Skip to content

Privacy Policy

Last updated: October 2026

This is an English translation provided for convenience. The Italian version is the authoritative text and prevails in the event of any discrepancy.

Data controller

Dr. Ernesto Bruschi — Centro Odontoiatrico Denti+
Corso Lazio 17, Scala B, 2nd floor — 03100 Frosinone (FR), Italy
Email: [email]
Tel. +39 0775 889009
VAT no. 15092531001
Clinical Director: Dr. Ernesto Bruschi — Dentist
Registered with the Frosinone Register of Dentists, no. 594
Authorisation no. 406946 of 15/06/2020

No Data Protection Officer (DPO) has been appointed, as this is not mandatory for this activity under Art. 37 GDPR.

Data collected and purposes of processing

1. Newsletter and informational communications

The email address and, where provided, the name of users who voluntarily subscribe to the newsletter or download informational material (e.g. clinical guides) are used to: send the requested material, send a short series of follow-up emails on the subject of the guide, and periodically send articles, clinical updates and news from the bonebenders.com blog.

Contacts are managed through the Brevo platform (Sendinblue SAS), acting as data processor. An unsubscribe link is included in every email sent.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

2. Contact form

The form on the Contact page collects name, email, phone number (optional) and message. The data is forwarded by email to the controller through Web3Forms in order to answer the enquiry. It is not used for automated marketing.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR) and, alternatively, the legitimate interest in responding to unsolicited enquiries (Art. 6(1)(f) GDPR).

3. Blog comments

The comment system collects: name, email address and the text of the comment. The email address is not published. Comments are moderated before publication.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

4. AI chatbot (Bonebenders Agent)

The chatbot on the site uses the Anthropic (Claude) API to process user questions. Messages are transmitted to Anthropic's servers in order to generate the answers. The conversation is not retained and is not linked to the user's identity: we do not record IP addresses, cookies, session identifiers, or the model's replies.

The text of the individual question is retained, so that we know what the site cannot yet answer and can decide what to write next. Before it is stored, the question is automatically stripped of email addresses, phone numbers and Italian fiscal codes, and truncated to 300 characters; alongside it we record only the language, the page it was asked from, the day (not the time) and whether the site covered the topic. No name, no IP address, no link between one question and another or to the same person. The register lives in a Cloudflare D1 database and is deleted after 90 days. Redaction is automatic: for this reason we ask users not to enter personal or health data, their own or anyone else's, into the chat.

Legal basis: consent of the data subject for using the chatbot (Art. 6(1)(a) GDPR); legitimate interest of the controller in knowing which questions the site does not cover and improving its content, on redacted data that cannot be traced to an identified or identifiable person (Art. 6(1)(f) GDPR).

The MCP connector (bonebenders.com/mcp), which lets external AI assistants read the published pages, is read-only and records nothing: neither the questions nor who asks them.

5. Submitting public questions (Q&A)

The Questions and Answers section lets users submit clinical questions of general interest. The form collects: name, email address, topic area (e.g. implantology, periodontology) and the text of the question. The data is forwarded by email to the controller through Brevo (Sendinblue SAS), acting as data processor for transactional sending only.

Selected questions may be published on the blog in anonymised or pseudonymised form, after editorial review. Full names and email addresses are never published. Users may at any time request deletion of their question or of their data by writing to [email] .

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

6. Periodontal calculator (AI radiograph analysis)

The periodontal diagnosis calculator is a clinical support tool. The questionnaire data (clinical parameters, risk factors) is processed locally in the browser and is neither transmitted nor stored. Any radiograph uploaded by the user is sent — subject to consent, given when the tool is opened — through a server function (Vercel Inc.) to Anthropic, PBC (Claude) for AI-assisted analysis. The image is not stored by this site. The tool sets no cookies and does not use the device for tracking purposes.

Legal basis: consent of the data subject (Art. 6(1)(a) and — as the data is potentially health data — Art. 9(2)(a) GDPR). The tool is not a substitute for an examination: the final diagnosis remains the clinician's responsibility.

7. Drug interaction checker

Drug names typed into the drug interaction checker are only used to look them up and are not stored. The exception is a name that returns no result: the site then asks the public Banca Dati of AIFA (the Italian Medicines Agency) which active ingredients it contains, and records the typed name (redacted and cut to 60 characters), AIFA's answer and the day (not the time). No IP address, no link to other searched drugs or to the person. The register shows which drugs the database lacks; it is kept in Cloudflare D1 and deleted after 90 days. AIFA only receives the drug name, sent by the site's server.

