Privacy and cookie policy

Last updated: November 1, 2026

This policy explains how personal data is processed when you visit eleaflet.eu or contact us through the site, in accordance with Regulation (EU) 2016/679 (GDPR) and Italian data protection law.

1. Data controller

The data controller is myHealthbox, Via Spadolini 11/B, 20141 Milano, Italy, VAT IT09255870967.
For any question about this policy or your personal data, write to info@myhealthbox.eu.

2. Data we process

Contact form: your name, company (optional), email address and the text of your message.
Technical data: your IP address, which is recorded in our web server and security logs and included in the email that forwards your contact request to our team, together with browser and device information sent automatically by your browser.
Analytics data, only if you accept analytics cookies: information about your visit collected by Google Analytics (pages viewed, approximate location, device and browser type).

Providing your contact details is voluntary, but without them we cannot answer your request.

3. Purposes and legal bases

Answering your requests and any related pre-contractual exchange: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in replying to the people who contact us).
Security of the site and prevention of spam and abuse, including Google reCAPTCHA on the contact form and server logs: Art. 6(1)(f) GDPR (our legitimate interest in protecting the site and our systems).
Audience measurement with Google Analytics: Art. 6(1)(a) GDPR, only with your consent, which you can withdraw at any time.

We use your details only to answer your request. We do not use them for marketing, we do not sell them and we do not make automated decisions about you.

4. Cookies

We use the following cookies and similar technologies:

Name	Provider	Purpose	Type	Duration
`el_consent`	eleaflet.eu	Remembers whether you accepted or rejected analytics cookies.	Technical, no consent needed	180 days
`_ga`, `_ga_*`	Google Analytics	Distinguish visitors and sessions to produce aggregated visit statistics.	Analytics, only with your consent	Up to 2 years
`_GRECAPTCHA` and related reCAPTCHA data	Google reCAPTCHA	Tell people and automated programs apart to protect the contact form from spam. Loaded only when you start using the contact form.	Technical (security), no consent needed	Up to 6 months

Analytics cookies are set only if you click “Accept” in the cookie banner. If you click “Reject”, or make no choice, no Google Analytics cookies are set: the Google tag still loads with Google consent mode set to “denied”, in which case Google receives only cookieless signals that are not linked to a cookie identifier.

You can change or withdraw your choice at any time from Cookie settings, a link also available at the bottom of every page. You can also delete cookies from your browser settings.

5. Recipients

Your data is processed by our authorised staff and by the following recipients:

our hosting and email service providers, acting as data processors on our behalf under Art. 28 GDPR;
Google (Google Ireland Limited and Google LLC), for Google Analytics (only with your consent) and Google reCAPTCHA. See the Google Privacy Policy.

We do not disclose your data to other third parties unless required by law.

6. Transfers outside the European Economic Area

Using Google services may involve transferring data to the United States. These transfers rely on the EU-US Data Privacy Framework, under the European Commission adequacy decision of 10 July 2023, and, where applicable, on the Standard Contractual Clauses approved by the European Commission.

7. Retention

Contact requests and related correspondence: 24 months after our last contact with you.
Server and security logs: 12 months.
Google Analytics data: 14 months.

After these periods the data is deleted or made anonymous, unless we must keep it longer to comply with a legal obligation or to establish, exercise or defend legal claims.

8. Your rights

Under Articles 15 to 22 GDPR you have the right to access your personal data, to have it rectified or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, write to info@myhealthbox.eu. We reply within one month of receiving your request; this period may be extended by two further months for complex or numerous requests, in which case we will tell you within the first month.

9. Complaints

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

10. Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it was last changed.