Privacy Policy

Version 3.7 — October 18, 2026

This policy transparently describes how OmniNeo processes the personal data of its users, in accordance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code) as amended by Decree 101/2018.

In a nutshell. OmniNeo is an educational tool for neonatologists/pediatricians. We do not collect or store patient data. Messages sent to the AI Assistant are not stored on our servers and are filtered server-side to block accidental transmission of identifying data. We do not use profiling or advertising cookies.

1. Data Controller

Ciro Barone, individual operator of the OmniNeo project.
Email: privacy@omni-test.it
Site: https://omni-test.it

OmniNeo is in commercial launch phase; a dedicated company will be incorporated upon reaching the revenue thresholds set by Italian tax law. This policy will be updated accordingly.

2. Categories of data processed

The principle of data minimization (Art. 5 GDPR) governs collection: we ask for the minimum required by the service.

Category	Examples	Source
Account identifiers	Email, name, password (stored only as bcrypt hash)	Provided by user at signup
Professional data	Role (physician/nurse/midwife), medical board registration number, country	Provided by user — verifiable via public board registry
Access data	IP address, user agent, device, city/country (approximate geolocation)	Computed at login (no external services: GeoLite2 local DB)
Payment data	Stripe customer ID, no credit card data on our servers	Stripe Inc. (US) processes payments
Billing data	Tax code (Codice Fiscale), billing address, VAT number if any — required to issue the electronic invoice to the Italian Interchange System (SdI)	Provided by the user at purchase (e-invoicing legal requirement)
AI Assistant usage	Daily counts (number of calls, model used, credits consumed). NO message contents.	Computed automatically
Forum / community	Posts, replies, public profile	Provided by user
Clinical / editorial reports	Reports of errors in drug formulary and clinical sheets	Provided by user
Security events	Audit log of sensitive actions (login, password change, account deletion...)	Computed automatically
Quiz progress	Identifiers of the questions you answer, outcome (right or wrong), response time, spaced-repetition status and the settings of the "Your study" page (weekly goal, start date of the study path). No clinical or patient data.	Computed automatically when you answer quizzes as a registered user
Library: favourites	Articles you save as favourites (PMID, title, authors, journal, year) with the folder and note you write	Provided by the user
Library and Desk: usage limits	Hourly counters of searches, downloaded PDFs and translations, to protect the service from abuse. The text of your searches is not linked to your account.	Computed automatically
Desk: documents	The PDFs and documents you open, annotate or write in Desk stay on your device and are not sent to our servers. The exceptions are text you choose to have translated (see §4 and §5) and, if you turn on sync between devices, the encrypted copy described in the next row.	Provided by the user, stored on the device
Desk: sync between devices (optional, Pro plan)	If you turn it on, drafts, PDF notes and annotations, the PDFs and saved signatures are encrypted on your device with a key protected by your passphrase, and only then sent to the server (up to 200 MB). OmniNeo stores unreadable data, the encrypted "custody" of the key, opaque identifiers, sizes and update dates: it cannot read the content, nor recover it if you lose both your passphrase and recovery code.	Provided by the user

Special categories (Art. 9 GDPR — health data). OmniNeo does not process patient health data. The product is an educational tool for licensed healthcare professionals: the content is medical literature and abstract clinical reasoning, never identifying data of real patients. The automatic anti-PII filter described in §6 technically blocks accidental transmission of fiscal codes, IBAN, NHS/SSN, clinical prefixes (Mr./Sr. + Surname), birth dates, etc. If a user accidentally transmits such data, the system halts the operation and educates them to rephrase anonymously.

3. Purposes and legal bases

Purpose	Legal basis (Art. 6 GDPR)
Provide the service (signup, login, content access)	Contract performance (Art. 6.1.b)
Manage subscriptions and billing	Contract + legal obligation (Art. 6.1.b + 6.1.c)
Account security (rate limit, lockout, audit log, admin 2FA)	Legitimate interest — user protection (Art. 6.1.f)
AI Assistant operation	Contract (Art. 6.1.b) + legitimate interest (no prompt persistence — Art. 6.1.f)
Verification of professional registry membership ("Verified" badge)	Legitimate interest — clinical audience reliability (Art. 6.1.f); data already public by board registry law
Quiz progress and spaced repetition ("Your study" page)	Performance of the contract (Art. 6.1.b)
Library (PubMed search, favourites, translations, summaries, infographics) and Desk tools	Performance of the contract (Art. 6.1.b); usage limits: legitimate interest — protection of the service (Art. 6.1.f)
Forum / community (public posts)	Consent (Art. 6.1.a)
Functional / security / statistics cookies	Consent (Art. 6.1.a)
Issuance and transmission of the electronic invoice to the SdI (Italian Revenue Agency) and compliant archiving	Legal obligation (Art. 6.1.c)
Compliance with legal obligations (billing, AML, GDPR accountability)	Legal obligation (Art. 6.1.c)