Legal basis: legitimate interest of the controller in completing the checker's database, on data that cannot be linked to an identified or identifiable person (Art. 6(1)(f) GDPR).

8. Browsing statistics (Google Analytics 4)

Subject to explicit consent through the cookie banner, the site uses Google Analytics 4 for aggregate browsing statistics. Consent is managed with Google Consent Mode v2: until you accept, analytics storage remains disabled and no _ga cookies are set. You can change your choice at any time from the "Manage cookies" link in the footer.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR; Art. 122 of the Italian Privacy Code).

Consent register

To meet the obligation to demonstrate consent (Art. 7(1) GDPR), the site keeps a technical register of consent and refusal events (analytics cookies, newsletter, contact form, comments, Q&A questions). The register stores date and time, purpose, outcome (granted/denied), the version of the privacy notice, and irreversible hashes of the email address and IP address — not the data in clear text. Retention: up to 24 months from the record date, unless the law requires otherwise.

Data retention

Newsletter contact data is stored on the Brevo platform (Sendinblue SAS, based in the EU). Blog comments, the consent register, the register of questions asked in the chat and the register of drugs not found by the interaction checker are stored in a Cloudflare D1 database (Cloudflare, Inc. infrastructure).

Third-party services

Google Analytics 4 (Google LLC) — The site uses Google Analytics to collect anonymous statistical data on browsing (pages visited, session duration, approximate geographic origin), only after consent. The data is collected through cookies (_ga, _ga_*) and transmitted to Google's servers in the United States, with Google Consent Mode v2. No personally identifying data is collected. Google's privacy policy: policies.google.com/privacy.

Brevo (Brevo, formerly Sendinblue — Sendinblue SAS) — Email delivery and management of newsletter subscribers are handled through Brevo. The data transmitted includes the email address and, where provided, the recipient's name. Brevo's privacy policy: brevo.com/legal/privacypolicy.

Cloudflare Pages, D1 and Turnstile (Cloudflare, Inc.) — The site is hosted on Cloudflare Pages. Comments, the consent register, the register of chat questions and the register of drugs not found by the interaction checker (redacted, 90 days) are stored in Cloudflare D1. Cloudflare may collect technical browsing data (IP address, user agent) for security and performance purposes. Cloudflare Turnstile protects the forms against bots (script served from challenges.cloudflare.com); it does not profile users for advertising. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

Anthropic (Anthropic, PBC) — The chatbot uses the Claude API. User messages are transmitted to Anthropic's servers to generate the answers. Anthropic's privacy policy: anthropic.com/privacy.

Web3Forms (Web3Forms) — The contact form uses Web3Forms to forward messages. The data entered (name, email, phone, message) is transmitted to Web3Forms' servers for delivery by email to the controller. Web3Forms does not use cookies. Privacy policy: web3forms.com/privacy.

YouTube (Google LLC) and Vimeo (Vimeo.com, Inc.) — On pages that embed video, the embeds use privacy-enhanced mode (youtube-nocookie.com) or Do Not Track (Vimeo). Third-party cookies can only be set once the user starts the video. Privacy policies: Google/YouTube, Vimeo.

Vercel Inc. — Hosts the periodontal calculator tool (loaded only after an explicit click). It may process technical connection data. Privacy policy: vercel.com/legal/privacy-policy.

Typefaces — The Inter and Playfair Display fonts are hosted directly on this site's server (self-hosted). No connection is made to external servers to load the typefaces, and no personal data is transmitted to third parties for this purpose.

Transfers outside the EU

Cloudflare, Google, Anthropic, Web3Forms, Vimeo and Vercel are based (or have infrastructure) outside the European Economic Area. Data transfers are made in compliance with the GDPR, on the basis of Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework, where applicable.

Your rights

Under Articles 15-22 GDPR, you may at any time request access to your data, its rectification or erasure, restriction of processing, data portability, or the withdrawal of your consent, by writing to [email] . You can also unsubscribe from the newsletter using the link in every email. You further have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

Cookies

For information on the cookies used by this site, see the Cookie Policy.