Enterprise Privacy Notice – Professional Enquiries, Stakeholders and Newsletter
Specific notice for clinicians, medical leadership, researchers, universities, research institutes, laboratories, biotech/pharma and other stakeholders requesting information or subscribing to professional communications.
Regulatory and governance references
- Regulation (EU) 2016/679
- Italian Legislative Decree 196/2003, including Article 130 where applicable to electronic communications
- Italian DPA guidance on promotional activities and anti-spam
- UESE policy on professional-enquiry handling and data minimisation
References indicate the design framework and must be verified against the current legislation, implementing measures, national law and the parties’ actual roles at implementation time.
1. Scope and Categories of Data Subjects
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
Actual categories must be documented in records of processing and project annexes. They may include professional users, commercial contacts, research personnel and, in customer projects, research subjects; UESE does not assume that data are necessary or lawful merely because the platform technically supports them.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
For enterprise deployments, the decision should be translated into a RACI matrix, verifiable evidence, acceptance criteria, technical controls and periodic review; exceptions must be approved, reasoned, time-limited and traceable.
2. Controller and DPO
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
The responsible legal entity must be unambiguously identifiable. Corporate details, contact channels and the relevant privacy role are kept separate from the commercial product name; a division or internal business unit does not change legal ownership unless expressly stated.
UESE’s Data Protection Officer is Dr Prof Giuseppe Izzo, contactable at dpo@uese.it. The DPO performs the tasks under GDPR Articles 37–39 independently; where a request concerns data processed on behalf of a customer, UESE will cooperate but may need to direct the data subject to the competent controller.
In healthcare or multi-centre projects, the requirement should be linked to the protocol, decision record, DPIA or security file where relevant, avoiding any assumption that a technical configuration replaces legal or scientific assessment.
3. Data Collected through the Professional Form
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
Access is intended for organisations and professionals acting in the course of their activities. The customer must ensure that users, researchers and collaborators are authorised and appropriately trained; involvement of consumers, patients or non-professional users requires a separate contractual and regulatory assessment.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
Compliance is continuous: changes to purpose, data, suppliers, engines, hosting, integrations or law require impact assessment and, where needed, updates to contracts, controls, instructions and documentation.
4. Do Not Submit Patient Data
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
UESE retains evidence proportionate to function and risk. The customer organisation remains responsible for its authorisations, protocols, legal bases and healthcare or scientific decisions beyond the service scope entrusted to UESE.
5. Purposes of Information Requests
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
Public-form data are used to qualify enquiries, organise contacts, demos or assessments and document the pre-contractual relationship. The public form must not receive patient data; where an assessment requires sensitive information, UESE first establishes a protected channel and clarifies privacy roles.
Access, rectification, erasure, restriction, objection and portability requests are handled according to the actual role. Where UESE is processor it does not replace the controller’s decision-making, but provides tools and information compatible with the nature of processing and security requirements.
RTO and RPO, if offered, must be expressly stated in the SLA and aligned with the architecture. Without executed values they cannot be inferred from public material; disaster recovery and application restoration should be tested periodically where required by the continuity plan.
For enterprise deployments, the decision should be translated into a RACI matrix, verifiable evidence, acceptance criteria, technical controls and periodic review; exceptions must be approved, reasoned, time-limited and traceable.
6. Legal Basis for Requests and Follow-up
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
Access, rectification, erasure, restriction, objection and portability requests are handled according to the actual role. Where UESE is processor it does not replace the controller’s decision-making, but provides tools and information compatible with the nature of processing and security requirements.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
In healthcare or multi-centre projects, the requirement should be linked to the protocol, decision record, DPIA or security file where relevant, avoiding any assumption that a technical configuration replaces legal or scientific assessment.
7. Newsletter and Separate Consent
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
The newsletter is voluntary and separate from commercial or technical enquiries. UESE uses email double opt-in to document the data subject’s choice; unsubscribe is available at any time and withdrawal does not affect the lawfulness of earlier processing.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
Compliance is continuous: changes to purpose, data, suppliers, engines, hosting, integrations or law require impact assessment and, where needed, updates to contracts, controls, instructions and documentation.
8. Double Opt-In and Evidence of Consent
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
The newsletter is voluntary and separate from commercial or technical enquiries. UESE uses email double opt-in to document the data subject’s choice; unsubscribe is available at any time and withdrawal does not affect the lawfulness of earlier processing.
A newsletter request generates a unique token and does not activate the subscription until the data subject confirms by email. The system records request date, confirmation, notice version and later withdrawal; double opt-in is used as an evidential and anti-abuse measure and is not presented as a universal statutory requirement.
UESE retains evidence proportionate to function and risk. The customer organisation remains responsible for its authorisations, protocols, legal bases and healthcare or scientific decisions beyond the service scope entrusted to UESE.
9. Superadmin Notifications and Business Handling
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
Professional enquiries are registered and notified to the Superadmin or configured address for allocation and qualification. Internal notes should contain only information relevant to the professional relationship and must not be used to record unnecessary health or special-category data.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
For enterprise deployments, the decision should be translated into a RACI matrix, verifiable evidence, acceptance criteria, technical controls and periodic review; exceptions must be approved, reasoned, time-limited and traceable.
10. Retention and Deletion
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
Retention periods are defined by data category and purpose. Exit must distinguish export, return, logical deletion, storage deletion and backup cycles; legal duties, disputes or legal hold may justify limited segregated retention that is documented and not reused for other purposes.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
In healthcare or multi-centre projects, the requirement should be linked to the protocol, decision record, DPIA or security file where relevant, avoiding any assumption that a technical configuration replaces legal or scientific assessment.
11. Recipients and Email Providers
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
Recipients are limited to authorised persons and necessary providers. Before entrusting processing to third parties, role, security, location, onward subcontracting and contractual terms are assessed; the sub-processor chain is governed under GDPR Article 28 and the agreed authorisation mechanism.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
Compliance is continuous: changes to purpose, data, suppliers, engines, hosting, integrations or law require impact assessment and, where needed, updates to contracts, controls, instructions and documentation.
12. Rights, Withdrawal and Unsubscribe
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
UESE retains evidence proportionate to function and risk. The customer organisation remains responsible for its authorisations, protocols, legal bases and healthcare or scientific decisions beyond the service scope entrusted to UESE.
13. Security, Versioning and Contacts
The public professional-enquiry and newsletter channel is intended for clinicians, medical leadership, research institutes, universities, laboratories, biotech, pharma, advisers and research partners. It is not a clinical channel and must not be used to transmit medical records, reports, genetic data, patient identifiers or other health information relating to individuals.
UESE limits the form to professional information needed for assessment. Enquiries are routed to the Superadmin or configured contact and tracked by status; they must not be enriched with unnecessary health information or reused for newsletters without separate consent.
For enterprise deployments, the decision should be translated into a RACI matrix, verifiable evidence, acceptance criteria, technical controls and periodic review; exceptions must be approved, reasoned, time-limited and traceable.
For requests concerning data processed within a customer project, UESE may need to direct the data subject to the competent controller. For commercial or technical enquiries, use the dedicated stakeholder form and do not submit patient data.
Request informationWebsite owner and corporate contacts
UESE ITALIA S.p.A. · Piazza Trivulziana 4/A · 20126 Milano (MI) · Italy · P. IVA / C.F. IT04398760274 · REA MI 2679515 · sales@uese.it · +39 02 5656 8416.