Privacy Policy
Last updated: October 21, 2026
1. Data controller and contact
Jonathan Mezzela (VAT no. 13584710969), Via Monviso 55, 20089 Rozzano (MI), Italia.
Email: [email protected] – Phone +39 340 161 9836.
This policy covers the scan3dfeet.com website, the Scan3DFeet mobile app and the web dashboard for professionals (the “Service”).
2. Roles
- Website visitors, people who contact us and professionals with an account: the data controller is Jonathan Mezzela.
- Patient data and foot scans: the controller is the healthcare professional (physician, podiatrist or orthotist) who invites the patient to use the app. Jonathan Mezzela provides the technical tool and acts as data processor (Art. 28 GDPR), only on the professional's instructions. Patients can exercise their rights on health data through the professional; we assist with such requests.
3. Data we process
| Category | Data | From |
|---|---|---|
| Website browsing | IP address and technical connection data, aggregated visit statistics (cookie-free) | Visitors |
| Contact requests | Name, email and message content | People who write to us |
| Professional accounts | Email, login identifier, professional practice details, technical access logs | Professionals |
| Patients (via the app) | First and last name, email, tax code; 3D foot scans (images, point clouds, depth data) | Patients, on behalf of the professional |
Health data. Foot scans, used to design an insole, are treated as data concerning health (Art. 9 GDPR) and receive enhanced protection.
No facial recognition. The app uses the TrueDepth camera and LiDAR sensor only to scan feet. It performs no facial recognition or biometric identification. If parts of a face are captured by mistake, the data is treated as incidental imagery and is not analysed.
4. Purposes and legal bases
- Providing the Service (creating the account, capturing and sending scans to the professional): performance of a contract (Art. 6(1)(b)).
- Patient data: the legal basis is set by the professional as controller; normally healthcare purposes (Art. 9(2)(h) and Art. 6(1)(b) GDPR), or explicit consent (Art. 9(2)(a)) where the professional requires it.
- Answering requests by email or phone: pre-contractual steps or legitimate interest (Art. 6(1)(b) and (f)).
- Security and abuse prevention: legitimate interest (Art. 6(1)(f)).
- Legal obligations, including tax and accounting (Art. 6(1)(c)).
We do not use data for advertising, profiling or sale to third parties, and we do not take decisions based on automated processing.
5. Who receives the data
- The professional who invited you (via code or QR) and the staff they authorise.
- Manufacturing laboratories and partners chosen by the professional, who produce the insole.
- Technical providers, appointed as processors:
- Cloudflare, Inc. – hosting, processing and file storage (R2, EU region), database;
- Auth0 (Okta, Inc.) – authentication for professional accounts;
- Brevo (Sendinblue SAS, France) – service emails.
- Apple distributes the app through the App Store; it does not receive scans.
- Public authorities, where required by law.
We do not sell or share data with advertisers or data brokers.
6. Transfers outside the European Economic Area
Some providers (Cloudflare, Okta) are based in the United States. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the European Commission's Standard Contractual Clauses. Scan files are stored in the EU region.
7. Retention
- Login sessions: 15 minutes, then they expire and are deleted.
- Technical browsing data: only as long as strictly necessary for security and operation.
- Contact requests: as long as needed to reply and then for any legal obligations.
- Professional accounts: while the account is active and, after closure, for the period required by law for tax purposes and to protect our rights.
- Patient data and scans: for the period set by the professional as controller and needed to make and manage the insole; deleted at their request or the patient's request, unless the law requires retention.
8. Security
- Encrypted communications over HTTPS/TLS.
- Patient data is accessible only after authentication and only to authorised administrators.
- File uploads and downloads use short-lived signed links.
- Storage on Cloudflare infrastructure with encryption at rest applied by the provider.
No system is 100% secure: in case of a personal data breach we will take the measures and give the notifications required by Arts. 33 and 34 GDPR.
9. Your rights
You may at any time request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and object (Art. 21); you may withdraw consent where it is the legal basis. Write to [email protected]. We reply within one month.
You have the right to lodge a complaint with your supervisory authority; in Italy, the Garante per la protezione dei dati personali.
10. Children
The app is intended for adults. For minor patients, scanning and the relationship with the professional are handled by the person with parental responsibility.
11. Cookies
Information on browsing data is in the Cookie Policy.
12. Changes
We may update this policy. The new version will be published on this page with the update date; for material changes we will notify registered users.