EL SPA uses artificial intelligence systems in limited functions of the portal. This notice explains in clear terms where AI is used, what data it processes and what controls are applied.
1. Public AI Assistant
The website provides an AI Assistant that is clearly identified as such. The assistant answers questions about EL SPA treatments and may suggest options based on the occasion, available time, preferences and budget indicated by the user. Responses are generated using the website’s actual catalogue as a reference.
- does not make diagnoses;
- does not provide medical advice;
- does not request health data;
- does not access the customer profile or purchase history;
- does not decide whether the user may purchase or access a treatment;
- does not apply personalised prices;
- does not make decisions producing legal or similarly significant effects.
2. Health data
The assistant includes technical filters at two levels. If the browser detects possible health data, the original text is neither stored nor transmitted and is replaced with a placeholder. If health data were nevertheless to reach the server, a second safeguard prevents transmission to the AI model and storage of the original content.
3. Providers and retention
Requests are routed through Lovable AI Gateway to an OpenAI model. The code sets store:false to prevent application-level storage of the response. Providers may nevertheless maintain technical or security logs under their respective agreements and policies; EL SPA does not treat store:false as a guarantee of absolute “zero retention”.
Conversations stored in the EL SPA backend have a maximum retention period of 90 days. In the browser, persistence for up to 90 days occurs only with consent to the functional category; without such consent the conversation is limited to the session.
4. Internal AI for commercial support
Only where the customer has given consent to commercial profiling may authorised staff use an internal AI function to receive operational suggestions based on purchase data. Consent is checked before the AI call. The payload is minimised and does not include name, e-mail or telephone number, but only strictly necessary commercial indicators such as number of purchases, average spend, frequency, categories and items purchased.
The output of the internal AI is not executed automatically: it is a support tool for staff. Any coupon, communication or proposal requires human action and must comply with the applicable consents.
5. Visual content reworked with AI
Some video content on the main Treatments page is derived from real photographs of EL SPA that were subsequently animated or reworked using artificial intelligence tools for graphic and illustrative purposes. Such content is labelled “Visual content reworked with AI”. It is not a testimonial, does not represent clinical results and is not before/after content.
6. Oversight and quality
- grounding of the AI Assistant on the actual catalogue;
- explicit limits against inventing prices, opening hours and availability;
- prohibition on health-related questions and advice;
- limits on message frequency and length;
- access to conversations only by authorised roles and in pseudonymous form;
- human review of internal commercial functions;
- AI literacy/training for staff who use or manage AI systems.
7. Rights and contact details
To obtain information about data processing, withdraw profiling consent or exercise GDPR rights, users may use the controls provided on the website or write to mail@elspa.it.
Legal and documentary references
- Regulation (EU) 2016/679 - GDPR: https://eur-lex.europa.eu/eli/reg/2016/679/oj/?locale=it
- Italian Privacy Code - Legislative Decree No. 196/2003, Article 122: https://www.normattiva.it/
- Italian Data Protection Authority - Guidelines on cookies and other tracking tools, 10 June 2021: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876
- Italian Data Protection Authority - list of processing operations subject to a DPIA, 11 October 2018: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9058979
- Regulation (EU) 2024/1689 - AI Act, consolidated text 2026: https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/ita
- European Commission - AI literacy, Q&A: https://digital-strategy.ec.europa.eu/it/faqs/ai-literacy-questions-answers