Don't Care
Don't Care
This notice explains how we process personal data through the Site and Don't Care digital services, including PWA Cli and PWA Pro.
Don't Care s.r.l.
p.zza Guglielmo Marconi 1 int. 3, 17100 Savona (SV) - IT.
VAT 01932080094
Email: info@dontcare.it
Some processing involves health-related data (art. 9 GDPR): exercise records, perceived effort, pain before and after, notes, photographs, messages exchanged with your professional and the free text of requests sent to the studio. For health services provided by professionals whose qualification the centre has verified the basis is health care (arts. 6.1.b, 9.2.h and 9.3 GDPR), without consent. In centres that have enabled consents per purpose, sharing among professionals of content produced by others and health data in non-health services require a specific consent (arts. 6.1.a and 9.2.a GDPR), optional and revocable (next section). In centres that have not enabled them yet, the explicit consent (arts. 6.1.a and 9.2.a GDPR) collected in the app with the confirmation of the notice remains, and it is revocable.
Confirming that you have read the notice is an acknowledgement: it is not consent, it cannot be withdrawn and it waives no right. In centres that have enabled consents per purpose, consents are separate, optional choices, one per purpose and with nothing pre-selected: sharing among the centre’s professionals of content produced by others, and health data in non-health services. They are expressed in the PWA Cli, after the acknowledgement and at any time in Settings → Privacy and consents, or on paper with the centre’s form, which takes effect after the front desk verifies it (also for people without an account). For a minor the representative chooses; from 14 to 17 a minor with their own access can withdraw but not grant. Health services and bookings do not depend on these choices: a service the centre has not yet qualified cannot be booked until it does, and a health service is booked with a professional whose qualification the centre has verified. Withdrawal is as easy as consent (one tap in the app, or the front desk) and applies to the future: no new data are recorded on that basis and nothing more is shared. It is not erasure: the data are kept as stated below and their erasure or restriction can be requested. What counts is the purpose of each item of data: data linked to an appointment follow that appointment, and another health service by the same professional does not turn a non-health service into care. Content recorded before activation, documents and professionals’ private notes carry no indication of their basis: without the consent to health data in non-health services they remain usable only when verifiably linked to a health service; a specific share, even of a single document, does not override the withdrawal of another purpose. If the centre suspends the collection of new consents, choices already expressed are still respected and you can always refuse or withdraw.
The data you record is collected continuously and reviewed periodically by authorised staff. There is no real-time human monitoring and an immediate reply is not guaranteed: nobody is listening on the app moment by moment.
For an emergency, a sudden worsening or an urgent symptom do not use the Don't Care applications: call 112 or 118, or go to the emergency department.
A conversation is always opened by the professional; the client can reply inside the thread for a limited period. Message content belongs to the client's record and is not readable by the front desk or by the admin panel: it is read by the client, by their authorised representatives and by professionals who hold a current title on them, re-checked on every access. No read receipts and no typing indicators are recorded: they do not exist at all.
Requests sent through «Contact Don't Care» are an administrative service, not a clinical reply. Reason, channel and free text are read by the front desk, which routes them: this is a consequence of the model, because the client never opens a direct conversation. If the reason is «Question for my professional», it is the professional who will open the conversation; in centres that have enabled consents per purpose the free text of these requests is not shown to the front desk, which only sees reason, channel, status and dates, and it is read by the professional the request is assigned to. For the other reasons do not write information about your health. The studio states a take-in-charge deadline of one working day: it is not a clinical reply, it is not an emergency channel, and the deadline runs on working days.
A hold is a temporary reservation of a room and a professional, used by the centre to organise the agenda while a possible appointment is still to be confirmed, without creating a fake client record or a fake appointment. It is created by the centre’s authorised staff (administration and front desk) or by a professional for their own agenda. It contains the room and the site, the professional, the time, the status, who created or changed it and, once converted, the appointment it became. It is not linked to any client record and it may concern a person who is not yet registered. An optional note (at most 500 characters) may contain only the minimal reference needed to recognise the request, for example a name, also given by whoever asks for the time on behalf of someone else, for example a parent for a minor. Legal basis: legitimate interest of the data controller in organising the agenda (art. 6.1.f GDPR), with a documented balancing that is kept under review. The note must not contain health or clinical data, diagnoses, symptoms, the health reason for the request or any other special category of data: this is an organisational rule for whoever writes, not a technical control. The note can be read by the centre’s administration and front desk and by the professional the hold belongs to; a professional does not see colleagues’ holds. Holds never appear in the client applications (PWA Cli and App Cli). The front desk informs the person: at the time of collection if the reference comes from them; if it comes from someone else, within a reasonable period and at the latest within one month of obtaining it, or earlier at the first contact with them or at the first disclosure to another recipient. Publishing this notice is not enough on its own, and the information is not sent automatically by the application; if there is no way of informing the person, the note does not contain their reference. A person who is not registered can also ask to access, correct or erase the note, or object, by writing to info@dontcare.it: the request is handled manually by the centre.
