Privacy policy

This policy covers people who visit medtools.care, fill in contact or information request forms, create an account, start the 90-day trial or purchase MedTool One, and people who contact our support team. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code).

Third-party websites reachable through links, such as the App Store and Google Play, have their own privacy policies.

• Contact details: first name, last name, email address and phone number you enter in our forms.
• Content of your requests: the message you send us and the information you share with our advisors.
• Account data: email and password used to access your account and complete your purchase.
• Order data: chosen product and payment plan, shipping and billing addresses, payment and instalment status, return or withdrawal requests. Card details are entered directly on the Stripe payment page: we do not store them.
• Browsing data: IP address, browser and device, pages visited, time spent and interactions with the website, collected through cookies and similar technologies according to the choices you make in the cookie banner.

Health data. MedTool One is a medical device for treating tinnitus, so you may tell us about your symptoms or health condition in your requests. You don't need to in order to receive information. If you choose to, we process that data only to answer and support you, based on your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.

For each purpose we list the GDPR legal basis and the retention period. At the end of that period, data is deleted or anonymised.

• Answer information requests and contact you by phone, SMS, WhatsApp or email

  Data

  Contact details, content of requests

  Legal basis

  Pre-contractual steps at your request (Art. 6(1)(b))

  Retention

  12 months from the last contact

• Notify you when the product is back in stock

  Data

  Email

  Legal basis

  Your request (Art. 6(1)(b))

  Retention

  Until the notification is sent, up to 12 months

• Create and manage your account

  Data

  Account data, contact details

  Legal basis

  Performance of a contract (Art. 6(1)(b))

  Retention

  Until the account is closed

• Manage trial, purchase, payments and instalments, shipping, returns, withdrawal, warranty and support

  Data

  Contact details, account data, order data

  Legal basis

  Performance of a contract (Art. 6(1)(b))

  Retention

  Contract term plus 10 years after it ends

• Meet tax and accounting obligations and medical device requirements such as traceability and vigilance

  Data

  Contact details, order data

  Legal basis

  Legal obligation (Art. 6(1)(c))

  Retention

  10 years or the period set by the applicable law

• Email you about products and services similar to those you have purchased

  Data

  Email

  Legal basis

  Legitimate interest (Art. 6(1)(f) GDPR and Art. 130(4) Italian Privacy Code)

  Retention

  Until you object, which you can do in every message

• Send you offers, news and promotions by email, phone, SMS or WhatsApp

  Data

  Contact details

  Legal basis

  Consent (Art. 6(1)(a))

  Retention

  Until withdrawn, up to 24 months from the last contact

• Measure website usage and improve its content

  Data

  Browsing data

  Legal basis

  Consent via the cookie banner (Art. 6(1)(a))

  Retention

  Cookie duration shown in the banner

• Show you relevant ads and measure advertising campaigns

  Data

  Browsing data

  Legal basis

  Consent via the cookie banner (Art. 6(1)(a))

  Retention

  Cookie duration shown in the banner

• Protect the website from abuse and fraud and defend our legal rights

  Data

  Data needed for the purpose

  Legal basis

  Legitimate interest (Art. 6(1)(f))

  Retention

  As long as needed, until claims are time-barred

We contact you to answer your request, tell you about MedTool One and the 90-day trial, and help you get started if you decide to. These contacts follow up on what you asked us and do not require separate consent.

We only send promotional messages unrelated to your request, on any channel, if you have given us your consent.

For WhatsApp messages we use the service provided by WhatsApp Ireland Limited, which also processes data under its own privacy policy. You can tell us at any time which channels you prefer or ask us to stop contacting you, either to the advisor directly or by writing to info@medtools.it

Fields marked with an asterisk in our forms are required: without them we can't answer your request, create your account or process your order. Consent to marketing and non-technical cookies is optional, and refusing it has no effect on your purchase or on support.

Your data is processed by authorised Med Tools Solutions S.r.l. staff bound by confidentiality, and may be disclosed to:

• Technology service providers appointed as data processors (Art. 28 GDPR): hosting and infrastructure for the website and purchase platform, form automation, cookie consent management (CookieScript).
• Stripe Payments Europe Limited, for payments and instalments.
• Google Ireland Limited, Meta Platforms Ireland Limited and Microsoft Ireland Operations Limited, for analytics and advertising through Google Analytics, Google Ads, Meta Pixel and Microsoft Clarity, only if you have accepted the related cookies.
• WhatsApp Ireland Limited, for messages sent via WhatsApp.
• Couriers and shipping companies, to deliver and collect the device.
• Consultants and professionals such as accountants and lawyers, bound by professional secrecy or confidentiality.
• Public and judicial authorities, where required by law.

We don't sell or publish your data. An up-to-date list of our data processors is available on request.

Some providers, such as Google, Meta, Microsoft and Stripe, may also process data in the United States or other countries outside the European Economic Area.

In these cases data is transferred only with the safeguards required by the GDPR: the European Commission adequacy decision on the EU-US Data Privacy Framework for certified providers, or the standard contractual clauses approved by the Commission (Art. 46 GDPR). You can request a copy of these safeguards by writing to info@medtools.it

• Technical cookies, needed for the website to work, such as the one that remembers your language. They do not require consent.
• Analytics cookies, to understand how the website is used: Google Analytics and Microsoft Clarity.
• Marketing cookies, to measure campaigns and show relevant ads: Google Ads and Meta Pixel.

Analytics and marketing cookies are only activated after you consent. On your first visit, the banner lets you accept them, reject them or choose by category. You can change your choices at any time from the cookie banner, where you will also find the full list of cookies and their duration.

We process data electronically and, where needed, on paper, with technical and organisational measures appropriate to the risk: encrypted connections, access limited to staff who need it, and providers selected and contractually bound to confidentiality. If a breach is likely to result in a high risk to your rights, we will inform you as required by the GDPR.

Forms and purchases are reserved for adults. If the device is intended for a minor, the request and purchase must be made by a person with parental responsibility. If we find that we have collected data from a minor without authorisation, we delete it.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

At any time you can request:

• Access to your data and a copy of it (Art. 15).
• Rectification of inaccurate or incomplete data (Art. 16).
• Erasure of your data, where applicable (Art. 17).
• Restriction of processing, where applicable (Art. 18).
• Portability: receive your data in a structured, machine-readable format, or have it sent to another controller (Art. 20).
• Objection to processing based on legitimate interest; you can always object to marketing, without giving a reason (Art. 21).
• Withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal (Art. 7).

To exercise your rights, write to info@medtools.it or to our certified email amministrazione@pec.medtools.care. We may ask for some information to verify your identity. We reply within one month; if the request is complex or we receive many, this may be extended by two months, and we'll let you know within the first month and explain why.

If you believe the processing breaches data protection law, you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it ) or with the supervisory authority of the EU country where you live or work.

We may update this policy to reflect changes to our service or to the law. The date of the latest update is shown at the top of the page. If the changes are significant, we'll let you know by email or with a notice on the website.