Kiddocare

GDPR overview

The publisher is established in Italy, so the GDPR applies directly and no article 27 representative is needed or named. The privacy notices are drafted under articles 13 and 14 and state their legal bases explicitly: article 6(1)(b) for running the service, 6(1)(f) for the newsletter, and 9(2)(a) for health data. A Data Protection Officer is designated and reachable by post at the company's Milan address. Kiddocare also publishes a separate notice under article 50 of Regulation (EU) 2024/1689, the AI Act, covering its chatbot. No transfers outside the EU are foreseen. One practical caveat: the DPO email address printed in the notice, dpo@ai-heatlh.it, contains a typo in the domain, which does not resolve and cannot receive mail.

Who owns the data?

AIHEALTH S.r.l., which owns Kiddocare, acts as data controller for the personal data it processes on its own account: registration details, contact and banking data, technical logs, and any images or voice files a parent uploads. For the health data the pediatrician handles through the platform, the roles reverse: the pediatrician is the controller and AIHEALTH is only a processor, formally appointed under article 28 GDPR, with a separate privacy notice issued by the doctor. Users remain solely responsible for the content they upload. Data subjects may exercise access, rectification, erasure, restriction, objection and portability rights, and can obtain their data in a structured, machine-readable format.

Reuse rights

Parents keep control of what they put into Kiddocare. Content uploaded to the app remains the user's responsibility, and AIHEALTH gives no warranty as to its accuracy. Documents stored in the Storico archive can be requested back in CSV format, and the portability right lets a user obtain their data in a structured, machine-readable form. On the publisher's side, the core processing rests on performance of the contract, so no consent is asked for it; newsletter and commercial messages rest on legitimate interest, with an unsubscribe link in every email that takes effect immediately. Health data exchanged through the Parla con il Pediatra feature requires explicit consent under article 9(2)(a). Image and voice files are optional and can be withdrawn at any time. Processing by AI systems, including the use of anonymised data for scientific and statistical research, happens only with prior consent that can be revoked. On the pediatrician side, profiling and any transfer of data to third parties each require their own separate, express consent, and refusing either still leaves the platform usable.

Data retention & training

Hosting summary

Kiddocare names its host explicitly: Amazon Web Services EMEA SARL, registered at 38 Avenue John F. Kennedy, L-1855 Luxembourg, acting as host provider. Data is stored on AWS infrastructure inside the European Union, in the eu-central-1 region in Frankfurt, Germany, and the documentation states that no transfers to third countries or international organisations are foreseen. That declaration is consistent with what the infrastructure shows, since the pediatrician portal resolves to an AWS load balancer in the same Frankfurt region. Other third parties named across the documents include Stripe for payments, Agora for video calls, Keycloak for identity management and a cloud GitHub instance for version control. The complete list of processors is not published: the privacy notice undertakes to supply it on request to the Data Protection Officer. No security certification, such as ISO 27001 or SOC 2, is claimed anywhere on the site.