Privacy and cookies

Privacy notice

1. Data controller

LybraGroup S.r.l. – Registered office: Viale Piero e Alberto Pirelli, 14 – 20126 Milan, Italy – VAT/Tax code 14439430969 – REA MI-2783980. Email: privacy@lybragroup.it – Certified email (PEC): lybragroup@pec.it.

2. Data we process

• Identification and contact data: name, surname, email, telephone, town, tax code, company name and VAT number, provided through the website forms or when registering for the client area.
• Contract and payment data: plan subscribed, duration, fees, instalments and payments; for members joining through their employer, company, job category, staff number, department and site.
• Health data (PRE.STO members only): outcome of the certification visit, appointments, diagnoses, treatments and risk score recorded by the dental clinic in the client area, as well as the information needed to handle any insurance claims.
• Browsing data: IP addresses and technical data logged by the systems that run the website, for security and troubleshooting.
• Application data: data contained in CVs sent for recruitment and in applications from dental clinics.

The risk test and the calculators on the website run entirely in your browser: your answers are neither sent nor stored.

3. Purposes and legal bases

• Replying to requests and pre-contractual steps (information requests, proposals for companies, clinic applications): Art. 6(1)(b) GDPR.
• Performance of the PRE.STO contract and management of the client area (account activation and management, clinic assignment, appointments, payments): Art. 6(1)(b) GDPR.
• Running the programme and quality control of care by the LybraGroup Medical Committee, which involves health data: the member’s explicit consent (Art. 9(2)(a) GDPR) and, for healthcare professionals bound by professional secrecy, Art. 9(2)(h) and 9(3) GDPR.
• Managing the agreement with the employer (corporate welfare): Art. 6(1)(b) and (f) GDPR. Only the administrative data needed are shared with the employer, never health data.
• Legal obligations (tax, accounting and administrative): Art. 6(1)(c) GDPR.
• Legitimate interest: security of the website and systems, prevention of abuse and fraud, legal defence: Art. 6(1)(f) GDPR.
• Direct marketing (newsletters and promotional messages), only with specific consent: Art. 6(1)(a) GDPR.
• Recruitment: Art. 6(1)(b) and/or (f) GDPR.

4. How data is processed and protected

Data is processed with IT and manual tools and with appropriate technical and organisational measures (Art. 32 GDPR): encrypted connections, access to the client area only with personal credentials after verification by our team, role-based permissions (support staff cannot see clinical data, LybraGroup doctors see only the clinics assigned to them, companies see only administrative data), an audit log of operations and backups.

5. Recipients and suppliers

• LybraGroup employees and collaborators authorised to process the data, trained and bound by confidentiality, each limited to the data needed for their role.
• The affiliated dental clinic treating the member, which is an independent controller of the clinical data processed for care.
• The employer that has signed an agreement, limited to the administrative data of the agreement.
• The partner insurance company, for dental damage cover and claims handling.
• Suppliers processing data on our behalf, appointed as data processors (Art. 28 GDPR): database and authentication for the client area (Supabase, servers in the European Union – Frankfurt), email service, payment services, tax, legal and employment advisers.
• Banks and financial institutions for collections, payments and any financing requested by the member; judicial or administrative authorities, where required by law.

Some suppliers belong to groups based outside the European Union: any data transfer takes place only with the safeguards required by the GDPR (adequacy decision, including the EU-US Data Privacy Framework, or standard contractual clauses). Data is not published or sold to third parties for marketing.

6. Retention

• Information requests not followed by a contract: up to 24 months from receipt.
• Accounts not approved: up to 12 months from registration.
• Contract data and health data recorded in the client area: for the duration of the contract and for 10 years after it ends, to protect the parties’ rights; tax and accounting records: 10 years.
• Marketing: until consent is withdrawn and in any case no longer than 24 months from collection.
• Applications: up to 12 months from receipt, unless you agree to longer retention.

7. Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent (Arts. 15-22 and 7 GDPR). Withdrawing consent to the processing of health data does not affect processing already carried out, but may prevent the programme from continuing. To exercise your rights, write to privacy@lybragroup.it or by registered letter to our registered office. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it).

Cookie policy

The website www.lybragroup.it does not use profiling or marketing cookies, nor third-party analytics tools. For this reason, in line with the Italian Data Protection Authority’s Guidelines of 10 June 2021, no consent banner is shown.

• Technical tools of the client area: when you log in to the client area, your browser keeps the session data needed to keep you signed in in local storage (localStorage, key “lybragroup-area-riservata”). This is essential to the service requested and is deleted when you log out.
• No third-party services: fonts, images and videos are hosted on our servers; there are no maps, embedded videos, social buttons or other content that send data to third parties while you browse.

Choices made in the interactive parts of the website (tabs, test and calculators) last only for your visit and are not stored. You can delete data stored by your browser at any time from its settings. If analytics or marketing tools are introduced in the future, this policy will be updated and your prior consent will be requested.

Last updated: October 2026.