PRIVACY NOTICE (Rehably)
Rehably is committed to respecting your privacy and protecting your personal data. This Privacy Notice explains clearly how we collect, process, and safeguard your data when you use our online Services, including our website, platform, and mobile applications (collectively, the “Services”), regardless of where you access them.
This Notice also informs you about your personal data protection rights and how the law protects them.
Users of our Services may be healthcare professionals or patients of healthcare professionals, unless otherwise specifically indicated.
Updated version: 28/10/2025
1. Purpose of this Privacy Notice
This Privacy Notice explains how Rehably collects, uses, and protects your personal data when you use our Services. This includes data you may provide when you subscribe to our newsletter, take part in a free trial, or request a demo.
This Notice applies to the following categories of users:
- Healthcare professionals who provide healthcare services as a business activity (either as individuals or as legal entities) and who use our Services directly.
- Representatives of healthcare professionals organized as companies, such as employees or collaborators, who access our Services on behalf of their employer.
- Patients who access our Services as part of the treatment they receive from a healthcare professional.
From this point onward, these individuals will also be referred to as “Users”, “you”, or “your”.
We invite you to read this Notice together with any other specific privacy notices we may provide to you at specific times when we collect or process your personal data. This Notice supplements those communications and does not replace them.
Data Controller
The Data Controller of your personal data is Environet di Angoni Lorenzo (also referred to as “Rehably”, “we”, “us”, or “our”), which determines the purposes and means of processing your personal data.
When we process personal data on behalf of others, we may act as a Data Processor. In some situations, we may perform both roles, as explained in this Notice.
Contact details
If you have any questions about this Notice or our privacy practices, you can contact us as follows:
- Company name: Environet di Angoni Lorenzo
- Email: info@rehably.it
- Postal address: Via Repubblica 8/a, Mazzano (BS), Italy
You have the right to lodge a complaint with the data protection supervisory authority in your country. However, we ask that you contact us first, so we have the opportunity to address and resolve any issues directly with you.
Changes to this Notice and data updates
We regularly update this Notice. We may make changes from time to time; the updated version will take effect upon publication.
If the changes are significant, we will inform you through the Services, by email, or via other communication channels. We encourage you to periodically check this page to stay informed about our privacy practices.
It is important that the data we hold about you is accurate and up to date. Therefore, please let us know about any changes to your data during your relationship with us.
Links to third-party websites
Our Services may contain links to third-party websites, plug-ins, or applications. When you interact with these links, those third parties may collect or share data about you. We have no control over those websites and are not responsible for their privacy notices. We encourage you to always read the privacy notices of the websites you visit.
2. Data we collect
2.1 As Data Controller
Personal data or personal information means any information that identifies, relates to, or describes, directly or indirectly, an identifiable individual. This does not include anonymized data that cannot be used to identify you.
As Data Controller, we may collect, use, store, and transfer different types of personal data about you, grouped as follows.
Healthcare professional data
- Identity data: first name, last name.
- Contact data: billing address, shipping/delivery address, email, phone numbers.
- Customer relationship data: name of your business or employer, role or professional title, contact details, classification within our customer management system, information contained in communications between you and us or between us and your employer.
- Transaction data: payment details and information about products or services purchased.
- Technical data: IP address, login data, browser type and version, time zone, location, browser plug-ins, operating system, platform, and other technologies used to access the Services or receive our emails.
- Profile data: API token, email, account creation and modification dates, website settings.
- Usage data: information on how you use our Services.
- Marketing and communications data: preferences and consent to receive marketing materials, such as newsletters. You can withdraw consent at any time by unsubscribing or contacting us at info@rehably.it.
- Financial data: bank or credit card details provided, invoices, and other accounting information containing personal data.
- Service data: data provided by you to facilitate use of the Services and data generated by use of the Services, including analytics, statistics, and performance.
Patient data
- Usage data: information on how you use our Services, products, and preferences.
- Contact data: mobile phone number and email address.
- Identity data: first name, last name.
- Health data: access code, exercise programs, feedback, adherence to the program, videos and images of personalized exercises.
