Privacy Notice
How SmartHallux® BV processes the personal data of people who visit the site, book a visit or contact us. Controller, purposes, legal bases and rights.
In force from 3 October 2026 · version 2.1 (version 2.0 was dated 22 September 2026: this version adds Cloudflare among the providers, and YouTube videos). It entirely replaces the privacy notice of the previous website, which described services no longer in use. This is a courtesy translation: in the event of any discrepancy, the Italian text prevails — read the Italian original.
In brief
You do not need to read everything to understand the essentials.
- The controller is SmartHallux® BV, a Dutch company with its registered office in Amsterdam.
- Browsing the site does not require you to identify yourself. Statistics and advertising cookies are activated only if you accept them, and you can change your mind at any time.
- If you book a visit, the data are collected on our behalf by the SimplyBook platform. The very fact that you book an orthopaedic visit is data concerning health, and we process it with the enhanced safeguards required by law.
- We do not sell your data and we do not disclose it to third parties for their own purposes.
- You can ask at any time to see, correct or erase what concerns you by writing to info@smarthallux.com.
1. Who processes your data
Controller
SMARTHALLUX B.V.
Poortland 66 — 1046 BD Amsterdam, the Netherlands
Registration number (KvK): 91567327 — VAT number: NL865698077B01
Email: info@smarthallux.com — Telephone: +39 02 400 443 60
We operate in Italy (Milan, Rome, Naples), in the Netherlands (The Hague), in Spain (Madrid) and in the United Kingdom (London). The registered office in Amsterdam is distinct from the clinic in The Hague.
For any request concerning your data you can write to the address above, stating “privacy” in the subject line.
2. What we collect, why, and on what legal basis
We do not collect anything “in general”: each item of data has a specific purpose and a specific legal basis.
2.1 Browsing the site
| Data | IP address, browser and device type, pages viewed, date and time, referring page |
|---|---|
| Why | To make the site work, keep it secure and diagnose malfunctions |
| Legal basis | Legitimate interest (Art. 6(1)(f) GDPR) in providing and protecting the service |
| How long | Server technical logs: a maximum of 12 months |
These data are necessary for the technical operation of the site and do not require consent. We do not use them to profile you.
2.2 Usage statistics — only with your consent
| Tool | Google Analytics 4 (identifier G-PD1RQ4P5ZG), loaded via Google Tag Manager |
|---|---|
| Data | Device identifier, pages viewed, duration, referral source, approximate location data |
| Why | To understand which content is useful and to improve the site |
| Legal basis | Consent (Art. 6(1)(a) GDPR) |
| How long | 14 months from collection |
If you do not consent, these tools are not loaded at all: this is not a partial deactivation.
2.3 Advertising and remarketing — only with your consent
| Tools | Google Ads and Google Marketing Platform (DoubleClick); Meta Pixel (identifier 379314814967800) |
|---|---|
| Data | Advertising identifiers, pages visited, actions taken on the site |
| Why | To measure the effectiveness of our ads and show you our messages on other websites and on social media |
| Legal basis | Consent (Art. 6(1)(a) GDPR) |
| How long | Up to 24 months, according to the settings of the respective platforms |
A clarification we consider it our duty to make. The pages of this site discuss conditions of the foot. If you consent to advertising, the platforms record which pages you have visited, and an interest in a health condition can be inferred from this. For this reason, consent to advertising is separate from consent to statistics and, if you refuse it, the site works in exactly the same way.
With regard to Meta Platforms Ireland Ltd, we act as joint controllers solely for the collection of data through the pixel, in accordance with Meta’s joint controller addendum; the subsequent stages are processed by Meta as an independent controller.
2.4 Booking a visit
| Where | On the SimplyBook.me platform (smarthallux.simplybook.it), which you reach from our site via a link |
|---|---|
| Data | First name, surname, email, telephone, chosen location and service, date and time, any notes |
| Why | To schedule, confirm and manage the appointment |
| Legal basis | Performance of a contract or of pre-contractual measures (Art. 6(1)(b)) and, for the health-related part, Art. 9(2)(h) GDPR — purposes of preventive medicine, medical diagnosis and the provision of health care |
| How long | For the time necessary to provide the service and to meet subsequent record-keeping obligations |
This is data concerning health. Booking a foot surgery visit reveals an interest in a clinical condition, and the law gives it enhanced protection. SimplyBook acts as a processor on our behalf.
We ask you not to enter detailed clinical descriptions in the notes field: bring them to your visit, which is the appropriate place for them.
