1. Who is responsible for your data
The data controller is Veridose, registered at Italy.
For any privacy-related question or to exercise your rights under the GDPR, write to privacy@veridose.it.
We have not appointed a Data Protection Officer because none of the triggers in Article 37 GDPR currently apply to our processing. We will appoint one and update this notice if that changes.
2. What data we collect
On the veridose.it landing page we collect only data you actively submit, plus the technical minimum required to deliver and protect the service.
2.1 Data you provide via the waitlist form
- Name — to address you correctly in follow-up emails.
- Work email — to contact you about the pilot programme and product updates.
- Role (physicist, oncologist, RTT, manager, researcher, other) — to tailor product information.
- Centre or institution (optional) — to evaluate pilot fit.
- Locale preference (EN / RO) — to communicate in your preferred language.
2.2 Data captured automatically
- IP address and user-agent string — captured when you submit the waitlist form, for abuse prevention and spam triage only.
- HTTP Referer header — to understand where waitlist traffic comes from at a coarse level. We do not link this to any third-party analytics.
- Submission timestamp.
We do not set tracking cookies, run third-party analytics scripts, or use advertising pixels on veridose.it. See our Cookie Policy for details.
3. Why we collect it (purposes and legal basis)
- Waitlist management and product updates. Legal basis: consent (Article 6(1)(a) GDPR). You give consent by submitting the form. You may withdraw it at any time.
- Selecting and onboarding pilot participants. Legal basis: steps prior to entering a contract at your request (Article 6(1)(b) GDPR).
- Preventing abuse and securing the service. Legal basis: legitimate interest (Article 6(1)(f) GDPR) in keeping the waitlist clean and the service operational.
- Complying with legal obligations (e.g. responding to lawful requests). Legal basis: legal obligation (Article 6(1)(c) GDPR).
4. Who else processes your data (sub-processors)
We use a small number of trusted vendors to deliver the landing page and the waitlist. They process your data on our instructions and under written data-processing terms.
- Google LLC (Google Workspace, Apps Script, Sheets) — Stores waitlist submissions in a private Google Sheet. Region: United States; Standard Contractual Clauses (SCCs) apply. Privacy notice.
- Netlify, Inc. — Static hosting, edge CDN, serverless functions for /api/waitlist. Region: United States; SCCs apply. Privacy notice.
- Google LLC (YouTube) — Hosts the optional explainer video. Embedded via youtube-nocookie.com; no cookies until the user clicks play. Region: United States; SCCs apply. Privacy notice.
Data transfers outside the European Economic Area are covered by the European Commission's Standard Contractual Clauses (SCCs, Decision (EU) 2021/914) and, where required, supplementary measures recommended by the European Data Protection Board.
5. How long we keep your data
- Waitlist entries are kept until (a) you ask us to delete your record, (b) you unsubscribe and do not interact for 24 months, or (c) the pilot programme officially ends and the records are archived for a further 2 years for audit purposes — whichever comes first.
- IP / user-agent / referrer data captured at submission is kept for 90 days and then deleted.
- Anything we are required to retain by law (e.g. for tax or anti-fraud) is kept for the period that law requires and then deleted.
6. Your rights
The GDPR gives you a set of rights over your personal data. You can exercise any of them by writing to privacy@veridose.it. We respond within 30 days (extendable by two further months for complex requests, per Article 12 GDPR).
- Access (Art. 15) — a copy of your data.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (Art. 17) — the “right to be forgotten”.
- Restriction of processing (Art. 18).
- Data portability (Art. 20) — receive your data in a structured, common, machine-readable format.
- Objection (Art. 21) — including objection to processing based on legitimate interest.
- Withdraw consent at any time (Art. 7(3)), without affecting the lawfulness of processing before withdrawal.
- Lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali.
7. Security
We protect waitlist data using industry-standard measures: TLS for all traffic in transit, access control on the underlying Google Sheet (limited to named team members), least-privilege credentials, and a shared-secret check between our /api/waitlist endpoint and the Apps Script webhook. No clinical or patient data is collected on this landing page, by design.
8. Automated decision-making
We do not make decisions about you using solely automated processing (Article 22 GDPR). Pilot selection is reviewed by a human.
9. Children
veridose.it is aimed at medical professionals. We do not knowingly collect data from anyone under 16. If you believe a child has submitted data, contact us and we will delete it.
10. Changes to this policy
We may update this notice as our processing changes. Material changes will be flagged on the landing page and, where required, sent to waitlist subscribers by email. The “Last updated” date at the top reflects the current version.
11. How to reach us
For privacy questions: privacy@veridose.it. For everything else: hello@veridose.it.