Privacy notice

Who is responsible for your data

The data controller is Dott.ssa Barbara Shkodrani (Studio Dott.ssa Barbara Shkodrani), Via Barnaba Oriani 100, Roma. Contact: barbarashkodrani@gmail.com. Registration with the Medical Board: Ordine dei Medici di Roma n. 66942. The practice decides why and how your data is used. It has not appointed a Data Protection Officer; if that changes, this notice will say so.

The role of NodeMed

NodeMed supplies the website and the booking system and processes your data only on the practice's instructions, as a processor under Article 28 GDPR. It does not decide what happens to your data and does not use it for its own purposes. These other suppliers are involved, each for one job:

• Supabase — database and file storage · European Union (Ireland)
• Vercel — running and delivering the application · European Union, with a parent company in the United States
• Brevo — sending transactional email (confirmations, reminders) · European Union (France)
• Stripe — collecting the deposit, where one is asked for · European Union (Ireland), with a parent company in the United States

What is collected, and what it reveals

When you book: your name, email address, telephone number, the treatment requested, the date and time, and anything you write in the notes field. When you order a product: the same details plus the item. When you leave a review: the name you type and what you write.

• The treatment you choose can reveal information about your health. Under Article 9 GDPR that is a special category of data, and it is collected only because you asked for that appointment.
• The notes field is free text. Please do not write clinical details there: it is meant for practical information, and anything you type is stored as you typed it.
• A record of your consent is kept — the moment, the version of this notice, and your IP address — so the practice can show what you agreed to and when.

Why, and on what legal basis

• To handle your booking or order and to contact you about it — steps taken at your request before and during a contract (Art. 6.1.b GDPR), and your explicit consent for the health-related part (Art. 9.2.a GDPR).
• To send you the confirmation, any reminder, and the link with which you can move or cancel the appointment — same basis.
• To publish a review you chose to submit — your consent (Art. 6.1.a), which you may withdraw at any time.
• To keep accounting records where a deposit was paid — a legal obligation (Art. 6.1.c).
• To keep the practice's own audit trail of who did what with your record — the practice's legitimate interest in being able to account for its own actions (Art. 6.1.f).

Consent, and taking it back

Where processing rests on your consent you can withdraw it at any time by writing to the practice, and that does not make what happened before it unlawful. Withdrawing consent for the booking means the practice can no longer manage the appointment; a review is unpublished on request.

How long it is kept

• Booking and order data: for as long as the relationship with the practice lasts, and afterwards only for what the law requires.
• Accounting records for a paid deposit: ten years, as Italian law requires.
• The delivery log of emails sent to you: kept while it is useful to show whether a reminder arrived.
• A published review: until you ask for it to be removed.
• The consent record: as long as the underlying data, because it is the proof of the basis for holding it.

Who else sees it

The practice's own staff, each within the sections they are given access to; the suppliers listed above, each only for the job named; and anyone the law requires. It is not sold, and it is not used to advertise anything to you.

Where it is processed

In the European Union. Two of the suppliers above have parent companies in the United States: any transfer outside the EEA relies on the European Commission's standard contractual clauses. You can ask the practice for a copy.

Automated decisions

There are none. Availability is calculated from the practice's own opening hours, and every appointment is confirmed, moved or cancelled by a person.

Your rights

Write to barbarashkodrani@gmail.com to ask for access to your data, correction, erasure, restriction, portability, or to object to processing. The practice must answer within one month. If you are not satisfied you may complain to the Garante per la protezione dei dati personali (garanteprivacy.it) or to the authority of the country where you live.

Cookies

No advertising cookies, no profiling, nothing loaded from third parties. What there is, in full:

• `lang` — the language you chose. Technical: it makes the site work the way you asked.
• `mb_session` and `mb_mfa` — only for the practice's own staff while they are signed in.
• `nm_cookie` — the choice you made in the cookie banner, kept for twelve months.
• Measurement of the booking journey: it counts how many people open the page, start and finish. It uses no cookie and does not identify you, and you can refuse it. Refusing means no event is sent at all.

Changing your mind about cookies

The link at the bottom of every page reopens the choice. It is the same choice, and the previous one is replaced immediately.

Changes

This notice is version 2026-09. If it changes materially, the new version is published here and consent is asked again where it is required.