Data controller
The data controller is ICMED S.r.l., Via F. Casiraghi 34, 20099 Sesto San Giovanni (MI), Italy.
For any question about personal data, including the exercise of the rights described below, write to info@icmed.net.
Scope of this notice
This notice covers the website icmed.net and the internal SEO analysis tool used by ICMED (ICMED SEO, described in a dedicated section).
Other ICMED services, such as IAAPP and ICMED Magazine, have their own notices published on their respective sites. Any survey or study promoted by ICMED comes with a dedicated notice.
What data we process, why and on what basis
Contact requests
If you use the form on the Contact page or on the home page, we process the name, e-mail address and message you enter, the type of organisation or need (optional), the type of request, the page the request was sent from and the site language. The request reaches ICMED by e-mail; the website does not store it in its own archive.
Purpose: to reply to your request. Legal basis: steps taken at the data subject's request before entering into a contract (Art. 6(1)(b) GDPR). Name, e-mail and message are needed to be able to reply; without them the form cannot be sent. No marketing consent is required to send a request.
Please do not enter patients' health data or other special categories of data in the message.
The form also records a technical counter of submissions (outcome, request type, page, language and time) that contains no personal data.
Website security and abuse prevention
To protect the forms from spam and automated submissions we use a hidden trap field, a limit on the number of submissions, a session token against forged requests and the Google reCAPTCHA v3 service (see “Third-party services and cookies”). For the reCAPTCHA check, your IP address and technical browser data are sent to Google. Legal basis: ICMED's legitimate interest in the security of the site (Art. 6(1)(f)).
Browsing data
Web servers automatically record the IP address, date and time, requested page, outcome of the request, referring site and browser type. They are used for operation, security and fault diagnosis; they are not used to profile visitors. Legal basis: legitimate interest (Art. 6(1)(f)).
Cookies
The site sets a single first-party technical cookie. Details in the Cookie Policy.
We do not carry out automated decision-making or profiling of site users.
Third-party services and cookies
The pages of the site rely on a few Google and YouTube services:
- Google Fonts: typefaces are requested from Google's servers on every page; Google therefore receives your IP address and technical browser data.
- Google reCAPTCHA v3: loaded on the home page and on the Contact page to protect the forms from spam.
- YouTube: on the resources page, video thumbnails are requested from YouTube; the video itself loads from YouTube only after you press “play”, and at that point YouTube may set its own cookies.
- Google Workspace (SMTP relay): notification e-mails for contact requests are sent through Google's mail service.
The site does not use analytics tools or marketing or profiling cookies. For processing carried out by Google on its own account, please see Google's privacy notices (policies.google.com/privacy).
ICMED SEO module and Google Search Console data
ICMED uses an internal SEO analysis tool, ICMED SEO, to measure and improve the visibility of icmed.net in search results. The tool is not a public service and does not collect data from visitors to the site.
How it accesses Google data
An ICMED administrator authorises the tool through Google OAuth, granting only read permission on Search Console data (scope https://www.googleapis.com/auth/webmasters.readonly). The tool cannot change anything in Search Console or on the website. The data read belongs to the Search Console property sc-domain:icmed.net, which covers icmed.net and its subdomains, including magazine.icmed.net.
What data it receives
Aggregated statistics on how the site performs in Google Search: clicks, impressions, CTR and average position, broken down by date, search query, page, country and device. This data does not identify visitors: Google does not provide it at the level of individual people. The tool also stores the access token (OAuth refresh token) of the authorised Google account.
What it uses the data for
Only to analyse and improve the search ranking of icmed.net: trends over time, comparisons between periods, classification of queries and pages by topic area, internal reports and an SEO improvement plan. No change to the website is applied automatically.
Who can access it and how it is protected
Access is limited to expressly authorised ICMED administrators. The data is stored in ICMED's database, on a server managed by ICMED. The OAuth token is stored encrypted and is never shown in the interface.
Sharing
Data received from Google is not sold, transferred or disclosed to third parties, and is not used for advertising, to profile people or to train or feed artificial intelligence models.
Revoking authorisation
Authorisation can be revoked at any time: from the tool's settings (“Disconnect”, which revokes access at Google and deletes the token from ICMED's database) or directly from the Google account at myaccount.google.com/permissions.
Retention and deletion of history
Disconnecting deletes the token but does not automatically delete the statistical history already imported. ICMED keeps the history for an ordinary period of 24 months and deletes older data with a periodic manual procedure. The history can be deleted sooner, in whole or in part, on written request to info@icmed.net.
Google API Services User Data Policy
ICMED SEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Recipients and transfers outside the EU
Data is processed by authorised ICMED staff and by providers that supply, on ICMED's behalf, the technical services needed (the website server and e-mail). The Google services mentioned above are governed by Google's terms and notices.
Google may process data outside the European Economic Area, in particular in the United States. Such transfers take place with the safeguards provided by the GDPR (adequacy decision for companies participating in the EU-US Data Privacy Framework, or standard contractual clauses). ICMED does not sell personal data.
How long we keep data
- Contact requests (e-mails received): for the time needed to reply and handle the follow-up and, where there is no ongoing relationship, for a maximum of 24 months from the last contact. If the request leads to a contract, data follows the terms of the contract and legal obligations.
- Web server logs (browsing data): 90 days. Application error logs are kept for about 8 weeks.
- Session cookie: until the browser is closed.
- Google Search Console statistics (ICMED SEO): 24 months of ordinary history; OAuth token: until disconnection or revocation.
Your rights and complaints
Under Articles 15–22 GDPR you have the right to access your data, to have it rectified or erased, to obtain restriction of processing, to data portability, and to object to processing based on legitimate interest.
To exercise your rights write to info@icmed.net; we reply within one month of the request, as the GDPR requires.
If you believe the processing breaches the GDPR you may lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of your country of residence.
Updates
This notice may be updated, for example if the services used by the site change. The version in force is always the one published on this page. Last updated: 7 November 2026.