PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Article 50 of Regulation (EU) 2024/1689 (AI Act)
This Privacy Notice provides information regarding the processing of personal data carried out as part of the Oralthea24 Service (“Service”), which can be accessed by sending a text message to www.oralthea24.com to connect Users with dental needs (“Users” or “Data Subjects”) with dental practices and/or private-practice dentists participating in the Service (“Practices”), as well as for subsequent processing operations. Some information also pertains to the staff members of said Practices.
Users must be of legal age to access the Service.
The Service connects Users—data subjects—with dental practices to address their dental needs.
Please note that the Service does not provide medical care itself, but is intended solely to connect Users with medical practices, which will then, independently and in accordance with their respective authority, provide the appropriate medical care for each case.
1.1 Data Controller for the “Oralthea24” Service
Oralcare S.r.l., with registered office at Via Bruno Maderna 7, 30174 Mestre, Venice (VE), Tax ID / VAT No. 04981750278, contact email: privacy@oralthea24.com, acts as an independent data controller for the provision of the Service, which includes:
- voice interaction with the user via an AI voice assistant;
- Identifying the dental practice that is geographically and temporally closest to address the dental need requested by the user;
- handling the reservation and receiving payment of the booking fee from the User;
- sharing the firm’s contact information upon payment of the retainer fee;
- administrative, technical, accounting, and contractual management of the agreement with the medical practices;
- reporting on the performance of the Service, to the extent within its purview.
1.2 Independent Data Controllers for Health Care Services
The individual “Practices” act as independent data controllers for:
- the provision of health care services, including all procedures related to diagnosis, care, and dental treatment;
- the preparation of the clinical estimate and treatment plan;
- the provision, if any, of video consultation services made available through a dedicated management platform;
- the collection of payment for healthcare services rendered;
- reporting on the performance of the Service, to the extent within its purview.
For detailed information regarding the data processing activities carried out by the medical practices, please refer to the specific privacy notice on the processing of personal data that these practices will provide to Users when they begin receiving healthcare services.
1.3 Data Controllers
To provide the Service, Oralcare s.r.l. relies on its technology partners; please refer to the “Recipients” section for more information.
Some of the services—including calendar sharing, document management, and video consultation features—are provided through a dedicated management platform supplied by Oralcare S.r.l. itself, which, in this regard, acts as the Data Processor pursuant to Article 28 of the GDPR with respect to the dental practices.
2. CATEGORIES OF PERSONAL DATA PROCESSED AND SOURCES OF ORIGIN
The data processed as part of the Service are as follows.
2.1 User Data
- personal and contact information: first name, last name, phone number, and email address (if applicable);
- voice data and text transcripts: a transcript of the conversation with the AI voice assistant using speech-to-text technology;
- specific health-related data (Art. 9 of the GDPR): information regarding the User’s health status and dental needs voluntarily disclosed by the User during the phone call, for the sole purpose of providing the Service and connecting the User with the dental practice identified based on geographical proximity and availability;
- location data: geographic coordinates or addresses provided verbally by the User to identify the nearest facility (no geolocation is performed);
- financial and payment data: transaction results regarding the payment of the call right and related financial data for tax purposes;
- service reporting data: information on service performance for the purpose of reporting to participating practices.
2.2 Data on Practice Operators and Staff
- personal and professional information: first name, last name, professional title, and affiliated firm, for the purpose of enrolling in the Service;
- administrative and technical data: administrative and technical data related to access to and use of the management platform provided to the firms by the Service.
2.3 Sources of Origin
The data will generally be provided directly by the data subject.
Additional data may come from the practices, for example, in connection with reporting on the services provided as part of the Service.