- Technical data: IP address, login data, browser type and version, time zone, location, browser plug-ins, operating system, platform, and other device technologies used.
Aggregated data
We also collect and use Aggregated Data, such as statistical or demographic data about groups of users. This data does not allow you to be identified directly or indirectly. If combined with personal data in such a way that it can identify you, it will be treated as personal data under this Notice.
Special categories of data
We do not collect Special Categories of Personal Data (such as information about race, religion, political opinions, health, genetic or biometric data, criminal offences, or criminal convictions) when we act as Data Controller.
Failure to provide data
If you do not provide the mandatory data required to deliver the Services, we may not be able to properly perform the contract and may have to cancel products or services, informing you promptly.
2.2 As Data Processor
We act as a Data Processor for Healthcare Professionals, collecting data on their behalf. In this role, our use and disclosure of data are limited by the agreements entered into with Healthcare Professionals.
This Notice does not reflect the privacy practices of Healthcare Professionals, and we are not responsible for their policies or practices. We do not monitor or verify their compliance with their respective notices.
For certain Patient data, we may act as a Data Processor, including health data received from Healthcare Professionals, such as assigned exercises and adherence to programs.
Data retention (as Data Processor)
In accordance with data protection law, the controller may request that personal data be returned or deleted at the end of the contract. If we do not receive instructions within 30 days after contract termination, we will permanently delete personal data from our systems.
3. How we collect data
We collect data about you using different methods, including:
a) Direct interactions
You may voluntarily provide personal data, such as Identity, Contact, and Financial Data, by filling in forms or communicating with us by post, phone, email, or other means.
In particular, we collect data when you:
- Request to use our products or Services.
- Create an account on our Services.
- Subscribe to newsletters, publications, or other services.
- Request marketing materials to be sent to you.
- Request further information from us.
b) Automated technologies or interactions
When you interact with our Services or our emails, we (and our third-party partners) automatically collect Technical Data about your device, your browsing actions, and usage patterns.
This data is collected through tools such as cookies and server logs. For more details on cookies and similar technologies, please see our Cookie Policy.
c) Third parties
We may receive personal data about you from various third parties, including:
- Providers of technical, payment, and delivery services: Contact, Financial, and Transaction Data.
- Public sources, such as LinkedIn: Identity and Contact Data.
- Healthcare Professionals and other parties for whom we act as Data Processor: personal data provided by them in connection with the Services offered.
4. How we use the data we collect
We use your personal data mainly to manage our Services and perform internal activities, in the following cases:
- Performance of a contract: where it is necessary to enter into or perform a contract with you.
- Legitimate interests: where it is necessary for our legitimate interests (or those of a third party), provided your fundamental rights and interests do not override those interests.
- Legal obligations: where we must comply with an obligation required by law.
Use of personal data as Data Processor
When we act as a Data Processor, we use personal data received through the Services exclusively for internal purposes connected with the Services, as provided by the contracts entered into with the Healthcare Professionals for whom we process data.
This use may include, by way of example:
- Extracting, analyzing, and communicating data.
- Preparing reports and documentation on Patient data.
- Managing recommendations and communications between Healthcare Professional and Patient.
- Activities related to providing and improving the Services.
Purposes / data / lawful basis table
| Purpose/Activity | Type of data | Lawful basis for processing (incl. legitimate interests) |
|---|---|---|
| Register you as a new User and create an account/profile | Identity; Contact | Performance of a contract with you; implicit consent |
| Provide our services to you, including: managing payments/fees/charges; collecting sums owed to us; operational management of the Services; provision of the Services | Identity; Contact; Financial; Transactions; Marketing and Communications; Customer relationship; Service Data; Health Data (of end patients) | Performance of a contract with you; necessary for our legitimate interests (to recover debts owed to us) and/or; implicit consent |
| Manage our relationship with you, which will include: notices about changes to terms or the Notice; requesting reviews/surveys; informational newsletters | Identity; Contact; Profile; Marketing and Communications; Customer relationship | Performance of a contract with you; necessary to comply with a legal obligation; necessary for our legitimate interests (keeping records up to date and studying product/service usage) and/or; implicit consent |
| Establish or defend legal rights | Identity; Contact; Profile; Usage; Marketing and Communications; Service Data | Necessary for our legitimate interests (protecting and asserting our legal rights, your legal rights, and the legal rights of third parties) |
Marketing and promotional offers
You may receive newsletters or promotional communications from us or on our behalf only if you have provided consent. We are committed to always offering you clear choices about how we use your data for marketing. In each communication you will find mechanisms to manage your preferences, and you can unsubscribe at any time through the Platform or by sending an email to info@rehably.it.
