Legal
Privacy Notice
Last updated 25 August 2026 · Applies to theforma.it, theforma.io and the FORMA practitioner portal
This notice explains what personal data Forma S.R.L.S. collects when you use our websites, submit an enquiry, talk to the FORMA AI assistant or hold an account in the practitioner portal — and what we do with it. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
Forma S.R.L.S.
Via dell'Annunciata 23/4, 20121 Milano, Italy
info@theforma.it
1. What we collect, and why
| What | When | Legal basis |
|---|---|---|
| Name, email, country, clinic or company, your message | You submit the enquiry form | Art. 6(1)(b) — steps prior to a contract, and Art. 6(1)(f) — our legitimate interest in responding to trade enquiries |
| Professional credentials, licence details, specialty | You apply for a practitioner portal account | Art. 6(1)(b) and Art. 6(1)(c) — our obligation to supply professional-use medical devices only to qualified practitioners |
| The text of your conversation with FORMA AI | You use the assistant | Art. 6(1)(f) — legitimate interest in operating and improving the service |
| IP address, request time, browser type | Automatically, on every request | Art. 6(1)(f) — security, abuse prevention and rate limiting |
We do not ask for, and do not want, patient data. Please do not send us identifiable information about a patient through any form on this site or through the AI assistant.
2. Health data
Our products are professional-use medical devices. If you volunteer information about your own health in an enquiry or to the assistant, that is special-category data under Art. 9 GDPR and we process it only on the basis of your explicit act of sending it, solely to answer you. We would rather you did not — a qualified practitioner is the right place for that conversation.
3. Who sees it
Personal data is seen by FORMA staff who need it to answer you, and by the following processors:
- Our hosting provider, which stores the site and its databases within the EU.
- Our email provider, which delivers enquiry notifications.
- An AI model provider, which processes the text you type into FORMA AI in order to generate a reply. Your message is sent to that provider for the duration of the request.
We do not sell personal data, and we do not share it with advertisers. Where a processor is located outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses.
4. How long we keep it
- Enquiries: 24 months from your last contact with us, then deleted.
- Portal accounts: for as long as the account is active, and 24 months after it is closed.
- AI conversations: not stored on our servers beyond the length of the session, other than in ordinary server logs.
- Server logs: 12 months.
5. Your rights
Under GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to another provider. Where we rely on legitimate interest, you may object. Where you have given consent, you may withdraw it at any time without affecting what we did before.
Write to info@theforma.it and we will answer within one month. If you are not satisfied, you may complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority in your own country.
6. Cookies
Handled separately, in our Cookie Notice.
7. Changes
If we change this notice we will update the date at the top. Material changes affecting how we use data you have already given us will be notified by email where we hold your address.