3. PURPOSES OF THE PROCESSING AND LEGAL BASES
Data processing operations are carried out in accordance with the principles set forth in Articles 5, 24, 25, and 32 of the GDPR and, in particular, with the conditions for lawfulness under Articles 6 and 9 of the GDPR:
| Category: Affected Parties | Purpose of the Processing | Legal Basis | Nature of the Contribution |
| Users | 1. initial Contact and Appointment Scheduling: Answering the call and interacting with the User via an AI assistant; receiving the request and analyzing it to identify the practice and schedule an appointment for the requested service. | Implementation of pre-contractual and contractual measures (Art. 6.1.b GDPR) | Required to receive the service. If this information is missing, the service cannot be provided. |
| Users | 2. processing of special categories of health data for the Oralthea24 Service: receipt of the dental request via voice call and its processing for the sole purpose of providing the Service. | Explicit consent (Art. 9.2.a GDPR) given verbally or via a keypad, in accordance with the instructions provided by the AI voice assistant | Required to receive the service. If this information is missing, the service cannot be provided. |
| Users | 3. payment of the booking fee: sending a link via text message or another communication method provided by the Service, and collecting the booking fee. | Implementation of pre-contractual and contractual measures (Art. 6.1.b GDPR); Legal obligation (Art. 6.1.c GDPR). | Required to receive the service. If this information is missing, the service cannot be provided. |
| Users | 4. medical treatment, including via video consultation: medical examination, diagnosis, and treatment plan at the Practice. This purpose is pursued exclusively by the Practice. | Exclusive Jurisdiction of the Law Firm (Independent Practitioner) (Art. 9.2.h GDPR: medical treatment purposes and Art. 9.3 GDPR: professional confidentiality) | Regulated independently by the firm. |
| Users | 5. financial reporting: reporting of amounts accrued in connection with the Service. | Explicit, additional, and optional consent (Art. 9.2.a and 6.1.a of the GDPR) requested by the Firm directly from the User. | Optional: In the event of a refusal, reporting will be based solely on aggregated/anonymous data, and the healthcare service will still be provided. |
| Studio Staff | 6. registration and Account Management for Firms: registration of firms, and creation and configuration of firm accounts on the platform provided by the Service. | Performance of the contract (Art. 6.1.b GDPR) or legitimate interest on the part of the firm’s employees (Art. 6.1.f GDPR). | Required for law firms to use the platform. |
| All | 7. Cybersecurity 8. Exercise of rights: system protection, fraud prevention, and the protection of rights (including the right to a defense) in court proceedings. | Legitimate Interest of the Data Controller (Art. 6.1.f GDPR). For any processing of special categories of data in connection with the exercise of rights in court (Art. 9.2.f GDPR) | Necessary for system security and the exercise of rights. |
4. TRANSPARENCY IN AI ACT AND THE USE OF ARTIFICIAL INTELLIGENCE
In accordance with Article 50 of Regulation (EU) 2024/1689 (AI Act), Users are hereby informed that the Oralthea24 telephone service is provided exclusively through an automated Artificial Intelligence system (AI Voice Assistant) that meets the following requirements:
- Zero Data Retention (ZDR) policy: The AI technology used operates under strict Zero Data Retention provisions. Voice data and text transcripts processed by the AI system are not stored on the AI provider’s servers once the routing operation is complete.
- prohibition on Training Models: The AI technology provider is strictly prohibited from using Users’ conversations, prompts, or health data for the training, fine-tuning, or reuse of its commercial language models;
- no automated clinical decisions: The AI voice assistant solely connects users with medical practices, without making any diagnostic, therapeutic, or general health-related assessments.
Subsequent phone calls with the selected dental practice will, however, be subject to the personal data protection policies established by that practice.
5. CATEGORIES OF RECIPIENTS OF PERSONAL DATA
The personal data collected will never be disclosed. For the purposes indicated above, the data may be disclosed only to the following categories of recipients:
- authorized personnel of the Data Controller: employees and contractors of Oralcare S.r.l. who have been expressly trained and designated to manage the service and administrative matters.