We may use your Identity, Contact, Technical, Usage, and Profile Data to determine which services or offers may be most relevant to you, so that we can personalize communications (an activity defined as “marketing”).
Cookies
You can set your browser to refuse all or some cookies, or to alert you when cookies are set or accessed.
Please note that if you disable or refuse cookies, some features of the Services may become unavailable or may not function properly.
For more information, see our Cookie Policy.
Change of purpose
We will process your personal data only for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose and that purpose is closely related to the original one.
If you wish to better understand the link between the original purpose and the new purpose, you can contact us for a detailed explanation.
If we need to use your personal data for unrelated purposes, we will notify you in advance, explain the lawful basis and, where required by law, obtain your explicit consent.
In accordance with applicable law, we may also process your data without consent or direct communication when required or permitted by law.
5. Disclosure of personal data
We may share your personal data for business and commercial purposes, such as operating the Services, with the following categories of recipients:
- Healthcare Professionals who use the Services to collect and process the data of their Patients.
- Service providers acting as Data Processors, providing IT, hosting, and system administration services (as indicated in the chapter “Transfers to third parties”).
- Affiliated companies, acting as controllers or processors, for business and commercial purposes.
- Professional advisors, including lawyers, bankers, auditors, and insurers, providing consulting, legal, banking, insurance, or accounting services.
- Regulators and other governmental authorities, where required by law.
- Third parties involved in corporate transactions, such as the sale, transfer, or merger of parts of our business or our assets, or acquisitions or mergers with other companies.
In these cases, new owners may use personal data in the same manner set out in this Privacy Notice.
6. International transfers of personal data
Where necessary, we may need to transfer your personal data to another country to provide the Services to you, for marketing purposes, or for customer relationship management.
Many of our external providers are based outside the country where you live, so their processing of your personal data may involve a transfer outside your country of residence.
How we protect data during transfers
Whenever we transfer your personal data outside your country, we take reasonable measures to ensure it receives a similar level of protection.
We transfer your personal data only to countries deemed to have an adequate level of personal data protection under applicable law.
For further details on the specific mechanisms we use for international transfers, please refer to the table in the PDF document (“Third-party providers (sub-processors) that process data on behalf of Rehably”).
7. Security of personal data
We adopt reasonable security measures to comply with applicable legal requirements and to prevent accidental loss, misuse, unauthorized access, alteration, or disclosure of your personal data.
While we strive to protect your personal data, we cannot guarantee the security of any data transmitted online. We limit access to personal data to employees, agents, collaborators, and third parties who have a business need to know. These parties process data only on our instructions and are subject to confidentiality obligations.
We also have procedures in place to deal with any suspected personal data breach and will notify you and the competent authority where required by law.
8. Data retention
We retain your data for as long as necessary to fulfill the purposes for which we collected it, including meeting contractual, legal, regulatory, tax, accounting, or reporting requirements.
The retention period may vary in the event of a complaint or if a dispute may arise regarding our relationship with you.
Once the appropriate retention period has expired, data will be securely deleted.
In some circumstances you can ask us to delete your data: see the “Data subject rights” section for more information.
9. Data subject rights
Depending on your country of origin, you may have the following rights:
- Request access to your personal data (data subject access request).
- Request rectification of the personal data held.
- Request erasure of personal data.
- Object to the processing of your personal data.
- Request restriction of processing of your personal data.
- Request the transfer of your personal data to you or to a third party, in a structured, commonly used, and machine-readable format (within the limits set out in the document).
- Withdraw consent at any time.
To exercise any of the rights listed above, contact us by email: info@rehably.it.