Dr. Federico Piazza Osteopath & Physiotherapist · Florence
IT Book

Privacy Policy

Last updated: 15 October 2026

This is an English translation of the Italian privacy policy, provided for convenience. If the two versions differ, the Italian version prevails.

1. Data controller

Federico Piazza, physiotherapist and osteopath, VAT no. 06731350481, tax code PZZFRC91T21A564C, Via Vittorio Gui 3, 50144 Florence (FI), Italy.

Email: dr.federicopiazza@gmail.com

2. Data processed and purposes

For each processing activity below we state its purpose and legal basis. The data requested in forms (your email for the free mini guide, checkout details for a purchase) is needed to provide the service you ask for: without it we cannot send you the content or complete the purchase. Providing it is always your free choice, as none of these services is compulsory.

Browsing data

The systems that run this website automatically collect some data whose transmission is inherent to the use of Internet protocols (IP address, browser type, operating system, pages visited, time of the request). This data is kept in the hosting provider's server logs for security and troubleshooting. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Website usage statistics

We use Umami, open-source web analytics software installed on our own infrastructure (self-hosted). It collects aggregated, anonymous data — pages viewed, referring site, country, device type, time spent on the page and interaction events (clicks on the main buttons and links with the area of the page, scroll depth, page sections viewed) — without cookies, without fingerprinting and without tracking users across websites. These events only measure how the pages are used overall and cannot be linked to an identified or identifiable person. Your IP address is never stored: it is used only in memory, for the duration of the request, to derive the country (not the city) and to generate a temporary session identifier, and is then discarded. Advertising click identifiers that may appear in the URL (e.g. "gclid", "fbclid") are removed before recording. Umami writes nothing to your device and respects the browser's "Do Not Track" signal. As this is anonymous, first-party measurement, treated like technical cookies under the Italian Data Protection Authority's guidelines of 10 June 2021, no consent is required and there is no cookie banner. Legal basis: legitimate interest in understanding, in aggregate form, how the website performs (Art. 6(1)(f) GDPR).

Campaign parameters (UTM)

When you reach the website from an ad, from a link on my social media profiles or from another tracked link, the URL may contain "utm_*" parameters showing where you came from (e.g. a Google Ads campaign or "Instagram"). Only these "utm_*" parameters are kept, in aggregated and anonymous form, to attribute visits and contact clicks to their source through the Umami statistics described above; other technical click identifiers (e.g. "gclid") are removed. So that attribution is not lost while you browse, the "utm_*" parameters stay in the address of the pages you open during the visit and are passed on with the online booking link; they are not saved on your device. If you buy a video guide, the same "utm_*" parameters (only the source, no personal data) are recorded with the order on Stripe, to know which channel sales come from. No advertising cookies are set, there is no individual profiling and the data is not shared with Google for marketing. Legal basis: legitimate interest in measuring the effectiveness of promotional activities (Art. 6(1)(f) GDPR).

Data you provide — buying a video guide

When you buy a video guide, you enter your name, surname, email and payment details in the checkout form run by Stripe. Payment details (card number etc.) never pass through or are stored on our servers — they are handled exclusively by Stripe. Your email address is added to our email system (MailerLite) to send the purchase confirmation and communications related to the service you bought. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). The data needed for tax and accounting obligations (recording the sale, any invoice) is processed and kept to comply with the law (Art. 6(1)(c) GDPR) and may be shared with the accountant who handles the controller's bookkeeping.

Data you provide — free content

If you request the free mini guide using the form on the video guide pages, we collect your email to send you the content and a series of educational emails about the condition you selected. Later emails may include information about the paid video guides. To understand which content is useful, MailerLite records whether an email is opened and whether the links in it are clicked. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time through the unsubscribe link in every email or by writing to dr.federicopiazza@gmail.com.

Data you provide — contacting me directly

If you contact us by email or WhatsApp, we process the data you provide only to reply to your request. Messages pass through the services of the respective providers (Google for email, WhatsApp for chat), listed in section 4. Please do not send health information through these channels beyond what is needed to book an appointment. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) or steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

3. Cookies and third-party content

The website does not set profiling or analytics cookies. The only cookies used are the following technical cookies, strictly necessary for the service and set only after you buy a video guide. For this reason there is no consent banner.

Name Purpose Duration
vg_spalla Checks access to the purchased Shoulder Video Guide 1 year
vg_schiena Checks access to the purchased Back Video Guide 1 year

These cookies contain no identifying personal data: they hold a cryptographic code (HMAC-SHA256) that verifies the purchase without storing the user's name or email. We do not use profiling cookies, analytics cookies or third-party marketing cookies. No consent is required.

