Privacy policy

How we process the personal data of readers, authors, and reviewers

Introduction

This notice describes how the personal data of visitors to the lifesciencehub.info website (hereinafter “the Site”) and of those who collaborate in its editorial activities are processed. The Site is a science communication publication on nutrition, health, and prevention, available in Italian, English, Spanish, French, and German. Its content is for informational purposes only and does not replace the advice of a healthcare professional. The same Controller publishes the journal LIFE Science Hub – Journal of Science (lifesciencehub-journalofscience.com), which has its own information page.

Notice provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003.

Controller

The Controller is LIFE Science Hub, with registered office at Via Ronciglione 3, 00191 Rome (Italy), VAT No. IT18497041006.

For any privacy-related matter, you may write to [email protected].

Data Protection Officer (DPO): Roberto Panzironi, reachable at the same address [email protected].

Which data we process and why

Browsing data

During your visit, the systems hosting the Site record technical information necessary for operation and security: IP address, browser and device type, pages requested, date and time, and request outcome. The Site is hosted on DigitalOcean infrastructure in the Frankfurt data center (European Union) and protected by Cloudflare, which acts as a distribution network and filter against abusive automated access and sets the technical cookie __cf_bm, with a duration of 30 minutes.

Legal basis: the Controller’s legitimate interest in ensuring the operation and security of the service (Art. 6(1)(f) GDPR). Technical logs are retained only for the time strictly necessary, normally no longer than 30 days, except where needed to ascertain unlawful acts.

Usage statistics

To understand which content is read, we use Google Analytics 4 configured in cookie-free mode: no cookie or other persistent identifier is stored on the device, the IP address is anonymized, and Google Signals and ad personalization are disabled. Statistics are aggregated (page views, device type, approximate geographic area) and do not allow the person to be identified; for the same reason, each visit is counted as new.

Legal basis: the Controller’s legitimate interest in measuring Site usage (Art. 6(1)(f) GDPR). Google Ireland Ltd processes the data as processor; any transfers to Google LLC (USA) take place within the scope of the EU-U.S. Data Privacy Framework.

Internal search

The Site’s search function is semantic: the text you type is sent to the APIs of OpenAI to be transformed into a numerical representation used to compare articles. The search text is not linked to an account or to other identifying data and, under OpenAI API terms, is not used to train models. We invite you not to enter personal data, yours or others’, in the search field.

Legal basis: legitimate interest in providing the requested service (Art. 6(1)(f) GDPR).

Collaboration forms

The Site provides two forms, for scientific collaboration and commercial collaboration. The data entered (first and last name, email, organization or company name, address, role, content of the request, and statements made) are sent by email to the editorial office and are not stored in the Site database. Email delivery is provided by SMTP2GO. The data are used solely to assess and respond to the request. The form includes an invisible anti-spam field that does not collect data.

Legal basis: performance of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR). Retention: 24 months from receipt, unless the request leads to a collaboration.

Authors, co-authors, and reviewers

Those who collaborate on the Site’s content have a public profile containing first and last name, qualifications, professional biography, photograph, areas of expertise, affiliation, and, if provided, ORCID identifier. These data are processed to correctly attribute authorship of the content and ensure scientific transparency, in performance of the collaboration agreement (Art. 6(1)(b) GDPR) and for the legitimate interest in correct editorial attribution (Art. 6(1)(f)).

The authors’ names permanently accompany each article, including in the copy deposited with the Zenodo archive (CERN), which assigns a DOI and does not allow the deletion of published versions. The review workflow takes place through personal links sent by email; access to the editorial office’s restricted areas takes place with authentication via ORCID or Google. Email addresses and other contact details are not published.

Videos and third-party content

Some articles embed YouTube videos. The player is loaded only when you press the play button: until then, no data are transmitted to Google. Videos on the LIFE Science Hub channel are monetized: from the moment playback starts, Google may show advertisements, including personalized ones, set its own cookies, and process data in accordance with its notice; a notice to this effect is displayed next to the play button. The audio files of the articles, PDFs, and images are served from our systems and do not entail further processing.

What we do not do

The Site does not provide newsletters, reader registration, public comments, or the sale of products or services. There are no third-party advertising networks or social media pixels on the Site pages: the boxes marked “Sponsored” are served by the Site and do not track browsing; the only advertisements are those within YouTube videos, as noted in the previous paragraph. Links to our social profiles are simple links.

Artificial intelligence

In producing content, we use artificial intelligence tools (OpenAI) as editorial, documentary, and linguistic support: bibliographic research, drafting, translation, illustrative images. Every piece of content is checked and reviewed by people before publication, in accordance with our editorial policy. No personal data of readers is used to train models; the only data reaching AI systems is the text of internal searches, as described above.

Data recipients

ProviderRoleProcessingLocation and safeguards
DigitalOcean LLCProcessorHosting, database, file archive, and CDNFrankfurt data center (EU); U.S. company, standard contractual clauses
Cloudflare Inc.ProcessorDistribution network, security, technical cookieUSA, Data Privacy Framework
Google Ireland LtdProcessorCookie-free statistics; editorial authentication; on-demand videosEU; transfers to the USA under the DPF
OpenAIProcessorSemantic search; editorial supportIreland/USA, DPF and standard clauses
SMTP2GO LtdProcessorDelivery of form emailsNew Zealand (adequate country), EU servers
ORCID Inc.Independent controllerAuthentication and author identifierUSA
Zenodo / CERNIndependent controllerPermanent deposit of articles with DOISwitzerland (adequate country)

Data may also be disclosed to public authorities where required by law. They are not sold or transferred to third parties for commercial purposes.

Transfers outside the European Union

Some providers are based in the United States. Transfers take place to companies certified under the EU-U.S. Data Privacy Framework or on the basis of the standard contractual clauses approved by the European Commission (Art. 46 GDPR). New Zealand and Switzerland are countries recognized as adequate by the Commission.

Retention period

DataRetention
Technical browsing logsNormally up to 30 days
Aggregated statistics (Google Analytics 4)Aggregated and non-identifying data; no visitor identifier
Text of internal searchesNot retained by the Site
Requests from collaboration forms24 months, unless a relationship is established
Author and reviewer dataFor the duration of the collaboration; name and attribution remain on published articles and in DOI deposits

Security

The Site is served exclusively over HTTPS, applies a Content Security Policy that prevents the execution of unauthorized scripts, filters abusive automated access through Cloudflare, and limits restricted areas to personal links and authentication with external providers. Provider credentials are stored encrypted in the hosting infrastructure.

Your rights

You may request access to your data, rectification, erasure, restriction of processing, portability, and object at any time to processing based on legitimate interest (Arts. 15–22 GDPR). To exercise your rights, write to [email protected]: we will respond within one month.

If you believe the processing violates applicable law, you may lodge a complaint with the Data Protection Authority or with the authority in the country where you reside.

Minors

The Site is not intended for children under 14 and does not knowingly collect their data.

Updates

This notice may be updated in the event of changes to the Site or to applicable law. The version in force is always the one published on this page, with the date of the latest update.

Last updated: 4 September 2026.