Privacy Policy

Version 3.17 — October 21, 2026

This policy transparently describes how OmniNeo processes the personal data of its users, in accordance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code) as amended by Decree 101/2018.

In a nutshell. OmniNeo is an educational tool for neonatologists/pediatricians. We do not collect or store patient data. Messages sent to the AI Assistant are not stored on our servers and are filtered server-side to block accidental transmission of identifying data. We do not use profiling or advertising cookies.

1. Data Controller

Ciro Barone, individual operator of the OmniNeo project.
Email: privacy@omni-test.it
Site: https://omni-test.it

OmniNeo is in commercial launch phase; a dedicated company will be incorporated upon reaching the revenue thresholds set by Italian tax law. This policy will be updated accordingly.

2. Categories of data processed

The principle of data minimization (Art. 5 GDPR) governs collection: we ask for the minimum required by the service.

Category	Examples	Source
Account identifiers	Email, name, password (stored only as bcrypt hash)	Provided by user at signup
Professional data	Role (physician/nurse/midwife), medical board registration number, country	Provided by user — verifiable via public board registry
Access data	IP address, user agent, device, city/country (approximate geolocation)	Computed at login (no external services: GeoLite2 local DB)
Payment data	Stripe customer ID, no credit card data on our servers	Stripe Inc. (US) processes payments
Billing data	Tax code (Codice Fiscale), billing address, VAT number if any — required to issue the electronic invoice to the Italian Interchange System (SdI)	Provided by the user at purchase (e-invoicing legal requirement)
AI Assistant usage	Daily counts (number of calls, model used, credits consumed). NO message contents.	Computed automatically
Forum / community	Posts, replies, public profile	Provided by user
Clinical / editorial reports	Reports of errors in drug formulary and clinical sheets	Provided by user
Security events	Audit log of sensitive actions (login, password change, account deletion...)	Computed automatically
Quiz and theory progress	Theory modules read (which sections you read to the end and when you completed the module); quizzes and flashcards you create from Library articles (article, questions, flashcards, date); chosen study path and results of the exam simulations (score, duration, date); certificates of completion you create (verification code, path, date, estimated hours, score, your name: whoever enters the code on the public verification page sees your name only if you chose to show it); identifiers of the questions you answer, outcome (right or wrong), response time, spaced-repetition status and the settings of the "Your study" page (weekly goal, start date of the study path). No clinical or patient data.	Computed automatically when you read the theory or answer quizzes as a registered user
Library: favourites	Articles you save as favourites (PMID, title, authors, journal, year) with the folder and note you write	Provided by the user
Library: followed searches	The searches you choose to follow (search text, name, date) and the identifiers of the new articles found for you. Other Library searches are not recorded	Provided by the user
Library: new-article email	If you turn it on (it is off by default): your account email address, the week of the last email and the identifiers of the articles already sent. It can be turned off in the Library or from the link in every email	Provided by the user
Library and Desk: usage limits	Hourly counters of searches, downloaded PDFs and translations, to protect the service from abuse. The text of your searches is not linked to your account.	Computed automatically
Desk: documents	The PDFs and documents you open, annotate or write in Desk stay on your device and are not sent to our servers. The exceptions are text you choose to have translated (see §4 and §5) and, if you turn on sync between devices, the encrypted copy described in the next row.	Provided by the user, stored on the device
Desk: sync between devices (optional, Pro plan)	If you turn it on, drafts, PDF notes and annotations, the PDFs and saved signatures are encrypted on your device with a key protected by your passphrase, and only then sent to the server (up to 200 MB). OmniNeo stores unreadable data, the encrypted "custody" of the key, opaque identifiers, sizes and update dates: it cannot read the content, nor recover it if you lose both your passphrase and recovery code.	Provided by the user
Desk: features that use external services (only when you use them)	Bibliography: when you look up a DOI the request goes from your device to doi.org, which returns the public data of the article; if you connect Zotero the request goes to Zotero (Corporation for Digital Scholarship, USA) with the user number and key you enter, remembered only on your device and only if you choose so. These services receive the DOI or your search and, like any website, your IP address. Dictation: speech recognition is provided by your browser or operating system (for example Google, Microsoft, Apple): your voice and the recognised text may be processed by that provider under its own terms; OmniNeo does not receive your voice. Do not dictate data that identify a patient. "Ask Desk": the Assistant receives your written request, the list of available commands and a few numbers (pages, words), never the text, title or name of the document, with the same identifying-data filter as the Assistant. Spell checking and read aloud run on your device.	Provided by the user

Special categories (Art. 9 GDPR — health data). OmniNeo does not process patient health data. The product is an educational tool for licensed healthcare professionals: the content is medical literature and abstract clinical reasoning, never identifying data of real patients. The automatic anti-PII filter described in §6 technically blocks accidental transmission of fiscal codes, IBAN, NHS/SSN, clinical prefixes (Mr./Sr. + Surname), birth dates, etc. If a user accidentally transmits such data, the system halts the operation and educates them to rephrase anonymously.