Location maps

The maps showing the clinics on the location pages are static images generated from OpenStreetMap data (OpenFreeMap style) and hosted on our own servers. Your browser does not contact any third-party map service (Google or others) and no cookie is set. If you click a map or the "Open in Google Maps" button, you are taken to Google Maps in a new tab: from then on the Google privacy policy applies, as for any external link.

Course videos (Bunny Stream)

The guide videos and free previews are hosted and streamed by BunnyWay d.o.o. (Bunny.net), based in Slovenia (EU). The video player is embedded through an iframe: when the page loads it, your browser contacts Bunny.net's servers (located in the European Union), which receive your IP address to deliver the stream. The player does not use profiling cookies and does not track users across websites. Legal basis: legitimate interest in showing the website's video content and performance of the contract for purchased courses (Art. 6(1)(f) and 6(1)(b) GDPR). Bunny.net Privacy Policy

4. Processors and recipients

To provide the services we rely on the following providers, which process data on our behalf:

Stripe Payments Europe, Limited and Stripe, Inc.

Payment processing. Based in Ireland (EU) and the USA. For data processed in the United States, the transfer is covered by the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and by Standard Contractual Clauses. Stripe Privacy Policy

UAB MailerLite

Customer emails and newsletter. Based in Lithuania (EU), GDPR compliant. MailerLite Privacy Policy

BunnyWay d.o.o. (Bunny.net)

Hosting and streaming of the video courses. Based in Slovenia (EU). Bunny.net Privacy Policy

Vercel, Inc.

Website hosting. Based in the USA. Transfer outside the EU covered by the EU-US Data Privacy Framework and by Standard Contractual Clauses. Vercel Privacy Policy

Umami (open-source software, self-hosted)

Aggregated browsing statistics (pages visited, traffic sources, country, time on page) and anonymous interaction events (clicks on buttons and links, area of the page clicked, scroll depth, sections viewed, purchase confirmation with amount). None of this data can be linked to a natural person: no name, email or other identifier is collected. Umami uses no cookies, writes nothing to the device, does not track users across websites, does not store the IP address and respects "Do Not Track". Unlike a third-party SaaS service, this installation is self-hosted: the code runs on our own infrastructure and no data is sent to the company that develops the software. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Vercel, Inc. (statistics dashboard) and Neon, Inc. (database)

The self-hosted Umami installation runs on a second Vercel project, with the aggregated, anonymous data stored in a Neon PostgreSQL database in the Frankfurt data centre (EU). No identifying personal data passes through these services. Vercel Privacy Policy · Neon Privacy Policy

WhatsApp Ireland Limited

Messaging, if you choose to contact us on WhatsApp. Based in Ireland (EU); the Meta group may process data in the USA under the EU-US Data Privacy Framework. WhatsApp Privacy Policy

Google Ireland Limited (Gmail)

Email inbox used to reply to messages. Based in Ireland (EU); Google LLC may process data in the USA under the EU-US Data Privacy Framework. Google Privacy Policy

Accountant

For purchases only: receives the data needed for accounting and tax obligations, as a professional bound by professional secrecy.

5. Retention

  • Purchase and invoicing data: 10 years (accounting and tax obligation)
  • Email for service communications: until you ask for deletion or after 2 years of inactivity
  • Email for the free mini guide: until you withdraw consent (unsubscribe link)
  • Email and WhatsApp messages: as long as needed to handle the request and any relationship that follows
  • Server logs: for a limited period, no longer than 30 days
  • Umami statistics: kept in aggregated, anonymous form, with no data that identifies a person
  • Course access cookies: 1 year (then the cookie expires automatically)

6. Your rights

Under Articles 15–22 GDPR, you have the right to:

  • Access — obtain confirmation of whether personal data about you is processed and receive a copy
  • Rectification — have inaccurate data corrected
  • Erasure — ask for your data to be deleted ("right to be forgotten")
  • Restriction — ask for processing to be restricted in certain circumstances
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interest and, at any time and without giving reasons, to promotional communications
  • Withdrawal of consent — withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise these rights write to dr.federicopiazza@gmail.com. The request is free and you will receive a reply within one month.

7. Complaints

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), Piazza Venezia 11, 00187 Rome, or with the supervisory authority of the EU country where you live or work.

8. Other information

  • No automated decisions — we do not use automated decision-making or profiling that produces legal effects concerning you.
  • Minors — buying the video guides and signing up for the free content are reserved for adults.
  • Legal claims — data may be used, to the extent necessary, to establish, exercise or defend legal claims, or when requested by the competent authorities.
  • Changes — this policy may be updated; the date of the last update is shown at the top of the page.