PRIVACY STATEMENT PURSUANT TO ART. 13 AND 14 OF GENERAL DATA PROTECTION REGULATION 2016/679 (GDPR)

Dear Patient,

UPMC Italy S.r.l. (hereinafter “UPMC”) and the Provincia Religiosa dell’Ordine Ospedaliero di S. Giovanni di Dio – Fatebenefratelli (hereinafter “San Pietro”), jointly manage UPMC Hillman Cancer Center at San Pietro (hereinafter the “Center”) that offers cancer patients innovative radiotherapy treatments and advanced care protocols, such as image guided radiation therapy (IGRT/IMRT) and stereotactic radiosurgery. The Center has received accreditation from Joint Commission International (JCI), an international body certifying compliance with quality and safety standards acknowledged by the international scientific community. The Center achieves excellence thanks to a multidisciplinary approach to cancer treatment, major investments in research and innovation, and particularly to daily exchanges with the University of Pittsburgh, UPMC (University of Pittsburgh Medical Center) and UPMC’s network of cancer centers (over 60 centers in the United States, one in Ireland, and two in Italy – hereinafter jointly referred to as “UPMC Cancer Network“). In its day-to-day operations the Center also utilizes data networks and information technology systems shared with the UPMC Group. As a consequence, patients referring to the Center are required to authorize the transfer of their data, including sensitive data, to the UPMC Group in the United States. According to EU regulations, the laws in force in the United States fail to guarantee adequate levels of personal data protection. The UPMC Group has therefore committed, subscribing the Standard contractual clauses approved by the European Commission, to adopt the necessary safety measures to protect patient data. A copy of the standard contractual clauses is available from the Data Protection Officer (“DPO”) at the addresses below.

The information on your health status, provided by you or by third parties (e.g. your family doctor), will be processed using paper or electronic means. This is required for us to provide you with the necessary clinical care and with the communications and related administrative and accounting purposes. Data processing complies with the provisions of art. 9.2.h of the Regulation (“processing is necessary for the purposes of medical diagnosis, the provision of health or social care pursuant to contract with a health professional”).

For training purposes, clinical care may be carried out in the presence of observers. In this event, all necessary precautions shall be taken to limit any potential inconvenience and your will to not abide by this procedure will be respected.

If you give your consent, required under art. 9.2-a of the Regulation (“data subject has given explicit consent to the processing”), your personal data can be used:

• To conduct scientific research in the medical field that will not influence your treatment nor will it require additional tests or therapies (CONSENT #1).
• To verify the quality of care and treatment received and for planning care (CONSENT #2).
• To request a consult of external experts to assess your state of health during treatment, also via telemedicine, including contacting centers that are not members of the UPMC Cancer Network (CONSENT #3).
• To send you e-mails, sms or mail containing informational material on the Center’s initiatives (CONSENT #4).
• To send you the Instructions on how to prepare for my tests and reminders of upcoming appointments (CONSENT #5).

With reference to the foregoing goals (CONSENTS #1, #2, #4, and #5) you may either give or deny your consent. Failure to sign your informed consent shall in no way affect your medical treatment. Notwithstanding your right to give or deny consent, we inform you that failure to sign CONSENT #3 may negatively affect your medical treatment at the Center, entailing a release of liability for the Center’s physicians and health care providers. Please note you may withdraw your consents at any time.

Your personal data will be processed by the Center’s clinical and administrative staff complying with specific instructions on the aim and methods of data processing. Your personal data will be notified to third parties appointed data controllers to whom some of the Center’s ancillary services are outsourced (e.g., consultants) or to independent data controllers, in fulfillment of the governing laws, or to enforce ones’ rights through legal action (e.g., NHS, institutions, municipalities, social security institutions or insurance companies). The updated list of the above mentioned subjects can be requested to the DPO or to the Data processing reference person at the following addresses.

Information on your health status will be stored for the mandatory minimum retention period established by the Region of Lombardy in the “Massimario di scarto” enforced for the health care system. Data and samples processed for research purposes are stored for the duration of the project and for the 10 years following its conclusions, and are transformed in an anonymous form. Data collected for marketing purposes will be retained for 24 months.

Information regarding your health status will only be provided to your relatives and friends listed at the end of this document, without prejudice to the provisions of law. In the cases provided for, you are entitled to access your personal data, verify its accuracy, request its cancellation, and limit or object to data processing (artt. 15 and following of the Regulation). Requests must be emailed to the Data processing reference person at the following address: UPMC Hillman Cancer Center at San Pietro FBF – Via Cassia 600, Rome, Italy, or info@upmcsanpietro.it; or contacting the Center’s DPO at UPMC Hillman Cancer Center at San Pietro FBF – Data Protection Officer Via Cassia 600, Rome, Italy, or DPO@upmcsanpietro.it

A form to exercise your rights drafted by the Italian Data Protection Authority is available at this link.

Should you deem that your personal data has been processed in breach of the Regulation, you have the right to file a complaint to the Italian Data Protection Authority (Art. 77, Regulation) or to start judicial proceedings (Art. 79, Regulation).

Co-data controllers are UPMC Italy S.r.l., with registered offices in Via Discesa dei Giudici 4, Palermo, Italy, and the Provincia Religiosa dell’Ordine Ospedaliero di S. Giovanni di Dio – Fatebenefratelli, with registered offices in Via Cassia 600, Rome, Italy.

Please take some time to review the additional information contained in the leaflet you received.

Last update: November 2018