The administration and front desk of the centres for which Don’t Care s.r.l. is the controller keep in the Frontoffice the PDFs of the contracts with professionals and collaborators, with their dates and expiry alerts. It concerns only professionals, collaborators and the contacts of counterparties that are companies or other entities, not clients. Personal data, contact details, signatures, relationship data and any economic, tax and bank data written in the contract are processed, together with a record of operations containing identifiers only. The legal bases are the performance of a contract (art. 6.1.b), legal obligations only for the data they cover — Article 2220 of the Civil Code, Article 22 of Presidential Decree 600/1973 and Article 39 of Presidential Decree 633/1972 (art. 6.1.c) — and legitimate interest in evidence and defence of rights, security and the contacts of legal persons (art. 6.1.f), with a documented balancing and the right to object: not consent. The feature is not meant for health data or data on criminal convictions. Only the centre’s administration and front desk have access; technical providers, including Microsoft Azure, are appointed as processors where required; advisers only when engaged; authorities when required by law. The data are hosted in an Azure region in the European Union; any transfer in the limited circumstances provided by Microsoft’s EU Data Boundary takes place under the Microsoft DPA and Chapter V GDPR. The full detail is in the in-app privacy notice, section «Professionals and collaborators: contracts and contractual documents», which the PWA Pro shows again for a read confirmation; those who do not use the app receive it by e-mail, certified e-mail (PEC) or against receipt.
If the centre offers them, some group sessions are open for booking: the front desk creates them, also as a recurring series, and the client books a seat from the PWA Cli after a summary with price and conditions. Payment takes place at the centre and the application processes no payment data; confirming a booking is not consent to the processing of data. The seat, the date and time of booking, undoing or cancellation, who acted (the client or the front desk), the channel and the reason for closing are recorded, together with a technical key that prevents double bookings. For sessions that took place, the front desk or the session's professional record attendance (present, absent or not recorded, which does not mean absent) with author and time; each correction adds a record. The client sees only their own bookings and the seats left, never the other participants or the attendance; front desk and administration see participants and attendance of the sites they manage, the professional those of their own sessions. Taking part gives the session's professional the same title as an appointment; cancelling the seat or the session removes only the title that came from that session. The basis is the performance of the contract for every kind of session; when the session is a health service provided by a health professional bound by professional secrecy, booking and attendance reveal information about health and are also processed for the purpose of health care (art. 9.2.h and 9.3 GDPR). In the PWA Cli, booking asks for confirmation of the current version of the notice. Without a connection: in the PWA Cli sessions, seats left and own bookings are read online only, are not kept on the device, and bookings and cancellations are never queued; in the PWA Pro, if the professional has enabled offline mode, the agenda with open sessions is kept on the device like the other appointments, may contain the participants' identifiers, expires 30 days after the last update and, shown without a connection, is marked as not verified and does not attest current seats or participants. Attendance and operations on bookings happen online only.
Access is limited to the professionals and authorised people involved in care, always within the centre concerned. A professional's title is re-evaluated on every read and ends immediately when the last one ends: a revoked or expired delegation, a voided appointment, the cancellation of the seat or of the open session it came from. An appointment that is cancelled but not voided, other appointments and active delegations keep it. For minors, the rules on representatives apply: being able to see someone's home tasks does not automatically give access to their conversations.
