Privacy Policy

Who we are

Supercell is run by:

For anything about your personal data, write to [email protected]. Privacy requests, including requests to exercise your rights, go to the same address.

Who is responsible for what

Supercell is software that clinics use to care for their patients. Who is responsible for your data depends on why it is processed.

We (IUVENTA S.R.L.) are the controller for:

• this website, its cookie choices and its measurement;
• messages sent through the contact form or to our email address;
• the accounts of clinics and of their team members (doctors, staff and clinic administrators): sign-in, security settings and account history;
• the clinic's subscription: plans, seats, AI usage, invoices and payment status;
• the security of the service: sign-in records, the audit trail of actions, security reports and abuse prevention.

The clinic is the controller for its patients' data: the patient record and everything the clinic keeps or receives about a patient in Supercell, including health questionnaires, consultations, protocols and prescriptions, documents and lab reports, orders, and the messages and notifications the clinic sends. The clinic decides why and how this data is used, and is responsible for having a legal basis to use it. We process it only on the clinic's documented instructions, as its processor under Article 28 GDPR and the data processing agreement that forms part of our Terms and Conditions.

If you are a patient, please contact your clinic first about your record: it decides on it. We will help the clinic answer you, and we will pass on to the clinic any request that reaches us about its patients.

What data we process

When you visit the website:

• technical data your browser sends with every request: your IP address, the page asked for, the time, the browser and device type, and the page you came from;
• your cookie choice, your language and your light or dark theme (see the Cookie Policy);
• if, and only if, you accept analytics cookies: how you use the website, measured by Google Analytics;
• on the contact page: the signals Cloudflare Turnstile reads in your browser to tell a person from an automated program.

When you write to us through the contact form:

• your name, email address, clinic or organisation (if you give it), the topic you choose, your message and the language of the page;
• your confirmation that you have read this policy.

When you use the app as a member of a clinic's team:

• your name, email address, title, role and the clinics you work in, and a mobile number if you choose text-message sign-in codes;
• your sign-in methods: your password, stored only as a one-way hash, your passkeys and your authenticator app setting;
• your signed-in sessions, with the IP address and browser of each, so that you can see them and end them;
• a record of what you do in the app (for example creating, signing or deleting a record), kept in the audit trail;
• what you write and upload in the app, and your language and display preferences.

For the clinic's subscription:

• the clinic's name, billing contact and billing details, its plan and number of seats;
• how many AI tokens the clinic uses, measured per clinic and per seat;
• invoices and payment status. Card details are entered on Stripe's own pages and never reach us.

On behalf of the clinic, for its patients (the clinic is the controller):

• identity and contact details: name, email address, phone number, date of birth, and the delivery address of an order;
• health data: answers to health questionnaires, consultation bookings, notes and outcomes, protocols and prescriptions, documents and lab reports with the values read from them;
• orders: what was ordered, the price quoted, the payment method chosen and the payment status;
• consents the patient gives in the portal, notifications and messages, and the patient's portal account and sign-in data.

If a patient starts a health questionnaire and does not finish it, the answers are kept in that browser for at most 24 hours, so the patient can continue. They are removed when the questionnaire is sent, on sign-out, and when the sign-in page or another person's portal opens in that browser.

Why we process it and on what legal basis

• To provide the service the clinic subscribed to: the contract with the clinic (Article 6(1)(b) GDPR). For team members who are not themselves party to that contract: our and the clinic's legitimate interest in running the clinic's accounts (Article 6(1)(f)).
• To keep the service and its data secure, prevent abuse, and keep the audit trail: our legitimate interest in a secure service, and the security duties the GDPR places on us (Articles 6(1)(c), 6(1)(f) and 32).
• To bill the clinic and keep accounting records: the contract (Article 6(1)(b)) and Italian tax and accounting law (Article 6(1)(c)).
• To answer your message: steps you ask for before a contract (Article 6(1)(b)), or our legitimate interest in answering the people who write to us (Article 6(1)(f)).
• To check that a contact message comes from a person (Cloudflare Turnstile): our legitimate interest in keeping the form free of spam and abuse (Article 6(1)(f)).
• To measure the website with Google Analytics: your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Code). You can withdraw it at any time, as easily as you gave it.
• To store what the website and app need to work (strictly necessary cookies and storage): no consent is needed (Article 122 of the Italian Code); see the Cookie Policy.

Patient health data is a special category of data (Article 9 GDPR). The clinic decides on its legal basis. The patient portal asks patients, on the clinic's behalf, for their explicit consent to the clinic's use of their health data (Article 9(2)(a)); a clinic may also rely on the provision of health care under the responsibility of a professional bound by professional secrecy (Article 9(2)(h) and 9(3)). We process health data only to provide the service to the clinic, on its instructions.

Giving us the data marked as required in a form is necessary for what you ask: without it we cannot answer a message, open an account or run a clinic's subscription.

AI features and decisions

Supercell is not a medical device and does not give medical advice. Its AI features draft, summarise, search the evidence and read documents for a clinician. A physician reviews and signs every clinical result, and remains responsible for every clinical decision.

When a clinician uses an AI feature, what they enter or select for that feature (for example a question, consultation notes, the clinical details a draft needs, or a lab report to read) is sent to the AI provider that runs it, and the result comes back into the app. The provider receives it only to run that feature.

No decision that has legal effects on you, or that affects you in a similarly significant way, is taken by automated means alone (Article 22 GDPR).

Who receives the data

We use the following providers. Each receives only the data needed for the service named next to it.

