This notice explains how personal data are processed when you use the MitImpact website, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. MitImpact has no user accounts and no registration.

Data controller

Fondazione Policlinico Universitario Agostino Gemelli IRCCS
Largo Francesco Vito, 1 - 00168 Rome, Italy
Data Protection Officer: dpo@policlinicogemelli.it (certified e-mail: dpo.gemelli@pec.it)

The website is run by the Computational Biology and Bioinformatics Laboratory of the Fondazione (computationalbiology@policlinicogemelli.it).

What we process, why, and for how long

• Server logs. Like any website, our server records each request: IP address, date and time, requested address (including what you typed in the search box), browser type and response code. Purpose: operating and securing the service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Logs are kept only as long as needed for security and troubleshooting and are then deleted.
• Files sent to the VCF annotator. The file is processed in memory only to produce the annotated file you download, then discarded. It is never written to disk, logged, or shared. Only chromosome, position and alleles are used; we recommend removing sample names and genotype columns before uploading. Legal basis: providing the service you request (Art. 6(1)(b) GDPR).
• Downloads. Downloading the database requires no registration and collects no data beyond the server log line above.
• Google Analytics (only with your consent). If you click Accept in the cookie banner, Google Analytics 4 sets cookies (_ga, _ga_<id>, up to 2 years) to count visits and pages viewed. Nothing loads if you click Reject or ignore the banner. Legal basis: consent (Art. 6(1)(a) GDPR; Art. 122 of the Privacy Code), which you can withdraw at any time via Cookie settings. Google acts on our behalf; data may be transferred to the United States under the EU-US Data Privacy Framework, to which Google LLC is certified.
• Your cookie choice is stored in your browser's local storage (mi-analytics). It is strictly necessary to remember your choice and needs no consent.
• Content delivery network. Page styles and scripts (Bootstrap, Chart.js, NGL) are served by the jsDelivr network, which receives your IP address in order to deliver them. Legal basis: legitimate interest in a fast, reliable website.

Data are processed by authorised staff of the Fondazione and by the providers named above acting on its behalf. They are not sold, and they are not used for automated decision-making or profiling.

Your rights

You may ask for access to, rectification or erasure of your data, restriction of or objection to their processing, and data portability (Articles 15-22 GDPR), and withdraw consent at any time without affecting earlier processing. Write to the Data Protection Officer at dpo@policlinicogemelli.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

Last updated: 17 October 2026.