Privacy Policy

Version 3.2 — July 21, 2026

This policy transparently describes how OmniNeo processes the personal data of its users, in accordance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code) as amended by Decree 101/2018.

In a nutshell. OmniNeo is an educational tool for neonatologists/pediatricians. We do not collect or store patient data. Messages sent to the AI Assistant are not stored on our servers and are filtered server-side to block accidental transmission of identifying data. We do not use profiling or advertising cookies.

1. Data Controller

Ciro Barone, individual operator of the OmniNeo project.
Email: privacy@omni-test.it
Site: https://omni-test.it

OmniNeo is in commercial launch phase; a dedicated company will be incorporated upon reaching the revenue thresholds set by Italian tax law. This policy will be updated accordingly.

2. Categories of data processed

The principle of data minimization (Art. 5 GDPR) governs collection: we ask for the minimum required by the service.

Category	Examples	Source
Account identifiers	Email, name, password (stored only as bcrypt hash)	Provided by user at signup
Professional data	Role (physician/nurse/midwife), medical board registration number, country	Provided by user — verifiable via public board registry
Access data	IP address, user agent, device, city/country (approximate geolocation)	Computed at login (no external services: GeoLite2 local DB)
Payment data	Stripe customer ID, no credit card data on our servers	Stripe Inc. (US) processes payments
Billing data	Tax code (Codice Fiscale), billing address, VAT number if any — required to issue the electronic invoice to the Italian Interchange System (SdI)	Provided by the user at purchase (e-invoicing legal requirement)
AI Assistant usage	Daily counts (number of calls, model used, credits consumed). NO message contents.	Computed automatically
Forum / community	Posts, replies, public profile	Provided by user
Clinical / editorial reports	Reports of errors in drug formulary and clinical sheets	Provided by user
Security events	Audit log of sensitive actions (login, password change, account deletion...)	Computed automatically

Special categories (Art. 9 GDPR — health data). OmniNeo does not process patient health data. The product is an educational tool for licensed healthcare professionals: the content is medical literature and abstract clinical reasoning, never identifying data of real patients. The automatic anti-PII filter described in §6 technically blocks accidental transmission of fiscal codes, IBAN, NHS/SSN, clinical prefixes (Mr./Sr. + Surname), birth dates, etc. If a user accidentally transmits such data, the system halts the operation and educates them to rephrase anonymously.

3. Purposes and legal bases

Purpose	Legal basis (Art. 6 GDPR)
Provide the service (signup, login, content access)	Contract performance (Art. 6.1.b)
Manage subscriptions and billing	Contract + legal obligation (Art. 6.1.b + 6.1.c)
Account security (rate limit, lockout, audit log, admin 2FA)	Legitimate interest — user protection (Art. 6.1.f)
AI Assistant operation	Contract (Art. 6.1.b) + legitimate interest (no prompt persistence — Art. 6.1.f)
Verification of professional registry membership ("Verified" badge)	Legitimate interest — clinical audience reliability (Art. 6.1.f); data already public by board registry law
Forum / community (public posts)	Consent (Art. 6.1.a)
Functional / security / statistics cookies	Consent (Art. 6.1.a)
Issuance and transmission of the electronic invoice to the SdI (Italian Revenue Agency) and compliant archiving	Legal obligation (Art. 6.1.c)
Compliance with legal obligations (billing, AML, GDPR accountability)	Legal obligation (Art. 6.1.c)

4. Suppliers (data processors — Art. 28)

To operate the service we rely on the following entities, bound by Data Processing Agreement (DPA) or equivalent:

Supplier	Role	Location	Transfer
Netsons S.r.l.	cPanel hosting, MySQL database, SMTP email	Italy (EU)	None outside EU
Stripe Inc. / Stripe Payments Europe Ltd.	Payments, subscriptions, web IAP	USA / Ireland (EU)	SCC 2021 + DPA
Openapi S.p.A.	Electronic invoicing: generation and transmission of the FatturaPA to the Interchange System (SdI), compliant archiving	Italy (EU)	None outside the EU — DPA Art. 28
Anthropic PBC	AI models (Claude Haiku/Sonnet)	USA	SCC 2021 + DPA — no prompt persistence
Intuition Machines / hCaptcha	Anti-bot verification on signup and login	USA	SCC 2021
Google LLC (future)	OAuth Sign-In, Play Billing (Android)	USA	SCC 2021 + DPA — only after explicit user consent
Apple Inc. (future)	Sign-In with Apple, IAP (iOS)	USA	SCC 2021 + DPA — only after explicit user consent
Backblaze Inc. (future Phase 4c)	Encrypted backup	USA	SCC 2021 + DPA — encryption key not shared with provider

The current list and related DPAs are available by writing to privacy@omni-test.it.