3. Purposes and legal bases

Purpose	Legal basis (Art. 6 GDPR)
Provide the service (signup, login, content access)	Contract performance (Art. 6.1.b)
Manage subscriptions and billing	Contract + legal obligation (Art. 6.1.b + 6.1.c)
Account security (rate limit, lockout, audit log, admin 2FA)	Legitimate interest — user protection (Art. 6.1.f)
AI Assistant operation	Contract (Art. 6.1.b) + legitimate interest (no prompt persistence — Art. 6.1.f)
Verification of professional registry membership ("Verified" badge)	Legitimate interest — clinical audience reliability (Art. 6.1.f); data already public by board registry law
Quiz and theory progress, spaced repetition ("Your study" page)	Performance of the contract (Art. 6.1.b)
Library (PubMed search, favourites, translations, summaries, infographics) and Desk tools	Performance of the contract (Art. 6.1.b); usage limits: legitimate interest — protection of the service (Art. 6.1.f)
Forum / community (public posts)	Consent (Art. 6.1.a)
Functional / security / statistics cookies	Consent (Art. 6.1.a)
Issuance and transmission of the electronic invoice to the SdI (Italian Revenue Agency) and compliant archiving	Legal obligation (Art. 6.1.c)
Compliance with legal obligations (billing, AML, GDPR accountability)	Legal obligation (Art. 6.1.c)

4. Suppliers (data processors — Art. 28)

To operate the service we rely on the following entities, bound by Data Processing Agreement (DPA) or equivalent:

Supplier	Role	Location	Transfer
Netsons S.r.l.	cPanel hosting, MySQL database, SMTP email	Italy (EU)	None outside EU
Stripe Inc. / Stripe Payments Europe Ltd.	Payments, subscriptions, web IAP	USA / Ireland (EU)	SCC 2021 + DPA
Openapi S.p.A.	Electronic invoicing: generation and transmission of the FatturaPA to the Interchange System (SdI), compliant archiving	Italy (EU)	None outside the EU — DPA Art. 28
Anthropic PBC	AI models (Claude Haiku/Sonnet): Assistant; in the Library and Desk, translation, summary, infographic, critical appraisal and quizzes of the texts you choose to process, and the summary of new articles for the searches you follow (only public PubMed abstracts, no user data); in Desk, choosing the commands of "Ask Desk"; in OmniNeo Presentation, the outline, slides and charts built from the sources you choose	USA	Anthropic DPA (part of the commercial terms) with EU Standard Contractual Clauses 2021 — by contract, submitted data may not be used to train models (commercial terms effective June 17, 2025); limited retention under the provider's terms
Intuition Machines / hCaptcha	Anti-bot verification on signup and login	USA	SCC 2021
Google LLC	OAuth Sign-In; in-app purchases on Android (Google Play Billing)	USA	SCC 2021 + DPA — only if the user signs in with Google or purchases in the Android app
Apple Inc.	Sign in with Apple; in-app purchases on iOS (App Store)	USA	SCC 2021 + DPA — only if the user signs in with Apple or purchases in the iOS app
Voyage AI Innovations, Inc. (MongoDB group)	Meaning-based search in OmniNeo chapters (OmniNeo Presentation and related features): receives only the search text, already checked by the identifying-data filter, and returns a numerical representation of it. It does not receive the user's name, email, account or IP address	USA	Voyage AI Data Processing Agreement with EU Standard Contractual Clauses 2021 (Decision 2021/914)
RevenueCat Inc.	Management of subscriptions purchased in the iOS and Android apps (OmniNeo account identifier, subscription status; no payment data)	USA	RevenueCat DPA (part of the terms of service) with EU Standard Contractual Clauses 2021 — only for iOS and Android app users
Backblaze Inc. (future Phase 4c)	Encrypted backup	USA	SCC 2021 + DPA — encryption key not shared with provider

The current list and related DPAs are available by writing to privacy@omni-test.it.

