Privacy
A clear summary of how Mediqa collects, uses, protects, and supports requests about personal data across the website, booking flows, and reserved product areas.
This notice applies to personal data processed through mediqa.it, demo requests, account registration, public booking pages, landing-demo calls, and the reserved SaaS workspace.
Mediqa Srl acts as controller for its website, demo requests, account setup, platform security, billing, and commercial communications. For patient and workspace operations managed for a healthcare customer, the customer normally acts as controller and Mediqa acts as processor under the applicable agreement. Privacy requests can be sent to info@mediqa.it.
Depending on the flow, Mediqa may process identification and contact data, organization data, account credentials, requested service, selected appointment slot, message or note content, booking references, call metadata, consent markers for landing-demo calls, billing data, integration status, technical logs, audit events, and workspace configuration.
Data is processed to answer demo requests, create and protect accounts, provide the SaaS service, manage public bookings, route calls and follow-ups, send operational notifications, sync authorized calendars, process payments, prevent abuse, keep audit evidence, comply with legal obligations, and manage requested commercial contact.
Personal data is kept for the time needed for the relevant purpose and then deleted, anonymized, or retained only where required for security, accounting, legal claims, audit, or contractual obligations. Customer workspace data follows the retention settings and written instructions agreed with the customer.
Depending on the enabled configuration, data may be processed by providers used for hosting, database and authentication, email delivery, telephony and voice AI, calendar synchronization, payments, rate limiting, security, logging, support, and consent-based public-page measurement. The current codebase integrates or prepares integrations with Supabase, Twilio, ElevenLabs, Google Calendar/Workspace, Stripe, SMTP email delivery, Google Analytics/Google Tag Manager, Meta Pixel, and a rate-limit store where configured.
Some providers may process data outside the European Economic Area depending on the chosen account, region, or service. Where this happens, Mediqa relies on applicable adequacy decisions, Standard Contractual Clauses, Data Processing Agreements, and supplementary safeguards where required.
Where applicable, individuals may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent by writing to info@mediqa.it. Requests related to a healthcare organization's workspace may be redirected to that organization when it acts as controller. Individuals may also lodge a complaint with the competent supervisory authority.
Mediqa uses access controls, workspace separation, secure session handling, request guards, webhook signature checks where enforced, rate limiting where configured, audit-oriented logs, least-privilege service keys, and operational safeguards designed to protect platform and customer data.
The application uses technical cookies and equivalent local/session storage for language, authentication, security, booking/demo handoff, and reserved-area usability. Optional support for Google Analytics 4, Google Tag Manager, and Meta Pixel is disabled by default, gated by environment configuration and granular consent, and limited to public marketing pages.
A GDPR certification, where pursued, must be issued by an accredited certification body for a defined processing scope. This notice is one accountability document and must be kept aligned with the technical controls, processor agreements, retention schedule, and certification dossier.
