DentalX Back to home

Italy Annex

ANX-IT · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: a8d8d5a489c6bd50755026e2476a5dba7d8afd76b4485c79271ef1e5735b99a0

Italy — ANX-IT: Italy Annex, with Specific Approval under Articles 1341 and 1342 of the Civil Code

Document ID: ANX-IT · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]] Language: English, with an Italian courtesy copy of this Annex [[TO CONFIRM: Italian translation of this Annex]]. The specific-approval text in Part B is in Italian, and the Italian text is the act of approval. Applies to: Clinics established in Italy, together with the MDPA and the EEA Transfer Module (TM-EEA). Terms defined in the MDPA have the same meaning here. Status: PREPARED, NOT YET OFFERED. Italy opens only when (1) Italian counsel has signed off this Annex and the method of approval in Part B, and (2) DentalX logs every read access to patient data (clause 3.2).

Part A — Data protection terms

1. Legal framework

This Annex supplements the MDPA with the provisions of the following:

  • the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, the "Code");
  • the measures of the Garante per la protezione dei dati personali; and
  • Law 132/2025 on artificial intelligence.

2. Authorised persons (Code, Art. 2-quaterdecies)

  • The Clinic's designations. The Clinic designates, in writing, the persons authorised to process personal data under its authority, and assigns them their tasks. In DentalX, it does this through the Users and roles it creates.
  • VstreamX's designations. VstreamX designates in writing the members of its personnel who may process the Clinic Data, and instructs them. It binds them to confidentiality (MDPA clause 5).

3. Health data and the patient file

3.1 Safeguards. VstreamX applies the measures in MDPA Schedule 2. They are consistent with the guarantee measures for health data that the Garante adopts under Article 2-septies of the Code. [[TO CONFIRM: whether the Garante's Art. 2-septies measures have been adopted, and their content]]

3.2 Logs and the dossier sanitario. Where the Clinic uses DentalX as a dossier sanitario (a record shared by several professionals of the same structure), the Garante's guidelines on the dossier sanitario require a log of accesses and operations, including consultations. DentalX provides a log of every access to patient data, including every read, with the User, the patient, the time and the action, which the Clinic can read and export (MDPA Schedule 2, C.12). That log is a condition for offering DentalX in Italy. For an Italian Clinic that already uses DentalX, VstreamX delivers it on this dated plan: [[TO CONFIRM: dated plan for read-access logging, and the log retention period checked against the guidelines]].

4. Artificial intelligence

4.1 Patient information. Under Article 7 of Law 132/2025, the patient has the right to be informed about the use of artificial-intelligence technologies in their care. DentalX provides the Clinic with:

  • an Italian patient-information template on the use of AI; and
  • labels on AI output.

4.2 Decisions stay with the professional. AI output is a support for the professional's decision, and the decision remains the professional's.

5. Retention

  • Default. DentalX's default for Italian Clinics keeps clinical records for 10 years, in line with the ordinary limitation period (Civil Code, Art. 2946).
  • No auto-deletion. DentalX does not auto-delete clinical records.

6. Electronic health file (FSE)

DentalX does not feed the Fascicolo Sanitario Elettronico. Where the law requires the Clinic to feed the FSE, the Clinic does so through the channels the law provides. [[TO CONFIRM: FSE feeding duties for private dental practices]]

7. Prescriptions

DentalX's prescriptions are not electronic prescriptions in the national system. They are clinical documents or private (bianca) prescriptions only.

Part B — Specific approval (Civil Code, Arts. 1341 and 1342)

The Terms of Service, the MDPA and its annexes are general contract conditions prepared by VstreamX. Some of their clauses are effective against the Clinic only if the Clinic specifically approves them in writing.

How the approval is given. The Service shows the Clinic the following text, in Italian, in a box separate from the acceptance of the agreements. Italian case law is divided on whether a click is a specific approval in writing. The Clinic's signatory therefore gives the approval with an advanced electronic signature (firma elettronica avanzata, Legislative Decree 82/2005 (CAD), art. 20(1-bis)): the signatory's identity is verified, and the signatory signs this text with a one-time code sent to a mobile number registered to them. The Clinic cannot create its account until the approval is signed. The signature, its time and the hash of the signed text are recorded separately from the acceptance of the agreements.

[[TO CONFIRM: Italian counsel's sign-off of this method (or a qualified signature), the identity-verification provider, and the FEA conditions VstreamX must publish. If VstreamX uses a plain checkbox instead, the clauses listed below must be treated as unenforceable against Italian Clinics and recorded in the risk register]]

Approvazione specifica ai sensi degli artt. 1341 e 1342 del Codice civile

Il sottoscritto, in nome e per conto di «Clinic legal name», dichiara di aver letto attentamente e di approvare specificamente, ai sensi e per gli effetti degli artt. 1341 e 1342 del Codice civile, le seguenti clausole:

Termini di servizio: art. 3 (modifica o rimozione di funzionalità); art. 11.5 (rinnovo automatico dell'abbonamento); art. 11.6 (modifica dei prezzi); art. 11.10 (non rimborsabilità dei corrispettivi); art. 12 (sospensione del servizio); art. 13.4 (cancellazione dei dati dopo la cessazione); art. 14 (assenza di impegni sui livelli di servizio); art. 17 (esclusione di garanzie); art. 18 (esclusioni e limitazioni di responsabilità); art. 19.1 (obblighi di manleva della clinica); art. 20 (risoluzione da parte di VstreamX); art. 21 (modifiche unilaterali dei Termini); art. 22 (divieto di cessione da parte della clinica); art. 23 (legge applicabile della Provincia di Manitoba e competenza esclusiva dei tribunali del Manitoba).

Accordo quadro sul trattamento dei dati (MDPA): clausola 7.4 (opposizione ai sub-responsabili limitata al recesso); clausola 12.2 (limiti agli audit); clausola 17 (responsabilità e rinvio alle limitazioni dei Termini); clausola 18 (modifiche dell'accordo e limitazione dell'accesso in caso di mancata accettazione); clausola 23 (legge applicabile e foro).

☐ Approvo specificamente le clausole sopra elencate e sottoscrivo la presente approvazione con firma elettronica avanzata.

[[TO CONFIRM: final list of clauses, checked against the published Terms and MDPA section numbers at publication]]

Items to confirm before publication (Italy)

  1. Publication date.
  2. The Italian translation of this Annex.
  3. Whether the Garante's Art. 2-septies measures have been adopted, and their content (A.3.1).
  4. The dated plan for read-access logging, which is a condition for opening Italy (A.3.2).
  5. FSE feeding duties for private dental practices (A.6).
  6. Italian counsel's sign-off of the advanced-electronic-signature method for art. 1341(2), and the identity-verification provider; Italy does not open before it (Part B).
  7. The final list of clauses, checked against the published section numbers (Part B).