4. Suppliers (data processors — Art. 28)

To operate the service we rely on the following entities, bound by Data Processing Agreement (DPA) or equivalent:

Supplier	Role	Location	Transfer
Netsons S.r.l.	cPanel hosting, MySQL database, SMTP email	Italy (EU)	None outside EU
Stripe Inc. / Stripe Payments Europe Ltd.	Payments, subscriptions, web IAP	USA / Ireland (EU)	SCC 2021 + DPA
Openapi S.p.A.	Electronic invoicing: generation and transmission of the FatturaPA to the Interchange System (SdI), compliant archiving	Italy (EU)	None outside the EU — DPA Art. 28
Anthropic PBC	AI models (Claude Haiku/Sonnet): Assistant; in the Library and Desk, translation, summary and infographic of the texts you choose to process	USA	Anthropic DPA (part of the commercial terms) with EU Standard Contractual Clauses 2021 — by contract, submitted data may not be used to train models (commercial terms effective June 17, 2025); limited retention under the provider's terms
Intuition Machines / hCaptcha	Anti-bot verification on signup and login	USA	SCC 2021
Google LLC	OAuth Sign-In; in-app purchases on Android (Google Play Billing)	USA	SCC 2021 + DPA — only if the user signs in with Google or purchases in the Android app
Apple Inc.	Sign in with Apple; in-app purchases on iOS (App Store)	USA	SCC 2021 + DPA — only if the user signs in with Apple or purchases in the iOS app
RevenueCat Inc.	Management of subscriptions purchased in the iOS and Android apps (OmniNeo account identifier, subscription status; no payment data)	USA	RevenueCat DPA (part of the terms of service) with EU Standard Contractual Clauses 2021 — only for iOS and Android app users
Backblaze Inc. (future Phase 4c)	Encrypted backup	USA	SCC 2021 + DPA — encryption key not shared with provider

The current list and related DPAs are available by writing to privacy@omni-test.it.

Public bibliographic sources (Library). Library searches and articles go through our server, which requests them from NCBI / National Library of Medicine (PubMed, PubMed Central — USA), Europe PMC (EMBL-EBI — United Kingdom) and Unpaywall (OurResearch — USA). These services receive only the search text or the article identifier, never your IP address, your name or your account: to them the request comes from OmniNeo. They are therefore not processors of your personal data.

5. Retention periods

Category	Period	Reason
User profile	Until deletion request	Service provision
Billing data (Stripe, Openapi — compliant archiving)	10 years	Italian tax obligation (D.P.R. 633/1972, Art. 22 and 39)
Login history	12 months	Account security (legitimate interest)
Login attempts log (rate limit)	30 days	Account security
Security events (audit)	12 months	GDPR accountability
AI usage counts	Until deletion request	Account stats / billing
Quiz progress	Until deletion request (deleted with the account, included in the data export)	Service delivery
AI message contents	0 seconds (not stored)	Privacy by design — Art. 25 GDPR
Library: favourites	Until you remove them or request deletion (deleted with the account, included in the data export)	Service delivery
Library and Desk: hourly usage counters	2 days	Protection of the service
Library: record of infographics you have already created (so they are not charged twice)	1 hour	Correct charging of credits
Desk: synced data (encrypted) and key custody	Until you delete them ("Delete from server" in Desk) or delete your account	Delivery of the requested service
Library: copies of public PubMed data and their processing (translations and infographics of abstracts)	Up to 31 days	Speed and cost containment; this is public content, not your own text
Text of your documents sent for translation (Desk)	0 seconds (not stored on our servers)	Privacy by design — Art. 25 GDPR
Forum: public posts	Until user deletion (with anonymization, unless full deletion requested)	Community continuity

6. Security measures

We implement appropriate technical and organizational measures (Art. 32 GDPR) consistent with a processing operation outside Art. 9 (no patient health data):

Transport: mandatory HTTPS, HSTS, TLS 1.3 certificates, 80→443 redirect
Desk sync encrypted on the device: AES-256-GCM with a key derived from your passphrase (PBKDF2-SHA-256, 600,000 iterations); the key never leaves the device in clear and the encrypted files are stored outside the public part of the server
Passwords: bcrypt cost 12 hashing, never stored plaintext, never sent via email
Sessions: HttpOnly + Secure + SameSite=Strict cookies, 24h idle timeout, session_version for logout-everywhere
Anti-bruteforce: sliding-window rate limit, temporary lockout, constant-time sleep against timing attacks
CSRF: synchronizer token on all sensitive POST methods
Anti-bot: hCaptcha on signup and login
Anti-PII filter towards Anthropic: 16 regex categories (CF, IBAN, NHS, SSN, phones, clinical prefixes IT/EN/ES, birth dates, chart numbers). See security-ai.html for details.
Mandatory admin 2FA + step-up reauth for sensitive actions (deploying in Phase 4a)
Immutable audit log for accountability (deploying in Phase 4a)
Encrypted offsite backups with key not shared with provider (deploying in Phase 4c)
HTTP headers: CSP, X-Frame-Options=DENY, restrictive Permissions-Policy, Referrer-Policy strict-origin
Local geolocation: GeoLite2 vendored in-app (no HTTP calls to US third-party services)

A complete technical description is available at security.html (non-technical summary) and security-ai.html (anti-PII detail).

