Last updated: 12 October 2026. We review this policy every year, and whenever the site changes in a way that matters for your data.
This policy explains how Bioscience Institute processes the personal data of people who visit bioinst.com and of people who write to us through the site’s forms, under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and San Marino Law no. 171/2018 (“RSM Law”). Our healthcare and laboratory services have their own privacy notices, which you receive when you use them.
1. Data controller and contacts
Bioscience Institute S.p.A.
Strada Rovereta, 42 – 47891 Falciano, Republic of San Marino
Email: privacy@bioinst.com
Representative in the European Union: Bioscience Genomics S.r.l., Via della Ricerca Scientifica, 1 – 00133 Rome, Italy, amministrazionegenomics@bioinst.com.
Data Protection Officer (DPO): dpo.bioinst@novapoesis.it, Via Pomposa 43/i – 47924 Rimini, Italy.
2. The data we process
When you browse
The systems that run the site receive the technical data of every visit: IP address, browser and device, the page requested, date and time, and the page you came from. We use them to show you the pages, to protect the site from abuse and to find faults. Only with your consent do we also collect visit statistics with Google Analytics (see the Cookie policy).
When you write to us
In the forms for information requests, call-back or appointment bookings, kit orders and similar, we ask for your first and last name, email, phone number, city or country, age, how you heard about us, when you prefer to be called back and your message; we also record the page you write from. Some forms ask for more, always shown in the form:
- Prenatal tests: expected due date, week of pregnancy, planned clinic or hospital and gynaecologist. These are health data.
- MYCOLON CARD activation: Italian tax code, date and result of the colonoscopy, the colonoscopy receipt and the IBAN for the refund. The date and result of the colonoscopy are health data.
- Returns and exchanges: order number and details of the return.
- Invoice area: the invoice code and your tax code, used only to find and show your invoice. The site does not keep them.
- Job applications (“Work with us”): your CV and the data it contains, processed under the notice for job applicants (in Italian).
Please do not include health information in your message beyond what the form asks for.
Anti-spam checks
To tell people from automated programs, the forms use Cloudflare Turnstile and, on some forms, Google reCAPTCHA. Both analyse technical signals from your browser, such as the IP address and device characteristics.
When you join the HELIXAFE waitlist (visitors from the United States)
On the HELIXAFE product pages, visitors from the United States can leave their email address to hear when HELIXAFE becomes available to them. With it we record the page and product you sign up from, the page language and view (patients or healthcare professionals), the page you came from and any campaign parameters in the address. We use them, with your consent, to send you emails about HELIXAFE availability and the programme: you can unsubscribe from any email, and we keep the address until you do. The list is shared with the HELIXAFE store (helixafe.bioinst.com).
3. Why we process your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your request, sending you information or a quote, calling you back or booking an appointment | Steps taken at your request before a contract (Art. 6(1)(b) GDPR; Art. 5(1)(b) RSM Law) |
| Processing the health data asked for in the prenatal-test and MYCOLON CARD forms | Your explicit consent, given with the box in the form (Art. 9(2)(a) GDPR and the corresponding provision of the RSM Law) |
| Handling the MYCOLON CARD refund and keeping its records | Performance of the initiative you join (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR) |
| Running the site, protecting it from abuse and spam, fixing faults | Our legitimate interest (Art. 6(1)(f) GDPR; Art. 5(1)(f) RSM Law) |
| Visit statistics (Google Analytics) | Your consent, given in the cookie banner (Art. 6(1)(a) GDPR; Art. 5(1)(a) RSM Law) |
| Sending you newsletters and promotional messages, including personalised ones, if you ask for them with the box provided | Your consent (Art. 6(1)(a) GDPR; Art. 5(1)(a) RSM Law) |
| Meeting legal obligations and defending our rights | Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) |
The data marked as required are needed to handle your request: without them we cannot answer. Consent to statistics and marketing is optional; you can refuse or withdraw it at any time, with no effect on the service.
4. Who receives your data
Your data are processed by our authorised staff and, when your request concerns them, by the companies of the Bioscience Institute group in Italy, San Marino and the United Arab Emirates. We also use providers who process data on our behalf, as processors:
- Cloudflare, Inc.: hosting and delivery of the site, security, anti-spam checks (Turnstile) and storage of the requests sent through the forms, in a database hosted in Western Europe;
- The Rocket Science Group LLC (Mailchimp Transactional, “Mandrill”): sending the emails generated by the forms;
- Klaviyo, Inc.: the HELIXAFE waitlist emails for visitors from the United States;
- Google Ireland Limited: Google Tag Manager and Google Analytics (only with your consent), Google reCAPTCHA, Google Fonts and the YouTube video player;
- Vimeo.com, Inc.: the video player on some pages;
- the providers that run the invoice-area service and those that support our IT systems.
Data may be disclosed to authorities when the law requires it. We do not sell your data and we do not publish it.
5. Transfers outside the European Union
Some providers are based in the United States (Cloudflare, Mailchimp, Klaviyo, Vimeo) or may access data from there (Google). In those cases the transfer relies on the EU-U.S. Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the European Commission (Articles 44 onwards of the GDPR and the corresponding provisions of the RSM Law). You can ask us about the safeguards in place.
6. How long we keep your data
- Requests sent through the forms: for as long as needed to handle the request and any follow-up; we then delete or anonymise them, unless the law requires us to keep them longer or we need them to protect our rights.
- MYCOLON CARD: for as long as needed for the refund, then for the period required by tax and accounting rules.
- Marketing consent: until you withdraw it, and no longer than two years from consent or its renewal for promotional messages, one year for personalised offers.
- Technical browsing data: for short periods, as long as needed for security and fault finding.
- Statistics: according to the Google Analytics retention settings, 14 months at most.
7. Your rights
At any time you can ask us to:
- tell you whether we process data about you, and give you a copy (access);
- correct or complete them (rectification);
- delete them when they are no longer needed, when you withdraw consent or when the processing is unlawful (erasure);
- limit their use (restriction);
- give them to you in a structured, commonly used format and send them to another controller (portability);
- stop processing based on our legitimate interest and, always and without giving reasons, direct marketing (objection);
- withdraw your consent, without affecting processing already carried out.
Write to privacy@bioinst.com or send a registered letter to the controller, or contact our EU representative or the DPO at the addresses in section 1. We answer free of charge within one month. You can also lodge a complaint with the data protection authority of the Republic of San Marino (Autorità Garante per la protezione dei dati personali) or with the supervisory authority of the EU country where you live or work (in Italy, the Garante per la protezione dei dati personali).
8. Cookies
The site uses technical cookies and, only with your consent, statistics cookies. The details are in the Cookie policy; you can change your choices at any time from Cookie settings.
9. Security
Communication with the site is encrypted (HTTPS), access to data is limited to the people who need it for their work, and our providers apply appropriate security measures. If a data breach occurs, we follow the procedures set by the GDPR and the RSM Law.
10. Minors
The site’s forms are meant for adults. If you are under 18, please ask a parent or guardian to contact us for you.
11. Changes
We may update this policy; the date at the top shows the version in force. If a change affects processing based on consent, we will ask for your consent again.
