innovabiohealth S.r.l., with registered office in Via Caleppe 6, 25125 Brescia, data controller (referred to as the "Owner" or "innovabiohealth"), pursuant to EU REGULATION 2016/679 of the European Parliament and of the Council of 27 April 2016, applicable from 25 May 2018 (hereinafter also simply Regulation) and the PRIVACY CODE (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 containing the provisions for the adaptation of national legislation to the aforementioned Regulation, as well as in based on the provisions of the General Provision of the Privacy Guarantor of 8 May 2014, it provides users with information relating to cookies or similar tools used by the website www.innovabiohealth.com and www.innovabiohealth.it (hereinafter also referred to as the "website web ").

What are cookies

A "cookie" is a small text file created on the user's computer when the user accesses a particular site, with the purpose of storing and transporting information. Cookies are sent from a web server (which is the computer on which the visited website is running) to the user's browser (Internet Explorer, Mozilla Firefox, Google Chrome, etc.) and stored on the latter's computer; they are then re-sent to the website at the time of subsequent visits. While browsing, the user may also receive cookies from different sites on his terminal (so-called "third-party" cookies), set directly by the managers of said websites and used for the purposes and in the manner defined by them.

Types of cookies used by this site

The website uses only technical cookies, with respect to which, pursuant to art. 122 of the privacy code and the Provision of the Guarantor of 8 May 2014, no consent is required from the user. More precisely, the site uses: Google Analytics for mere statistical purposes. This is a web analysis service provided by Google Inc. ("Google") which uses cookies that are stored on the user's terminal to allow statistical analysis in aggregate form regarding the use of the website visited. It should also be noted that in addition to cookies, a pixel tag is also used by Google (http://www.google.it/intl/it/policies/privacy/key-terms/). The data generated

by Google Analytics are stored by Google as indicated in the information available here:

https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

It is possible to consult the privacy policy of Google Inc. at the following link: http://www.google.com/intl/en/analytics/privacyoverview.html

As expressly indicated by the Privacy Guarantor with the "Clarifications regarding the implementation of the legislation on cookies" of 5 June 2015, the sites that use, for mere statistical purposes, analytical cookies created and made available by third parties are not subject to the obligations and fulfilments provided for by the legislation (notification to the Guarantor in primis) if suitable tools are adopted to reduce the identification power of

analytical cookies that they use (for example, by masking significant portions of the IP address) and provided that the use of these cookies is subject to contractual obligations between sites and third parties, in which express reference is made to the commitment of the third party or to use them exclusively for the provision of the service, to keep them separately and not to “enrich” them or not to “cross” them with other information they have at their disposal. innovagenome has decided to make use of the user IP anonymization function provided by Google (and described at the following link: https://support.google.com/analytics/answer/2763052?hl=it) and accepted the Amendment on '' data processing (Google Analytics Data Processing Amendment) made available by Google Analytics in compliance with Directive 95/46 / EC, with which Google undertakes to process the data according to the requests of the Customer - Owner of the site and not to share them with others additional services if it is not the Customer himself who requests them, through the service settings. On this point, the user is informed that the owner of this site has not connected Google Analytics to any additional service and that no advertising or data sharing options with Google have been activated. In light of the measures adopted, the Google Analytics service, used by this site for mere statistical purposes, is activated upon landing, requiring no consent from the user for the release of the related cookies.

Disabling cookies

The user can disable Google Analytics using the appropriate browser add-on which can be downloaded through the following link: https://tools.google.com/dlpage/gaoptout Without prejudice to the foregoing regarding the deactivation of Google Analytics, please note that the user can delete cookies directly through and your browser. Each browser has different procedures for managing settings. The user can obtain specific instructions through the links below. Microsoft Windows Explorer Google Chrome Mozilla Firefox Apple Safari For information on the cookies stored on your terminal and to disable them individually, please refer to the following links:

http://www.youronlinechoices.com/it/le-tue-scelte

http://www.allaboutcookies.org/mobile/index.html

Further information

Further information regarding the processing of personal data of users who browse the website can be found in the privacy policy and in the specific information relating to certain services offered.