If the centre enables the feature, after a completed training session the athlete (or the representative of a minor) may report within 48 hours a few scores on a model defined by the centre — for tennis: technical, tactical, mental, tension, motivation, physical state and the coach’s question — and an optional note on their physical state; on home tasks they may report the feedback measures chosen by the centre (for example perceived effort) instead of the fixed fields. They are health-related data: in health services the basis is health care (arts. 6.1.b, 9.2.h and 9.3 GDPR); in non-health services, where the centre has enabled consents per purpose, the specific consent to health data (arts. 6.1.a and 9.2.a GDPR), without which they are not recorded; elsewhere the explicit consent collected in the app. They remain in the record with the same immutable revisions as every other value; they are read by the data subject, by authorised representatives and by professionals holding a current title, while the front desk and the admin panel do not read them. They feed the per-area averages and the moving average of the Progress view.
The centre may define thresholds on some measures. When a reported value crosses one, the professional of the training session (or of the home-task plan) receives a generic notification, without the value, with a link made only of technical identifiers; the delivery queue records only identifiers, status and an error code. The alert is sent at intervals, only if the recipient still holds a current title on the athlete and has a device with notifications enabled: it is not real-time monitoring, it guarantees neither reading nor intervention, and it is not an emergency channel. The professional records that they have seen it; the value stays in the record.
Push notifications carry no health data: the title and body are generic and localised, and the link carries at most technical identifiers, never names, dates or places. The content is read only by opening the application. For open sessions the professional receives the creation and the cancellation of the session, the client their own booking, their own cancellation and the cancellation of the session: these notifications open only the appointments section or the schedule, without identifiers of the session or of the client. Reminders, if enabled in the preferences, reach the participants and the professional as for any other appointment and carry only the appointment's technical identifier. No participant is told about the others and attendance triggers no notification.
In the centres that enable this feature, the front desk or the professional can send manually, from the Frontoffice calendar, an email reminder for a single appointment. Only the appointment’s main client receives it, at the address in their record. The message contains only the name of the centre and the date and time in the site’s time zone: no service, note, professional, other participant, attachment or link. It is sent from the mailbox frontoffice@dontcare.it with the Microsoft 365 mail service (Exchange Online); it is a service communication about an appointment already booked, within the management of the relationship (art. 6.1.b GDPR), with no additional consent and no promotional purpose. The application keeps neither the text nor a log of the messages; Microsoft 365 keeps its own technical traces of the mail service under its terms.
Accesses to minors' content are recorded after each operation that actually succeeded. Denied attempts are not recorded: a log of refused attempts would describe accesses that never happened. The logs never contain message content.
An archived conversation is not deleted: it is kept and made unreachable from any screen of the applications. Access goes through a dedicated administrative channel, reserved to people designated by name by the controller, requires a written reason and is recorded every time. It is allowed only for the exercise of data subject rights, a legal hold, or a request from the authorities. An administrator who is not designated has no access, and an archived conversation does not become visible again in the app if the pathway resumes: a new pathway gets a new conversation.
Where litigation, a request from the authorities or a documented obligation requires it, automatic deletion can be suspended. Every hold records who placed it, when and why, and it can be released leaving a trace of the release.
A deletion request immediately removes sessions, tokens, notification subscriptions and local data on the device. Any health documents subject to mandatory retention remain stored in a restricted area and are no longer accessible as an active account.
Data may be processed by authorised internal staff (admin, kinesiologist/pro) and technical suppliers providing hosting, maintenance and support, appointed as processors where required. Data are not publicly disclosed. For email reminders the mail service is Microsoft 365: under Microsoft’s Data Protection Addendum, Microsoft processes personal data as a processor (or subprocessor) and as an independent controller only for its own business operations incident to providing the service; Exchange Online is within Microsoft’s EU Data Boundary.
Infrastructure is hosted in the EU. Any extra-EU transfers, when necessary (e.g., email delivery tools or CDN), will comply with GDPR Chapter V (SCCs, adequacy decisions, supplementary measures).
The PWA may temporarily store technical data and content locally (IndexedDB/Cache Storage) to operate offline. These data are synced when the device is back online.
You can clear the PWA local data from your browser/device settings. Local deletion does not automatically remove data stored on the server.
You can exercise your rights of access, rectification, erasure, restriction, portability, objection and complaint to the competent Authority.
For requests regarding your personal data, please contact the Controller at the references above. We will respond within the GDPR timeframes.
This policy may be updated to reflect regulatory or technical changes. Please check it periodically.
We use technical cookies required for the Site to function. For details, see the Cookie page.