Public bibliographic sources (Library). Library searches and articles go through our server, which requests them from NCBI / National Library of Medicine (PubMed, PubMed Central — USA), Europe PMC (EMBL-EBI — United Kingdom) and Unpaywall (OurResearch — USA). These services receive only the search text or the article identifier, never your IP address, your name or your account: to them the request comes from OmniNeo. They are therefore not processors of your personal data.

5. Retention periods

Category	Period	Reason
User profile	Until deletion request	Service provision
Billing data (Stripe, Openapi — compliant archiving)	10 years	Italian tax obligation (D.P.R. 633/1972, Art. 22 and 39)
Login history	12 months	Account security (legitimate interest)
Login attempts log (rate limit)	30 days	Account security
Security events (audit)	12 months	GDPR accountability
AI usage counts	Until deletion request	Account stats / billing
Quiz and theory progress	Until deletion request (deleted with the account, included in the data export)	Service delivery
AI message contents	0 seconds (not stored)	Privacy by design — Art. 25 GDPR
Library: favourites	Until you remove them or request deletion (deleted with the account, included in the data export)	Service delivery
Library: followed searches	Until you stop following them or request deletion (deleted with the account, included in the data export)	Service delivery
Library: new-article email	Until you turn it off or request deletion (deleted with the account, included in the data export)	Service delivery
Library and Desk: hourly usage counters	2 days	Protection of the service
Library: record of infographics you have already created (so they are not charged twice)	1 hour	Correct charging of credits
Critical appraisal of articles: the response, kept only to deliver it if the connection drops (without charging twice). Appraisals are then kept only on your device	1 hour	Correct charging of credits
OmniNeo Presentation: the outline and slides response, kept only to deliver it if the connection drops (without charging twice)	Up to 2 days	Correct charging of credits
OmniNeo Presentation, «From PowerPoint to an identical PDF»: the .pptx file you upload, converted on OmniNeo's server (no external service receives it)	Deleted as soon as the PDF is ready (a few seconds)	Performance of the requested service
Critical appraisals of public PubMed articles, in anonymous form (article and tool, with no link to who requested them), reused at reduced cost	Up to 180 days	Cost containment; they contain no personal data. Your documents never enter this archive
Desk: synced data (encrypted) and key custody	Until you delete them ("Delete from server" in Desk) or delete your account	Delivery of the requested service
Library: copies of public PubMed data and their processing (translations and infographics of abstracts)	Up to 31 days	Speed and cost containment; this is public content, not your own text
Text of your documents sent for translation (Desk)	0 seconds (not stored on our servers)	Privacy by design — Art. 25 GDPR
Forum: public posts	Until user deletion (with anonymization, unless full deletion requested)	Community continuity

6. Security measures

We implement appropriate technical and organizational measures (Art. 32 GDPR) consistent with a processing operation outside Art. 9 (no patient health data):

Transport: mandatory HTTPS, HSTS, TLS 1.3 certificates, 80→443 redirect
Desk sync encrypted on the device: AES-256-GCM with a key derived from your passphrase (PBKDF2-SHA-256, 600,000 iterations); the key never leaves the device in clear and the encrypted files are stored outside the public part of the server
Passwords: bcrypt cost 12 hashing, never stored plaintext, never sent via email
Sessions: HttpOnly + Secure + SameSite=Strict cookies, 24h idle timeout, session_version for logout-everywhere
Anti-bruteforce: sliding-window rate limit, temporary lockout, constant-time sleep against timing attacks
CSRF: synchronizer token on all sensitive POST methods
Anti-bot: hCaptcha on signup and login
Anti-PII filter towards Anthropic and Voyage AI: 16 regex categories (CF, IBAN, NHS, SSN, phones, clinical prefixes IT/EN/ES, birth dates, chart numbers). See security-ai.html for details.
Mandatory admin 2FA + step-up reauth for sensitive actions (deploying in Phase 4a)
Immutable audit log for accountability (deploying in Phase 4a)
Encrypted offsite backups with key not shared with provider (deploying in Phase 4c)
HTTP headers: CSP, X-Frame-Options=DENY, restrictive Permissions-Policy, Referrer-Policy strict-origin
Local geolocation: GeoLite2 vendored in-app (no HTTP calls to US third-party services)

A complete technical description is available at security.html (non-technical summary) and security-ai.html (anti-PII detail).