The rights of the interested party

The law recognizes the right of the data subject to ask the data controller to access personal data and to correct or cancel them or limit their processing or to oppose their processing, in addition to the right to data portability. .

More precisely, the interested party has:

• The right of access, ie the right to obtain from the data controller confirmation that personal data concerning him or her is being processed and in this case, to obtain access to personal data and the following information: a ) the purposes of the processing; b) the categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients of third countries or international organizations; d) when possible, the retention period of the personal data envisaged or, if not possible, the criteria used to determine this period; e) the existence of the right of the interested party to ask the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their treatment; f) the right to lodge a complaint with a supervisory authority; g) if the data are not collected from the data subject, all available information on their origin; h) the existence of an automated decision-making process, including profiling and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the data subject.

If personal data are transferred to a third country or to an international organization, the interested party then has the right to be informed of the existence of adequate guarantees relating to the transfer.

• The right of rectification, ie the right to obtain from the data controller the rectification of inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration.

• The right to cancellation, ie the right to obtain from the data controller the cancellation of personal data concerning him without undue delay if: a) the personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed; b) the interested party revokes the consent on which the processing is based and if there is no other legal basis for the processing; c) the interested party opposes the processing carried out because it is necessary for the execution of a task in the public interest or connected to the exercise of public authority vested in the owner or for the pursuit of legitimate interest and there is no legitimate overriding reason to proceed with the processing, or oppose the processing for direct marketing purposes; d) the personal data have been unlawfully processed; e) personal data must be deleted to fulfill a legal obligation under the law of the Union or of the Member State to which the data controller is subject; f) the personal data have been collected in relation to the offer of information society services to minors. However, the request for cancellation cannot be accepted if the processing is necessary: ​​a) for the exercise of the right to freedom of expression and information; b) for the fulfillment of a legal obligation that requires the treatment provided for by the law of the Union or of the Member State to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of public

powers vested in the data controller; c) for reasons of public interest in the public health sector; d) for archiving purposes in the public interest, for scientific or historical research or for statistical purposes, insofar as the cancellation risks making it impossible or seriously jeopardizing the achievement of the objectives of such processing; or e) for the assessment, exercise or defense of a right in court.

• The right of limitation, ie the right to obtain that the data are processed, except for storage, only with the consent of the interested party or for the ascertainment, exercise or defense of a right in court or for protect the rights of another natural or legal person or for reasons of significant public interest of the Union or of a Member State if:

a) the data subject disputes the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data; b) the processing is unlawful and the interested party opposes the deletion of personal data and instead requests that its use be limited; c) although the data controller no longer needs it for the purposes of

processing, the personal data are necessary for the interested party to ascertain, exercise or defend a right in court; d) the interested party objected to the processing carried out because it is necessary for the execution of a task of public interest or connected to the exercise of public authority vested in the holder or for the pursuit of the legitimate interest of the data controller or third parties, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.

• The right to portability, ie the right to receive in a structured format, commonly used and readable by an automatic device, the personal data concerning him provided to the holder and has the right to transmit such data to another holder without impediments by the holder to whom he provided them, as well as the right to obtain the direct transmission of personal data from one holder to another, if technically feasible, if the processing is based on consent or on a contract and the processing is carried out by automated means. This right does not affect the right to cancellation.

the right of opposition, i.e. the right of the interested party to oppose at any time, for reasons connected to his particular situation, to the processing of personal data concerning him carried out because it is necessary for the execution of a task of public interest or connected to exercise of public authority vested in the owner or for the pursuit of the legitimate interest of the data controller or third parties.

If personal data are processed for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him for these purposes, including profiling to the extent that it is connected to such direct marketing.

The interested party may assert your rights at any time, without formalities, by contacting the data controller, through the e-mail address

info@innovagenome.com

The interested party is then informed that the law recognizes the possibility of asserting his rights with an appeal to the Privacy Guarantor or before the judicial authority.

The Data Controller is innovabiohealth S.r.l, with registered office in Via Caleppe 6, 25125 Brescia

Last update: 04/03/2021