• Hetzner Online GmbH (Germany): the servers that run Supercell and its database.
• DigitalOcean, LLC: file storage in its Frankfurt, Germany data centre, for documents, logos, transfer receipts held for a retry, and the backup copies of the whole database, which include patient and health data. Documents, lab reports and held receipts are encrypted by us before they are stored; the storage is reached only with our access keys.
• Cloudflare, Inc.: carries all traffic to the website and the app (network, DNS and protection against attacks) and runs Turnstile on the contact page. On public pages only, its cookieless Web Analytics may be enabled at the network level, counting page views and measuring page speed.
• Twilio Inc. (SendGrid): sends our emails, such as sign-in codes, invitations, reminders and notifications.
• Telnyx LLC: sends text messages, such as sign-in codes and reminders, where the clinic or the user chose them.
• Stripe: takes the clinic's subscription payments and holds the clinic's card and billing details.
• Google: Google Analytics on the website and the sign-in pages, only after consent; and Google Calendar, if a doctor connects it.
• Microsoft: Outlook calendar, if a doctor connects it.
• Google Fonts: the HTML version of our emails asks the recipient's mail app to load the Inter typeface from Google's servers. If the mail app loads it, Google receives the recipient's IP address and technical details of the device.
• Anthropic, PBC: reads uploaded lab reports so that their values can be entered for the clinician to check.
• A specialised clinical AI provider: runs the evidence search, chat and drafting features.

A consultation written into a connected calendar carries a fixed title and a link into the app: never the patient's name, contact details, reason for the visit or health data.

We also disclose data where the law requires it (for example to a court or an authority that is entitled to ask), and to our professional advisers under a duty of confidentiality. We do not sell personal data.

Transfers outside the European Economic Area

Our servers and file storage are in Germany. Some providers listed above are based in the United States, or may access data from there (Cloudflare, Twilio, Telnyx, Stripe, Google, Microsoft, Anthropic and DigitalOcean). Under Chapter V GDPR, data may leave the European Economic Area only with a safeguard, such as an adequacy decision of the European Commission (for the United States, the EU-U.S. Data Privacy Framework, for providers that participate in it) or the European Commission's standard contractual clauses. To learn which safeguard applies to a provider, write to [email protected].

How long data is kept

• Patient data: for as long as the clinic keeps it. When the clinic deletes a patient record, it can be restored for 90 days and is then removed by a daily job. Deleted documents can be restored for 30 days; deleted AI conversations for 90 days; deleted protocols, compound reviews, notes, lab analyses and lab panels for 180 days; deleted prescriptions for 365 days. Then they are removed.
• The audit trail: records of clinical actions and messages are kept without an end date set by the software, because a regulator may ask about them years later; the clinic is responsible for how long its records must be kept. Records of administrative actions, data access and data exports are kept for 5 years; sign-in events for 2 years.
• Cookie consent records: 3 years. Security reports from browsers: 30 days. Counters that limit repeated requests: about a day. Sign-in codes: removed a day after they expire. Data export packages: 7 days.
• Contact form messages are not stored in Supercell: they reach our email inbox, and we keep them as long as we need them to answer you and follow up.
• Clinic accounts and subscription records: for as long as the clinic uses Supercell; billing and accounting records for as long as Italian tax and accounting law requires. When a subscription ends, the clinic's data is not deleted automatically: the clinic can export it, and we delete it when the clinic asks us to, or as our agreement with the clinic provides.
• Backups: we keep backup copies of the whole database, including patient data, in DigitalOcean's Frankfurt data centre to recover from a failure. Data removed from the service stays in the existing backups until those backups are deleted.

How data is protected

• Every connection is encrypted (HTTPS).
• Documents, lab reports and held transfer receipts are encrypted with a key of their own before they are stored. Database backups are stored in DigitalOcean's Frankfurt data centre under access control.
• Each clinic's data is separated in the database itself (row-level security): one clinic's account cannot read another clinic's records, and where the clinic chooses, a doctor sees only the patients assigned to them.
• Sign-in can be protected with a second step: a passkey, an authenticator app, or a one-time code sent by email or text message. A clinic can require it for its team, and patients can turn it on.
• The audit trail is hash-chained: each record is linked to the one before it, so a change or a removal shows.
• Repeated requests are limited, and every user can see their signed-in sessions and end them.

Your rights

You have the right to ask for access to your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests (Articles 15 to 21 GDPR). Where processing is based on your consent, you can withdraw it at any time; this does not affect what was done before.

Write to [email protected]. We answer within one month, which may be extended by two further months for complex requests, as the GDPR allows. We may ask you to confirm your identity first.

Patients: your clinic controls your record, so please send requests about it to your clinic. If you write to us, we pass your request on to the clinic and help it answer you.

Cookie choices can be changed at any time with the Cookie settings link at the bottom of every page.

Complaints

You have the right to complain to a supervisory authority, in particular in the EU country where you live or work or where an infringement took place. In Italy it is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it. We would welcome the chance to address your concern first: write to [email protected].

Children

The website and the clinic app are for adults and professionals and are not directed at children. Whether a clinic cares for minors through Supercell, and how a parent or guardian acts for them, is decided by the clinic as the controller of its patients' data.

Changes to this policy

We will update this policy when the service or the law changes. The date at the top shows the current version. If a change matters to how your data is used, we will tell clinics and signed-in users before it takes effect.

This version takes effect on 5 October 2026.

Language versions

This policy is published in English, Italian, German, Russian and Lithuanian. If the versions differ, the English version prevails, without prejudice to the mandatory provisions of Italian law.