Privacy and cookie policy

Last updated: November 4, 2026

This policy explains how personal data is processed when you visit developer.myhealthbox.eu or contact us through the site, in accordance with Regulation (EU) 2016/679 (GDPR) and Italian data protection law. It covers this website only. The use of the myHealthbox API with a developer account is governed by the API terms and conditions, and the API itself (api.myhealthbox.eu) has its own documentation.

1. Data controller

The data controller is myHealthbox, Via Spadolini 11/B, 20141 Milano, Italy, VAT IT09255870967.
For any question about this policy or your personal data, write to info@myhealthbox.eu.

2. Data we process

• Contact form: your name, company (optional), email address and the text of your message.
• Technical data: your IP address, which is recorded in our web server and security logs and included in the email that forwards your contact request to our team, together with browser and device information sent automatically by your browser.
• Analytics data, only if you accept analytics cookies: information about your visit collected by Google Analytics (pages viewed and for how long, the page or search engine that brought you here, browser, device and screen size, approximate location derived from your IP address; Google Analytics 4 does not log or store the IP address itself). It does not know your name or email address.

Providing your contact details is voluntary, but without them we cannot answer your request.

3. Purposes and legal bases

• Answering your requests and any related pre-contractual exchange: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in replying to the people who contact us).
• Security of the site and prevention of spam and abuse, including Google reCAPTCHA on the contact form and server logs: Art. 6(1)(f) GDPR (our legitimate interest in protecting the site and our systems).
• Audience measurement with Google Analytics: Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code, only with your consent, which you can withdraw at any time.

We use your details only to answer your request. We do not use them for marketing, we do not sell them and we do not make automated decisions about you.

4. Cookies

We use the following cookies and similar technologies:

Analytics cookies are set only if you click “Accept” in the cookie banner. Until you accept, the Google Analytics script is not even loaded, so no analytics data reaches Google; if you click “Reject”, or make no choice, nothing is sent. Rejecting after an earlier acceptance also deletes the Google Analytics cookies from your browser. The banner offers “Reject” and “Accept” with equal prominence, and rejecting does not limit your use of the site.

You can change or withdraw your choice at any time from Cookie settings, a link also available at the bottom of every page. You can also delete cookies from your browser settings.

5. Recipients

Your data is processed by our authorised staff and by the following recipients:

• our hosting and email service providers, acting as data processors on our behalf under Art. 28 GDPR;
• Google (Google Ireland Limited and Google LLC), for Google Analytics (only with your consent, as our processor under Google's data processing terms) and for Google reCAPTCHA, which is loaded only when you start using the contact form and then receives your IP address and browser information to protect the form from spam. See the Google Privacy Policy.

The fonts, style sheets, scripts and icons of our pages are served from our own servers, so loading a page does not send your IP address to third-party content providers: Google receives data only when you use the contact form (reCAPTCHA) or accept analytics cookies (Google Analytics). We do not disclose your data to other third parties unless required by law.

6. Transfers outside the European Economic Area

Using Google services may involve transferring data to the United States. These transfers rely on the EU-US Data Privacy Framework, under the European Commission adequacy decision of 10 July 2023 (Art. 45 GDPR), and, where applicable, on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

7. Retention

• Contact requests and related correspondence: 24 months after our last contact with you.
• Server and security logs: 12 months.
• Google Analytics data: the data about individual visits (events) for 2 months and the data linked to the identifier in the cookie (user-level data) for 14 months, after which only aggregated statistics remain.

After these periods the data is deleted or made anonymous, unless we must keep it longer to comply with a legal obligation or to establish, exercise or defend legal claims.

8. Your rights

Under Articles 15 to 22 GDPR you have the right to access your personal data, to have it rectified or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time, for analytics cookies from “Cookie settings” at the bottom of each page, without affecting the lawfulness of the processing carried out before withdrawal.

To exercise your rights, write to info@myhealthbox.eu. We reply within one month of receiving your request; this period may be extended by two further months for complex requests, in which case we will tell you within the first month.

9. Complaints

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU Member State where you live or work.

10. Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it was last changed.