PRIVACY POLICY

Last updated: 30 October 2026

Diadem S.p.A. (“Diadem”, “we”, “us” or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we process the personal data of users of our website https://diademdx.com/ (the “Website”) and of persons who contact us through the contact details published on the Website, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and the applicable Italian data protection legislation (Legislative Decree no. 196/2003, as amended, the “Privacy Code”).

To make this Privacy Policy clearer, the key terms used are defined below:

  • Personal data: any information relating to an identified or identifiable natural person, including indirectly by reference to an identification number or an online identifier;
  • Processing: any operation or set of operations performed on personal data, whether or not by automated means (e.g. collection, recording, storage, consultation, use, disclosure);
  • Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (in this case, Diadem);
  • Processor: the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
  • Data subject: the natural person to whom the personal data relate.

1. DATA CONTROLLER

The controller is Diadem S.p.A., tax code/VAT no. 03446230983, with registered office at Via Ceresio 7, 20154 Milan (MI), Italy. You can contact us for any matter relating to the processing of your personal data at privacy@diademdx.com or by certified e-mail (PEC) at diadem.srl@legalmail.it.

2. PERSONAL DATA WE COLLECT

2.1 Information you provide to us

The Website does not currently contain registration areas, contact forms or newsletter subscription forms. If you contact us using the e-mail addresses or other contact details published on the Website, we will process your first name and surname, e-mail address, telephone number, organisation and role (e.g. if you are a clinician, researcher, investor, journalist or potential business partner) and any other information you choose to include in your message.

The Website is not intended for patients and does not provide test results, medical advice or diagnostic services. Please do not send us information about your health or that of other persons. If you nevertheless do so, we will process such information only to the extent strictly necessary to respond to you (for example, by directing you to the appropriate healthcare professional) and will then delete it.

2.2 Navigation data

The IT systems and software used to operate the Website automatically acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols, such as:

  • technical information, including the IP address or domain name used to connect to the Website, the type and version of browser, time-zone settings, browser plug-in types and versions, the operating system and platform used;
  • information about your visit, including the full URL, clickstream data, date and time of the visit, the resources requested, the size of the file obtained in response, the status of the response given by the server (success, error, etc.) and the method used to leave the page.

Navigation data are not collected in order to identify users; however, by their very nature, they could allow users to be identified, also through association with data held by third parties.

2.3 Cookies

The Website uses cookies and similar technologies. For detailed information on the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

3. PURPOSES, LEGAL BASES AND RETENTION PERIODS

We process your personal data for the following purposes, on the basis of the legal bases and for the retention periods indicated below:

Purpose

Legal basis

Retention period

Responding to requests and communications you send us by e-mail, telephone or otherwise

Performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) or our legitimate interest in responding to communications we receive (Art. 6(1)(f) GDPR)

For the time necessary to handle the request and, where no contractual relationship follows, for 24 months from the last contact

Operating and administering the Website, including checking its correct functioning and resolving technical problems

Legitimate interest in providing a functioning website (Art. 6(1)(f) GDPR)

Navigation data: 30 days from collection, unless needed for the purposes below

Ensuring the security of the Website and establishing liability in the event of computer crimes against the Website

Legitimate interest in protecting our systems (Art. 6(1)(f) GDPR)

30 days, or for the longer period necessary in the event of an incident or of a request from the authorities

Collecting statistical information on the use of the Website through analytics cookies

Your consent (Art. 6(1)(a) GDPR and Art. 122 Privacy Code), given through the cookie banner

See the Cookie Policy

Complying with legal obligations and establishing, exercising or defending legal claims

Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR)

For the period required by law or until the claim is finally settled

 

Where the processing is based on our legitimate interest, you may obtain information on the balancing test carried out by contacting us at privacy@diademdx.com.

4. PROVISION OF DATA

You are free to decide whether to provide your personal data. However, the processing of navigation data is necessary for the technical operation of the Website, and any refusal to provide the data necessary to handle your request will make it impossible for us to respond to it. Refusing analytics cookies has no consequence on your ability to browse the Website.