7. Artificial-intelligence transparency (EU Regulation 2024/1689 — AI Act)

In accordance with the transparency obligations of EU Regulation 2024/1689 (AI Act), we inform you that:

AI-based clinical assistant: the OmniNeo assistant is an artificial-intelligence system. When you use it you are interacting with an AI, not a person; this is clearly indicated when the chat opens (Art. 50(1)). Its answers are for educational purposes, may contain errors and do not replace clinical judgement nor constitute a diagnosis or treatment recommendation.
Content produced with the help of AI: some texts and illustrations in the app were produced with the help of artificial-intelligence tools and reviewed by a human editor, under BaronSoft's responsibility.
AI-generated translations, summaries and infographics: in the Library and Desk these texts are produced automatically by Claude (Anthropic) at your request and are always labelled as such, with an invitation to check them against the original; infographics keep only data that appear in the abstract.
No high-risk profile: OmniNeo is not a medical device and does not use AI for automated clinical decisions; it therefore does not fall among the high-risk AI systems under Art. 6.

8. Data subject rights

You may exercise the rights granted by Articles 15–22 GDPR at any time:

Access (Art. 15): obtain a copy of your data. "Download my data" button on your profile — sends an email with a ZIP archive of all your data in JSON format (within 60 seconds, link valid 24h, single-use). Frequency: 1 every 30 days.
Rectification (Art. 16): correct inaccurate data. From your profile or by writing to privacy@omni-test.it.
Erasure / right to be forgotten (Art. 17): "Delete account" button on the profile, or the page cancella-account.html — while signed in, just confirm with the word "ELIMINA"; no password is needed. Deletion takes effect after 7 days (cancellable any time by logging in). After the grace period the deletion is complete and irreversible (with automatic pseudonymization of forum posts, or full deletion if selected).
Restriction (Art. 18): suspend processing. Email privacy@omni-test.it.
Portability (Art. 20): receive data in structured format (JSON). Same "Download my data" button.
Objection (Art. 21): object to processing based on legitimate interest. Email privacy@omni-test.it.
Complaint (Art. 77): lodge a complaint with the Italian supervisory authority (Garante per la Protezione dei Dati Personali) or your own EU Member State authority.

9. Cookies

OmniNeo uses three categories of cookies/SDK:

Technical (always on) — session, theme preferences, disclaimer acceptance. No consent required (Art. 122 D.Lgs. 196/2003).
Functional (opt-in) — login form email pre-fill, synced UI preferences.
Security (opt-in) — hCaptcha (Intuition Machines, USA, SCC). Without this consent, signup and login will not work.
Statistics (opt-in) — aggregate, anonymous usage statistics to understand which features are used and improve the app. With your consent we record categorical events (opening a feature, clicks on "Did you know?" tips, the destination of a search, clicks from newsletter links, views of the public pages on medicines during breastfeeding). We never record patient data, the free text of searches, or IP addresses. Data is kept for at most 180 days and then deleted. You can withdraw consent at any time from the cookie banner.

We do not use profiling or advertising cookies. Consent is collected via banner compliant with the Italian Garante Guidelines of June 10, 2021 (3 buttons with equal visual weight: "Accept all" / "Reject all" / "Customize"). Persistence: 12 months, with automatic re-prompt at expiry. You may modify your choices at any time by reopening the banner from the homepage footer.

10. Extra-EU transfers

Some suppliers are based in the United States. Transfers comply with Standard Contractual Clauses (SCC) approved by the European Commission with Decision 2021/914, supplemented by additional measures where required by CJEU C-311/18 (Schrems II): transport encryption, no provider-managed keys for the most sensitive data, no transfer of health data.

11. Data Protection Officer (DPO)

The Controller has assessed mandatory DPO appointment criteria (Art. 37 GDPR + WP243 Guidelines) and has not appointed a DPO because:

Not a public authority or body
No large-scale systematic monitoring of data subjects
No special-category (Art. 9) or criminal-conviction data processed at scale — the "outside Art. 9" position is demonstrated by technical measures (anti-PII filter, no prompt persistence)

For privacy questions you may always write to the Controller at privacy@omni-test.it — you will receive a reply within 30 days (Art. 12.3).

12. Policy updates

This policy may be updated for regulatory changes or service evolution. We will notify substantive changes by email. The current version is always available at https://omni-test.it/privacy_en.html. Version history available upon request.

Contacts

Privacy / DSAR: privacy@omni-test.it
Security / vulnerability disclosure: security@omni-test.it
General support: support@omni-test.it