Personal Data Processing Notice

EMSy S.r.l. ("EMSy") operates the EMSy Events platform for the collection and management of health data of participants in sporting events (ultratrails, road races, cycling events and similar).

This notice describes the processing of personal data of healthcare operators (doctors, nurses, paramedics, volunteers) who register and use the EMSy Events platform in the course of their professional activities.

Regarding the healthcare operator, EMSy processes:

a) Registration data: first and last name, email address, phone number, declared professional qualification, organisation.

b) Access data: authentication logs, login/logout timestamps, IP address, browser/device user agent.

c) Operational data: clinical records entered by the operator within the assigned event, accesses to participant anamnesis data (Break-the-Glass log).

d) Consent data: timestamp, IP address and user agent related to acceptance of this notice and the confidentiality agreement.

e) Geolocation data: (1) GPS coordinates (latitude, longitude, elevation) collected at the time of clinical record creation, for the purpose of medico-legal traceability of the healthcare intervention; (2) for field rescuers only, the current position sent to the operations centre about every 25 seconds while the field area of the app is open, to show it on the coordination map. Only the latest current position is kept, and it is deleted when leaving the field area or when it becomes stale: no movement history is kept. Shift clock-in/clock-out does not collect any location data.

Service provision and account management: performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).

Participant health data processed through the operator (on behalf of the organiser, see section 4): care by health professionals (Art. 9.2.h GDPR) and, if the participant is unable to respond, vital interest (Art. 6.1.d and 9.2.c GDPR); the voluntary health form completed by the participant is based on their explicit consent (Art. 9.2.a GDPR). Details in the participants' privacy notice (/privacy/athletes).

Geolocation data: legitimate interest of the event organiser in ensuring the localisation of healthcare interventions and coordination of rescue operations (Art. 6.1.f GDPR), as well as vital interest of the participant in emergency situations (Art. 6.1.d GDPR). The current position of field rescuers is used to dispatch the nearest rescuer and to keep them safe in mountain terrain; it is visible only to the event's operations centre, is not kept as history and is not used to assess the operator's performance or attendance.

Audit trail and security logs: EMSy's legitimate interest in ensuring the integrity and traceability of access to special-category data (Art. 6.1.f GDPR).

Legal obligations: data retention required by applicable law (Art. 6.1.c).

For the processing of participant health data, EMSy acts as a Data Processor under Art. 28 GDPR, on the instructions of the event organiser (Controller). The healthcare operator acts as "authorised person" under Art. 29 GDPR, under the authority and following the instructions of EMSy and the organiser.

Participant anamnesis data (medical conditions, allergies, medications, blood type) is classified as special-category data under Art. 9 GDPR and is accessible only through the Break-the-Glass mechanism, which requires a documented clinical justification and generates an immutable log of every access.

Operator data is not sold or shared with third parties for commercial purposes. It may be disclosed to:

- Event organisers (Controllers), limited to data necessary for the operational management of the event.

- Technical providers, acting as sub-processors under contractual guarantees: Vercel (hosting, EU functions), Neon (database, Frankfurt), Cloudflare R2 (encrypted archive, EU), Google Cloud (reading of report photos and ECGs, EU), Upstash (abuse protection, EU), Brevo (email, France), LiveKit (push-to-talk radio).

- Artificial intelligence decision-support tool (OpenRouter, with OpenAI, Google and Anthropic models, USA): receives the clinical data of the record without name, bib number, contact details or precise location. It does not receive operator identification data.

- Competent authorities, in case of legal obligation or judicial authority request.

Database, archive and storage operate in the European Economic Area. Some providers are based in the United States: for them the safeguards of Arts. 45-49 GDPR apply (EU-US Data Privacy Framework or Standard Contractual Clauses). The artificial intelligence tool processes clinical data without direct identifiers in the United States; contractual safeguards for this transfer are being finalised.

Account data and operational logs: retained for the duration of the account and for 24 months after deactivation, unless longer retention is required by law.

Break-the-Glass logs: retained for 10 years from the date of access (medico-legal purposes and GDPR accountability).

Consent data: retained for the duration of the relationship and for 10 years thereafter (proof of consent).

The healthcare operator has the right to:

- Access their personal data (Art. 15 GDPR).

- Rectify inaccurate data (Art. 16 GDPR).

- Obtain erasure, within the limits permitted by retention obligations and EMSy's legitimate interests (Art. 17 GDPR).

- Restrict processing (Art. 18 GDPR).

- Receive their data in a structured format (portability, Art. 20 GDPR).

- Object to processing based on legitimate interest (Art. 21 GDPR).

- Withdraw consent at any time, without prejudice to the lawfulness of processing before withdrawal.

- Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise your rights: info@emsy.io

To request the deletion of your account and associated data, the operator may send a request by email to info@emsy.io, stating the name, surname and email address of the account to be deleted.

Requests are processed within 30 days of receipt. EMSy will confirm the deletion by email.

What is deleted upon request:

- Registration data: name, surname, email, phone number, professional qualification, organisation.

- Profile access data: preferences, settings, session tokens.

- Event associations: roles and assignments to future events.

What is retained due to legal obligations or legitimate interest (cannot be deleted):

- Security logs and audit trail (SecurityAuditLog, AuditLog): retained for 10 years for medico-legal traceability and GDPR accountability obligations.

- Break-the-Glass logs: immutable logs of accesses to participant anamnesis data, retained for 10 years.

- Consent records: retained for 10 years as proof of acceptance of the terms of use.

- Operational clinical records: records entered by the operator remain associated with the event for healthcare documentation obligations; the reference to the operator is pseudonymised.

EMSy implements appropriate technical and organisational measures, including:

- Encryption of data in transit (TLS 1.3) and at rest.

- JWT authentication with short expiry and role-differentiated refresh tokens.

- Physical separation of anamnesis data in a dedicated table.

- Log of every access to participants' health forms, which cannot be modified or deleted through the application.

- Role-based access control (RBAC).

The EMSy Events platform uses only strictly necessary technical cookies for the operation of the service. No profiling, advertising, or tracking cookies are used.

The technical cookies used are:

- emsy_token: authentication cookie (JWT), duration 15 minutes, HttpOnly, Secure, SameSite=Lax.

- emsy_refresh_token: session cookie for authentication renewal, duration 7 days (30 days for field rescuers, to work without network), HttpOnly, Secure, SameSite=Lax.

- NEXT_LOCALE: language preference cookie (it/en), set by the internationalisation framework.

Under the Italian Data Protection Authority's Provision of 10 June 2021, technical cookies do not require user consent and may be used without a consent banner.

The analytics service (Vercel Web Analytics) used by the platform does not use cookies and does not perform individual user tracking.

EMSy reserves the right to update this notice. Material changes will be notified via the platform or by email with reasonable notice. Continued use of the platform after notification constitutes acceptance of the new version.