2.5 Direct contact: email, telephone, WhatsApp
| Data | Those you provide to us: contact details and the content of the message |
|---|---|
| Why | To reply to you |
| Legal basis | Pre-contractual measures or legitimate interest in responding (Art. 6(1)(b) / 6(1)(f)); explicit consent (Art. 9(2)(a)) if you spontaneously send us information about your health |
| How long | 24 months from the last exchange, unless the law requires otherwise |
About WhatsApp. The service belongs to Meta, and the metadata of the conversation are processed by Meta under its own terms, over which we have no control. Use WhatsApp for organisational information — opening hours, locations, how to get there. For clinical descriptions, medical reports or photographs, prefer email or, better still, the visit.
2.6 Video consultation
The connection takes place on Google Meet. We do not record the sessions. What you tell us during the consultation is processed for the purpose of providing health care (Art. 9(2)(h)).
2.7 Social networks
The icons of our profiles on Facebook, Instagram, X and YouTube are simple links, not embedded widgets: they transmit no data until you click on them. Once you are on the platform, that platform’s privacy policy applies.
2.8 Videos
Some pages contain YouTube videos (Google Ireland Ltd). When the page opens you only see an image stored on our site and no data is sent to YouTube; the player loads from the youtube-nocookie.com domain only when you press play, and from that moment YouTube processes the playback data in accordance with its own privacy notice.
3. Who else sees your data
We do not sell, rent or disclose personal data for the purposes of others.
Access is limited to:
- the medical and administrative staff of our clinics, within the scope of their duties;
- the providers that process data on our behalf, appointed as processors under Art. 28 GDPR: SimplyBook.me (bookings), the site’s hosting provider, Cloudflare, Inc. (the network that delivers the pages and protects them from attacks: it processes the IP address and the technical data of each request), the email service provider, Google Ireland Ltd (analytics and advertising, if you have consented), Meta Platforms Ireland Ltd (advertising, if you have consented);
- the authorities, where required by law.
The complete and up-to-date list of processors is available on request.
4. Transfers outside the European Union
Some providers belong to groups headquartered in the United States. Where this involves a transfer, it takes place on the basis of:
- the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for providers participating in it (Google LLC, Meta Platforms Inc. and Cloudflare, Inc. are listed as certified); or
- the standard contractual clauses approved by the Commission, together with a transfer impact assessment.
Booking data and health data remain within the European Economic Area.
You can request a copy of the safeguards adopted by writing to info@smarthallux.com.
5. How long we keep data
| Data | Retention |
|---|---|
| Server technical logs | 12 months |
| Statistics (GA4) | 14 months |
| Advertising data | up to 24 months |
| Bookings | duration of the service and subsequent record-keeping obligations |
| Correspondence | 24 months from the last contact |
| Proof of cookie consent | 12 months from the choice |
Once these periods expire, the data are erased or irreversibly anonymised.
6. Your rights
You can exercise at any time, free of charge, the rights provided for in Articles 15-22 GDPR:
- access — to know what data we hold and obtain a copy;
- rectification — to correct inaccurate or incomplete data;
- erasure — to request that they be deleted, where there are no retention obligations;
- restriction — to request that they be stored but not used;
- portability — to receive them in a machine-readable format, or have them transmitted to others;
- objection — to object to processing based on legitimate interest, including profiling;
- withdrawal of consent — at any time, without affecting the lawfulness of processing carried out before.
How: write to info@smarthallux.com. We reply within one month, which may be extended by two further months in complex cases, in which case we will inform you. For cookies you do not need to write to us: you can change your choices via the “Cookie preferences” link at the bottom of every page.
Complaint. If you believe that the processing infringes the law, you can lodge a complaint with a supervisory authority.
- Lead supervisory authority, competent for SmartHallux® BV: Autoriteit Persoonsgegevens (the Netherlands) — autoriteitpersoonsgegevens.nl
- You can also contact the authority of the country in which you live or work: in the United Kingdom, the Information Commissioner’s Office (ICO).
7. Security
We adopt technical and organisational measures appropriate to the risk: encryption of communications (HTTPS across the entire site), named access limited to those who need it, system updates, backups. No measure is infallible: should a breach occur that is likely to result in a high risk to your rights, we will inform you, as provided for by Art. 34 GDPR.
8. Minors
Our services are intended for adults. Services for minors are requested and authorised by the holder of parental responsibility, and in that case we process the minor’s data on that person’s instructions.
9. Automated decision-making
We do not carry out decision-making based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. No clinical decision is taken by an automated system.
10. Changes
If the tools we use or the purposes change, we update this document and change the date at the top. When the change is substantial, we will notify you on the site and, where required, ask you for fresh consent.
For cookies and other tracking tools, details are available in the Cookie Policy (in Italian).