7. Artificial-intelligence transparency (EU Regulation 2024/1689 — AI Act)

In accordance with the transparency obligations of EU Regulation 2024/1689 (AI Act), we inform you that:

AI-based clinical assistant: the OmniNeo assistant is an artificial-intelligence system. When you use it you are interacting with an AI, not a person; this is clearly indicated when the chat opens (Art. 50(1)). Its answers are for educational purposes, may contain errors and do not replace clinical judgement nor constitute a diagnosis or treatment recommendation.
Content produced with the help of AI: some texts and illustrations in the app were produced with the help of artificial-intelligence tools and reviewed by a human editor, under BaronSoft's responsibility.
AI-generated translations, summaries and infographics: in the Library and Desk these texts are produced automatically by Claude (Anthropic) at your request and are always labelled as such, with an invitation to check them against the original; infographics keep only data that appear in the abstract.
No high-risk profile: OmniNeo is not a medical device and does not use AI for automated clinical decisions; it therefore does not fall among the high-risk AI systems under Art. 6.

8. Data subject rights

You may exercise the rights granted by Articles 15–22 GDPR at any time:

Access (Art. 15): obtain a copy of your data. "Download my data" button on your profile — sends an email with a ZIP archive of all your data in JSON format (within 60 seconds, link valid 24h, single-use). Frequency: 1 every 30 days.
Rectification (Art. 16): correct inaccurate data. From your profile or by writing to privacy@omni-test.it.
Erasure / right to be forgotten (Art. 17): "Delete account" button on the profile, or the page cancella-account.html — while signed in, just confirm with the word "ELIMINA"; no password is needed. Deletion takes effect after 7 days (cancellable any time by logging in). After the grace period the deletion is complete and irreversible (with automatic pseudonymization of forum posts, or full deletion if selected).
Restriction (Art. 18): suspend processing. Email privacy@omni-test.it.
Portability (Art. 20): receive data in structured format (JSON). Same "Download my data" button.
Objection (Art. 21): object to processing based on legitimate interest. Email privacy@omni-test.it.
Complaint (Art. 77): lodge a complaint with the Italian supervisory authority (Garante per la Protezione dei Dati Personali) or your own EU Member State authority.

9. Cookies

OmniNeo uses three categories of cookies/SDK:

Technical (always on) — session, theme preferences, disclaimer acceptance. No consent required (Art. 122 D.Lgs. 196/2003).
Functional (opt-in) — login form email pre-fill, synced UI preferences.
Security (opt-in) — hCaptcha (Intuition Machines, USA, SCC). Without this consent, signup and login will not work.
Statistics (opt-in) — aggregate, anonymous usage statistics to understand which features are used and improve the app. With your consent we record categorical events (opening a feature, clicks on "Did you know?" tips, the destination of a search, clicks from newsletter links, views of the public pages on medicines during breastfeeding). We never record patient data, the free text of searches, or IP addresses. Data is kept for at most 180 days and then deleted. You can withdraw consent at any time from the cookie banner.

We do not use profiling or advertising cookies. Consent is collected via banner compliant with the Italian Garante Guidelines of June 10, 2021 (3 buttons with equal visual weight: "Accept all" / "Reject all" / "Customize"). Persistence: 12 months, with automatic re-prompt at expiry. You may modify your choices at any time by reopening the banner from the homepage footer.

10. Extra-EU transfers

Some suppliers are based in the United States. Transfers comply with Standard Contractual Clauses (SCC) approved by the European Commission with Decision 2021/914, supplemented by additional measures where required by CJEU C-311/18 (Schrems II): transport encryption, no provider-managed keys for the most sensitive data, no transfer of health data.

11. Data Protection Officer (DPO)

The Controller has assessed mandatory DPO appointment criteria (Art. 37 GDPR + WP243 Guidelines) and has not appointed a DPO because:

Not a public authority or body
No large-scale systematic monitoring of data subjects
No special-category (Art. 9) or criminal-conviction data processed at scale — the "outside Art. 9" position is demonstrated by technical measures (anti-PII filter, no prompt persistence)

For privacy questions you may always write to the Controller at privacy@omni-test.it — you will receive a reply within 30 days (Art. 12.3).

12. Policy updates

This policy may be updated for regulatory changes or service evolution. We will notify substantive changes by email. The current version is always available at https://omni-test.it/privacy_en.html. Version history available upon request.

Contacts

Privacy / DSAR: privacy@omni-test.it
Security / vulnerability disclosure: security@omni-test.it
General support: support@omni-test.it