5. METHODS OF PROCESSING

Personal data are processed by automated and manual means, using tools designed to guarantee their security and confidentiality, by persons authorised to process personal data and bound by confidentiality obligations. We do not carry out automated decision-making, including profiling, through the Website.

6. RECIPIENTS OF YOUR DATA

Your personal data may be shared, to the extent necessary for the purposes described above, with:

  • service providers that support us in operating the Website and our IT systems (e.g. website hosting and maintenance provider, our IT service provider, providers of e-mail and cloud services such as Microsoft), acting as processors on our behalf;
  • providers of analytics services (e.g. Google Ireland Limited/Google LLC), where you have consented to analytics cookies;
  • companies of the Diadem group, including Diadem US, Inc., where your request concerns their activities;
  • professional advisers (e.g. law firms, accountants and auditors), acting as independent controllers or as processors;
  • public authorities and judicial authorities, where required by law or to establish, exercise or defend legal claims.

Your personal data will not be disseminated. We do not sell your personal data. We may share aggregated or anonymous information with third parties for statistical and research purposes.

7. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some of our service providers (e.g. Microsoft) and our subsidiary Diadem US, Inc. may process your data in the United States or the United Kingdom. In these cases your data remain protected as required by the GDPR: the United Kingdom, and US companies certified under the EU-U.S. Data Privacy Framework, are covered by an adequacy decision of the European Commission; in all other cases we sign the standard contractual clauses approved by the European Commission. For more information, contact us at privacy@diademdx.com.

8. YOUR RIGHTS

In accordance with Articles 15-22 GDPR, you have the following rights:

  • Access: to obtain confirmation as to whether your personal data are being processed and a copy of such data;
  • Rectification: to have inaccurate or incomplete personal data corrected or completed;
  • Erasure: to obtain the erasure of your personal data, to the extent permitted by Article 17 GDPR;
  • Restriction: to obtain the restriction of processing, to the extent permitted by Article 18 GDPR;
  • Objection: to object, on grounds relating to your particular situation, to processing based on our legitimate interest, and to object at any time to processing for direct marketing purposes;
  • Withdrawal of consent: to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (for cookies, through the “Cookie settings” link on the Website);
  • Data portability: where the processing is based on consent or on a contract and is carried out by automated means, to receive the personal data you have provided in a structured, commonly used and machine-readable format or to have them transmitted to another controller.

You can exercise your rights by writing to privacy@diademdx.com. To allow us to handle your request, please provide your name and contact details; we may ask for further information if we have reasonable doubts as to your identity. We will reply without undue delay and in any event within one month of receipt of the request, which may be extended by two further months where necessary.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it) or with the supervisory authority of the EU Member State in which you habitually reside or work, or in which the alleged infringement took place.

9. MINORS

The Website is not directed at persons under 16 years of age, and we do not knowingly collect personal data from them.

10. LINKS TO SOCIAL NETWORKS AND THIRD-PARTY WEBSITES

The Website contains links to third-party websites and social networks (e.g. LinkedIn) and to articles published by third parties. Such links do not involve the installation of social network plug-ins on the Website: when you click on them, you leave the Website and the processing of your data is governed by the privacy policies of the relevant third parties, which we invite you to read. This Privacy Policy does not apply to third-party websites that can be accessed through links on the Website.

Where a page of the Website contains social network plug-ins or embedded content, your browser connects directly to the servers of the relevant provider, which may collect data on your visit even if you do not interact with the plug-in. Such plug-ins are activated only after you have given your consent through the cookie banner.

11. CHANGES TO THIS PRIVACY POLICY

We may update or amend this Privacy Policy at any time, in particular in the event of legislative changes or changes to the Website. The date of the latest update is indicated at the top of this Privacy Policy. Where changes are significant, we will inform you through a notice on the Website.