Privacy notice for race participants

The data controller is the organiser of the race you registered for (for example VDA Trailers for the Tor des Géants and the Gran Trail Courmayeur): the organiser must provide medical assistance and chose EMSy Events to do so. Their contact details are in their registration privacy notice.

EMSy S.r.l., Via degli Anziani 14, 11013 Courmayeur (AO), Italy, info@emsy.io, provides the platform and processes data on behalf of the organiser as data processor (Art. 28 GDPR), under a written agreement.

Only for scientific research (section 6), and only if you consented, the controller is EMSy S.r.l.

Registration data needed for rescue: name, bib number, date of birth, sex, language, nationality, race and category, email, phone, emergency contact, wristband code. We do not receive your tax code or address.

If you receive assistance during the race: the clinical record of the intervention completed by doctors, nurses and rescuers (vital signs, problems found, care and medication, tests, outcome, location of the intervention, any photos).

If you fill it in: the voluntary health form (section 5).

To provide medical assistance for the event and to treat you: the organiser's obligation and protection of your health (Art. 6(1)(c) and 6(1)(d) GDPR), care by health professionals bound by professional secrecy (Art. 9(2)(h) GDPR) and, if you are unable to respond, protection of your life (Art. 9(2)(c) GDPR).

Your consent is not needed to treat you: nobody can refuse assistance because a signature is missing.

Consent is needed for the voluntary health form, for research and for being contacted after the race. Each one is separate, optional and can be withdrawn.

- The race's doctors, nurses, rescuers and operations centre, authorised and bound to confidentiality.

- The 112/118 emergency service and the hospital, if you are transferred.

- EMSy's technical providers, bound by contract: hosting and database in the European Union (Vercel, Neon in Frankfurt), encrypted archive (Cloudflare R2, EU), reading of report photos and ECGs (Google Cloud, EU), real-time updates to the operations centre (Upstash, EU), email (Brevo, France).

- The artificial intelligence decision-support tool, which gives rescuers a non-binding second opinion: it receives only clinical data of the intervention, without name, bib number, contact details, health form or precise location, through a provider based in the United States (OpenRouter, with OpenAI, Google and Anthropic models).

Your data are not sold or used for advertising.

Before the race you may, if you wish, enter allergies, medication, known conditions, blood group and notes for rescuers. It is optional: not filling it in changes nothing for your registration.

Only the rescuers assisting you can see it: to open it they must state the clinical reason, and every access is logged. It is never sent to the artificial intelligence tool.

Legal basis: your explicit consent (Art. 9(2)(a) GDPR). You can delete it at any time.

If you do not receive assistance, it is deleted 90 days after the end of the race. If you are assisted, it becomes part of the record of the intervention and is kept with it (section 7).

If you ticked the research box in the registration form, EMSy S.r.l., as controller, uses your race data and any health data for research in sports and mountain medicine, epidemiology and safety of endurance races, also with universities, hospitals and research institutions. Where the law requires it, each study is reviewed by an ethics committee.

What we study: injuries and illnesses during races and their risk factors; endurance-specific conditions (gastrointestinal, sodium and hydration, hypothermia, exhaustion); effectiveness of race medical organisation; validation of clinical protocols and decision-support tools.

How: data are pseudonymised (your name is replaced with a code; never name, bib number or contact details in datasets), results are published only in aggregate or anonymous form. Pseudonymised data are kept for the duration of the studies and at most 10 years after the race.

Legal basis: explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR) with the safeguards of Art. 89 GDPR. Consent is optional and is not a condition for racing. If you did not give it, your data are used only in anonymous aggregate statistics, which cannot identify you.

You can withdraw it at any time by writing to info@emsy.io: from then on your data are not used in new analyses.

For 90 days after the end of the race the data can be consulted on the platform.

After that, the data that identify you, together with the records of any interventions, move to an encrypted archive kept for 10 years in the European Union, which can only be opened with a key kept outside the cloud. It protects you and those who treated you in case of disputes about the care provided (Art. 2946 Italian Civil Code; Law 24/2017). Only clinical data without your name remain on the platform.

Contact details for post-race follow-up and automatic summaries: deleted after 90 days. After 10 years the archive is deleted.

You can request access to your data, rectification, erasure, restriction or object to processing, and you can withdraw the consents you gave at any time (health form, research, follow-up).

The clinical record of an intervention cannot be erased on request, because it is medical documentation that must be kept (Art. 17(3) GDPR); you can however ask for it to be corrected.

How: write to info@emsy.io stating the race, your bib number and the email used for registration, or contact your race organiser. We reply within 30 days, in agreement with the organiser. To check that the request comes from you, we may write to your registration email.

You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country.

If this notice changes, the new version is published on this page with its date. Consents already given remain linked to the version you read; for new uses we will ask for new consent.