Privacy Notice
Last updated: 16 October 2026
This notice is provided by Medilust S.r.l. pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) to those who interact with the website medilust.com. This is an English translation; in case of discrepancy, the Italian version prevails.
1. Data Controller
The Data Controller is Medilust S.r.l., registered office at Piazzetta Ado Furlan 4, 33170 Pordenone (PN), Italy. VAT: IT01999240938. Contact: privacy@medilust.com — certified email (PEC): medilustsrl@pec.it.
2. What we do
Medilust develops and provides "Mami AI", a digital platform for dental practices that includes appointment management, patient communication via WhatsApp Business, AI voice telephony and practice administration.
This notice covers the processing of personal data carried out by Medilust S.r.l. as Data Controller with regard to:
- users visiting the website medilust.com;
- people requesting information or a demo of Medilust's services.
This notice does not cover the processing of personal data of dental practices' patients carried out through the Mami AI platform, including health data. For such processing, Medilust S.r.l. acts as Data Processor on behalf of the dental practice, which is the Data Controller and provides patients with the relevant notice.
3. What data we process
- Identification and contact data (first name, last name, email address, phone number) of those requesting a demo or information;
- Dental practice data: practice name;
- Browsing data: IP address, browser type, date and time of the request and other technical data automatically collected by IT systems while the site is being browsed.
4. Purposes, legal basis and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Handling booking and information requests ("Book a demo" form) | Pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR). | 24 months from the last contact, unless a contract is subsequently concluded. |
| Compliance with legal obligations (only if the service is purchased) | Compliance with a legal obligation (Art. 6(1)(c) GDPR). No consent is required. | 10 years from the end of the service (tax and civil-law obligations), unless a different term is set by the requesting Authority. |
| Security of the site and platform, prevention of unauthorised access and abuse, detection of cybercrime | Legitimate interest of the controller in ensuring the security and integrity of its IT systems and of the data processed (Art. 6(1)(f) GDPR) | 12 months from collection, unless further retention is needed to investigate security incidents or to defend a legal claim |
5. Whether providing data is mandatory
For booking and information requests, providing the data marked as mandatory is necessary to handle the request; failing to provide it makes it impossible to fulfil. Browsing and platform usage data are collected automatically by IT systems in the course of their normal operation.
6. How data is processed
Processing is carried out with electronic and/or paper tools, strictly in line with the stated purposes and in any case so as to ensure the security and confidentiality of the data, adopting technical and organisational measures appropriate to the risk (Art. 32 GDPR). No automated decision-making, including profiling, within the meaning of Art. 22 GDPR is carried out for the processing described in this notice.
7. Recipients of the data
Data is processed by the Controller's staff and collaborators who are authorised and instructed pursuant to Art. 29 GDPR and Art. 2-quaterdecies of Italian Legislative Decree 196/2003. To the extent strictly necessary for the stated purposes, data may also be processed by the following providers, appointed as Data Processors under Art. 28 GDPR:
- Hetzner Online GmbH — Industriestr. 25, 91710 Gunzenhausen (Germany): hosting of the servers running the website and the internal request-management systems, with data centres in Germany;
- Google Ireland Limited — Gordon House, Barrow Street, Dublin 4 (Ireland): business email service (Google Workspace), used to reply to the requests received.
Where necessary, data may also be disclosed to tax and legal advisors, banks and public authorities in the cases provided for by law, who will process it as independent controllers. Data is never sold to third parties. The up-to-date list of Data Processors can be requested from the Controller using the contact details in section 1.
8. Transfers outside the EEA
Personal data is stored and processed mainly within the European Economic Area (EEA). The website and the request-management systems are hosted on servers located in Germany. As regards the email service provided by Google, data may be processed by its parent company Google LLC or its affiliates in the United States: any such transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, to which Google LLC adheres, and, additionally, on the Standard Contractual Clauses approved by the European Commission (Arts. 45 and 46 GDPR).
Data subjects may request further information on transfers and obtain a copy of the safeguards adopted by contacting the Controller using the details in section 1.
9. Your rights
With regard to the processing described, data subjects may exercise the following rights:
| Right | Description |
|---|---|
| Right of access (Art. 15) | Obtain confirmation of whether data is being processed and learn the purposes, data categories, recipients, retention period and source of the data, and obtain a copy. |
| Right to rectification (Art. 16) | Have inaccurate data corrected and incomplete data completed. |
| Right to erasure (Art. 17) | Have data erased when no longer necessary, when an objection is upheld or when processing is unlawful, subject to statutory retention obligations. |
| Right to restriction (Art. 18) | Have processing restricted in the cases provided by law (e.g. when the accuracy of the data is contested). |
| Right to data portability (Art. 20) | Receive the data in a structured, machine-readable format and transmit it to another controller, where processing is based on a contract or pre-contractual measures and carried out by automated means. |
| Right to object (Art. 21) | Object at any time, on grounds relating to one's particular situation, to processing based on the Controller's legitimate interest. The Controller will stop processing unless it demonstrates compelling legitimate grounds or the need to establish, exercise or defend legal claims. |
| Right to lodge a complaint (Art. 77) | Without prejudice to any other remedy, if you believe that the processing of your personal data infringes the GDPR, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at protocollo@gpdp.it or PEC protocollo@pec.gpdp.it. |
The exercise of these rights is subject to the limits and procedures set out in Regulation (EU) 2016/679. The Controller will respond without undue delay and in any event within one month of the request, extendable by two further months where necessary given the complexity of the request, informing the data subject of the reasons. To exercise your rights, write to the Controller using the details in section 1.
10. Changes
Last updated: 16 October 2026. The Controller may amend or update this notice, including as a result of regulatory changes. Changes will be published on this page with the date of the last update.