- AI-powered voice assistance service providers: entities that provide the voice assistance infrastructure and speech-to-text conversion modules, designated as Data Processors pursuant to Article 28 of the GDPR;
- management platform providers: companies that supply and distribute management software infrastructure and related cloud storage;
- web service and IT infrastructure providers: companies responsible for managing the website, hosting servers, cookies, and cybersecurity;
- payment gateway providers: financial institutions and technology platform providers for the financial settlement of call rights (operating as Independent Entities);
- communication service providers: providers for sending SMS messages and transactional emails confirming reservations;
- Participating Dental Practices: local dentists and dental facilities to which the User’s data is transmitted following payment of the consultation fee, to facilitate the initiation of medical care (Independent Data Controllers);
- consultants and independent professionals: law firms, tax firms, and accounting firms to ensure compliance with regulatory obligations and protect the Data Controller’s rights;
- competent authorities: judicial bodies, law enforcement agencies, and financial authorities in the cases provided for by law;
- other data controllers, data processors, or authorized parties for purposes exclusively related to the Service.
6. TRANSFER OF DATA TO THIRD COUNTRIES
All processing, handling, and storage of personal data takes place within the European Economic Area (EEA).
If, for technical or operational reasons, it becomes necessary to use suppliers located outside the EEA, the transfer will take place only if there is an Adequacy Decision by the European Commission (Art. 45 GDPR) or upon the signing of Standard Contractual Clauses (Art. 46 GDPR), supplemented by additional security measures.
Personal data is retained for no longer than is strictly necessary to fulfill the purposes for which it was collected, in accordance with the principle of data minimization:
- Voice streams and AI transcriptions: immediate and irreversible deletion at the end of the conversation and routing to the management system (Zero Data Retention), with a maximum technical window for handling any error queues not exceeding 24 hours;
- User booking and contact information: retained for as long as necessary to complete the contact process and send the subsequent SMS or email notification.
- User administrative and accounting data related to the use of the Service: retained for 10 years in accordance with applicable tax and corporate law requirements.
- Credentials and user accounts for practice staff: retained for the entire duration of the agreement between Oralcare s.r.l. and the practice, and deleted upon withdrawal from or termination of the contractual agreement.
Data subjects may exercise at any time the rights provided for in Articles 15–22 of the GDPR, namely:
- right of access (Art. 15 GDPR): to obtain confirmation as to whether personal data is being processed and to access the relevant information;
- right to Rectification / completion (Art. 16 GDPR): to have incomplete or inaccurate data updated or corrected;
- right to erasure / “right to be forgotten” (Art. 17 of the GDPR): request the erasure of data in the cases provided for by law;
- right to restriction of processing (Art. 18 GDPR): to request the temporary suspension of processing in the cases provided for by law;
- right to notification (Art. 19 GDPR): the right to notify recipients in the event of rectification, erasure, or restriction;
- right to data portability (Art. 20 of the GDPR): to receive the data provided in a structured, machine-readable format and to transmit it to another data controller, in the cases provided for by law;
- right to object (Art. 21 GDPR): to object to processing in the cases provided for by law.
The data subject also has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning him or her or that similarly significantly affects him or her (Art. 22 GDPR).
Data subjects have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent given prior to the withdrawal.
Data subjects have the right to file a complaint pursuant to Articles 77 et seq. of the GDPR with a supervisory authority, which in Italy is the Italian Data Protection Authority.
The forms, procedures, and time limits for filing complaints are established and governed by applicable national law.
This complaint is without prejudice to any other administrative or judicial remedy; with regard to judicial actions for damages, in Italy, the action must be filed with the court having territorial jurisdiction.
11. PROCEDURES FOR EXERCISING RIGHTS
These rights may be exercised in the manner and within the time limits set forth in Article 12 of the GDPR, by sending a written notice to the Data Controller at the contact information provided above.
The Data Controller will provide an appropriate response as soon as possible and, in any case, within one month of receiving the request, except in cases of extension or justified refusal as provided for in Article 12 of the GDPR.
For any further information, please contact https://www.garanteprivacy.it/i-miei-diritti
The Data Controller reserves the right to modify or update this Privacy Policy, including in response to changes in regulations or technological developments related to the Service. The updated version will be available at all times on the website www.oralthea24.com.