5. Retention periods

Category	Period	Reason
User profile	Until deletion request	Service provision
Billing data (Stripe, Openapi — compliant archiving)	10 years	Italian tax obligation (D.P.R. 633/1972, Art. 22 and 39)
Login history	12 months	Account security (legitimate interest)
Login attempts log (rate limit)	30 days	Account security
Security events (audit)	12 months	GDPR accountability
AI usage counts	Until deletion request	Account stats / billing
AI message contents	0 seconds (not stored)	Privacy by design — Art. 25 GDPR
Forum: public posts	Until user deletion (with anonymization, unless full deletion requested)	Community continuity

6. Security measures

We implement appropriate technical and organizational measures (Art. 32 GDPR) consistent with a processing operation outside Art. 9 (no patient health data):

Transport: mandatory HTTPS, HSTS, TLS 1.3 certificates, 80→443 redirect
Passwords: bcrypt cost 12 hashing, never stored plaintext, never sent via email
Sessions: HttpOnly + Secure + SameSite=Strict cookies, 24h idle timeout, session_version for logout-everywhere
Anti-bruteforce: sliding-window rate limit, temporary lockout, constant-time sleep against timing attacks
CSRF: synchronizer token on all sensitive POST methods
Anti-bot: hCaptcha on signup and login
Anti-PII filter towards Anthropic: 16 regex categories (CF, IBAN, NHS, SSN, phones, clinical prefixes IT/EN/ES, birth dates, chart numbers). See security-ai.html for details.
Mandatory admin 2FA + step-up reauth for sensitive actions (deploying in Phase 4a)
Immutable audit log for accountability (deploying in Phase 4a)
Encrypted offsite backups with key not shared with provider (deploying in Phase 4c)
HTTP headers: CSP, X-Frame-Options=DENY, restrictive Permissions-Policy, Referrer-Policy strict-origin
Local geolocation: GeoLite2 vendored in-app (no HTTP calls to US third-party services)

A complete technical description is available at security.html (non-technical summary) and security-ai.html (anti-PII detail).

7. Artificial-intelligence transparency (EU Regulation 2024/1689 — AI Act)

In accordance with the transparency obligations of EU Regulation 2024/1689 (AI Act), we inform you that:

AI-based clinical assistant: the OmniNeo assistant is an artificial-intelligence system. When you use it you are interacting with an AI, not a person; this is clearly indicated when the chat opens (Art. 50(1)). Its answers are for educational purposes, may contain errors and do not replace clinical judgement nor constitute a diagnosis or treatment recommendation.
Content produced with the help of AI: some texts and illustrations in the app were produced with the help of artificial-intelligence tools and reviewed by a human editor, under BaronSoft's responsibility.
No high-risk profile: OmniNeo is not a medical device and does not use AI for automated clinical decisions; it therefore does not fall among the high-risk AI systems under Art. 6.

8. Data subject rights

You may exercise the rights granted by Articles 15–22 GDPR at any time:

Access (Art. 15): obtain a copy of your data. "Download my data" button on your profile — sends an email with a ZIP archive of all your data in JSON format (within 60 seconds, link valid 24h, single-use). Frequency: 1 every 30 days.
Rectification (Art. 16): correct inaccurate data. From your profile or by writing to privacy@omni-test.it.
Erasure / right to be forgotten (Art. 17): "Delete account" button on the profile — requires password + the confirmation word "ELIMINA". Deletion takes effect after a 7-day grace period (cancellable any time by logging in). After the grace period the deletion is complete and irreversible (with automatic pseudonymization of forum posts, or full deletion if selected).
Restriction (Art. 18): suspend processing. Email privacy@omni-test.it.
Portability (Art. 20): receive data in structured format (JSON). Same "Download my data" button.
Objection (Art. 21): object to processing based on legitimate interest. Email privacy@omni-test.it.
Complaint (Art. 77): lodge a complaint with the Italian supervisory authority (Garante per la Protezione dei Dati Personali) or your own EU Member State authority.

9. Cookies

OmniNeo uses three categories of cookies/SDK:

Technical (always on) — session, theme preferences, disclaimer acceptance. No consent required (Art. 122 D.Lgs. 196/2003).
Functional (opt-in) — login form email pre-fill, synced UI preferences.
Security (opt-in) — hCaptcha (Intuition Machines, USA, SCC). Without this consent, signup and login will not work.
Statistics (opt-in) — aggregate, anonymous usage statistics to understand which features are used and improve the app. With your consent we record categorical events (opening a feature, clicks on "Did you know?" tips, the destination of a search, clicks from newsletter links). We never record patient data, the free text of searches, or IP addresses. Data is kept for at most 180 days and then deleted. You can withdraw consent at any time from the cookie banner.

We do not use profiling or advertising cookies. Consent is collected via banner compliant with the Italian Garante Guidelines of June 10, 2021 (3 buttons with equal visual weight: "Accept all" / "Reject all" / "Customize"). Persistence: 12 months, with automatic re-prompt at expiry. You may modify your choices at any time by reopening the banner from the homepage footer.

10. Extra-EU transfers

Some suppliers are based in the United States. Transfers comply with Standard Contractual Clauses (SCC) approved by the European Commission with Decision 2021/914, supplemented by additional measures where required by CJEU C-311/18 (Schrems II): transport encryption, no provider-managed keys for the most sensitive data, no transfer of health data.

11. Data Protection Officer (DPO)

The Controller has assessed mandatory DPO appointment criteria (Art. 37 GDPR + WP243 Guidelines) and has not appointed a DPO because:

Not a public authority or body
No large-scale systematic monitoring of data subjects
No special-category (Art. 9) or criminal-conviction data processed at scale — the "outside Art. 9" position is demonstrated by technical measures (anti-PII filter, no prompt persistence)

For privacy questions you may always write to the Controller at privacy@omni-test.it — you will receive a reply within 30 days (Art. 12.3).

12. Policy updates

This policy may be updated for regulatory changes or service evolution. We will notify substantive changes by email. The current version is always available at https://omni-test.it/privacy_en.html. Version history available upon request.

Contacts

Privacy / DSAR: privacy@omni-test.it
Security / vulnerability disclosure: security@omni-test.it
General support: support@omni-test.it