Within the scope of healthcare activities, and in compliance with laws, guidelines and specific consents, personal data – including special categories of data (e.g. health data) – may be processed for:

• prevention, diagnosis, treatment and rehabilitation activities, including specialist consultations, diagnostic tests, therapies, outpatient and surgical services;
  
• administrative and operational management activities linked to booking, admission, reporting, certification, invoicing, payment handling and reporting;
  
• certification, reporting, prescription activities and maintenance of medical records;
  
• activities aimed at protecting the health of users, also in coordination with other healthcare professionals, in accordance with the law and the rights of the data subject;
  
• verification and assessment of the appropriateness of services provided, and, where necessary, debt recovery;
  
• improvement of the quality of services offered, including through satisfaction surveys (while respecting anonymity where possible);
  
• training and updating of healthcare and administrative staff, using aggregated or pseudonymised data where possible.

In such cases, the legal basis for processing is, depending on the context:

• performance of a contract to which the data subject is party or pre-contractual measures (Article 6(1)(b));
• compliance with legal obligations in the healthcare and administrative fields (Article 6(1)(c));
• reasons of substantial public interest in the field of healthcare, preventive medicine, diagnosis and care (Articles 9 and 10 GDPR and related national provisions).