Last updated: 24 October 2026. This notice describes personal data processing and the technologies used by this blog.
Controller and contact
The controller is Elio Catapano, who runs the personal blog brugadasyndro.me. For privacy enquiries and requests, email elio.catapano@gmail.com.
The blog does not sell products or services or carry paid advertising or affiliate links on behalf of its owner. As explained in the Disclaimer, the author is not a doctor and the content is informational. This notice concerns visitors’ personal data and supplements the original Disclaimer, which remains available.
Data and purposes
Browsing and security
Browsing involves technical data such as IP address, time, requested resource, browser and server response. WordPress, Hostinger and security tools use these data to deliver pages, diagnose errors and prevent abuse. The legal basis is the controller’s legitimate interest in operating and protecting the website, taking visitors’ rights into account. Caching improves page delivery. You do not need to subscribe to read the blog.
Contact forms and email
WPForms Lite forms collect your name, email and message; the Italian form also requests a surname. These data are used to deal with your enquiry, based on the legitimate interest in responding to correspondence you choose to send. Required fields are necessary to submit the form, but not to read the site. Since 23 October 2026, the forms are configured to forward messages to the controller’s iCloud Mail mailbox, provided by Apple. Form delivery is temporarily under maintenance: the website’s success message does not guarantee receipt. For privacy requests, email the address in this notice directly. Earlier correspondence may remain in Gmail; changing the recipient does not transfer or delete those copies. WPForms Lite Connect is disabled: submissions are not stored as WPForms entries in the website database or in Lite Connect. Email copies and technical logs may remain. Sending a message does not subscribe you to the newsletter.
Do not send medical records, genetic data, identifiable diagnoses or other people’s personal data. The blog does not provide clinical assistance and is not an emergency channel. Submitting a form is not explicit consent to process health data. Unnecessary health information received is removed when identified.
Comments
Comments involve the text, name or pseudonym, email, optional website and technical information including IP address and browser. Approved comments and the supplied name are public; the email is not displayed. Discussion management, moderation and spam prevention rely on the controller’s legitimate interest. Do not include identifiable health information in public comments.
Akismet checks comments for spam using comment and technical data. Its privacy link appears in the comment form. Posting a comment does not automatically subscribe you to updates.
Email updates
Jetpack subscription is optional and based on consent. It provides new posts or other updates you request. The service uses your email and technical data needed for subscription management and abuse prevention. Follow the confirmation email’s instructions. Withdraw consent using the unsubscribe link in messages or by contacting the controller. Withdrawal does not affect the lawfulness of earlier processing.
Jetpack documentation also describes email open and click statistics associated with subscribers, together with country, device and email-client information. These functions are separate from website browsing statistics: disabling Jetpack Stats on this site does not guarantee their absence from emails. Automattic’s notice describes the service’s processing. Replies to newsletter emails may become public comments on the related post: do not use them for confidential communications or health information.
The follow.it forms have been removed. Previous subscriptions have not been deleted or transferred. If you still receive messages through that service, use its unsubscribe link or contact the controller for help. The follow.it privacy notice also applies and describes the provider’s own processing, including advertising activities.
Statistics, search and external links
Jetpack Stats is disabled; historical statistics have not been deleted. The blog does not use internal searches for personalised advertising. Search words may appear in URLs and technical logs, so do not include personal health information. Links to PubMed, social networks and other sources lead to independently operated websites with their own notices. A plain sharing link is used when you open it.
Providers and access
Data are accessible to the controller and providers needed for the functions described: Hostinger for hosting, security and backups; Automattic for Jetpack and Akismet; Apple for iCloud Mail and Google for privacy requests and earlier correspondence retained in Gmail. WordPress, Polylang and WPForms are also software components: installation alone does not mean that all data are sent to their developers. Authorities may receive data where required by law. The controller does not sell personal data.
Services may involve infrastructure outside the European Economic Area. Providers’ notices and terms describe recipients and transfer mechanisms. Contact the controller for information and copies of applicable safeguards. Hosting the primary server in Europe does not mean every provider’s processing takes place in Europe.
- Hostinger data processing addendum and privacy policy.
- Automattic visitor privacy notice and Jetpack features.
- Apple privacy policy for iCloud Mail.
- Google privacy policy for privacy requests and earlier correspondence in Gmail.
Apple identifies Apple Distribution International Limited in Ireland as controller for people in the European Economic Area and describes standard contractual clauses for international transfers. Jetpack and Akismet also describe safeguards based on standard contractual clauses. Contact the controller for the safeguards applicable to a specific request.
Retention
The controller reviews email manually every three months and deletes ordinary enquiries within 12 months of the last exchange, except for open matters or documented needs. Privacy requests are handled separately, keeping only necessary evidence of their handling. This is a manual procedure, not automatic mailbox deletion.
Published comments and their metadata remain associated with the discussion while the content is maintained, subject to deletion requests assessed under applicable law. Pending comments remain until the controller reviews them. Akismet is configured to delete spam older than 15 days automatically. Subscriptions remain active until cancellation, subject to minimum information needed to document the request and prevent unwanted messages.
Technical logs and backups follow the service’s cycles and documented security and recovery needs. Access to backups is restricted. Deletion from the active website may remain in backups until rotation.
According to Hostinger documentation checked on 23 October 2026, automatic weekly backups are kept for six weeks. This period does not apply to manual copies or migration archives. The controller keeps those copies during refactoring and for 90 days after final acceptance testing, then reviews them and manually deletes superseded copies only after verifying a recent recoverable backup. There is no automatic deletion.
The published Hostinger DPA supplements the terms of covered services, including hosting, and describes Hostinger as a processor for customer data processed on the customer’s behalf.
On 23 October 2026, Hostinger support confirmed that access logs are retained on its servers for up to 7 days and then automatically deleted, unless legal requirements or an active security investigation require longer retention. The hPanel viewing window covers the same period. In its final reply, support distinguishes LiteSpeed service error logs, including LSAPI/PHP process messages, which rotate on the server within a few days, from account PHP error files. If logging is enabled, the latter remain in the .logs folder, may be included in backups and have no automatic deletion period communicated by the provider. The firewall inspects headers and POST data in memory to block attacks, without retaining request contents as part of that inspection. Selected security events may be forwarded to internal monitoring. Hostinger does not disclose detailed retention periods for those internal security records for security reasons; the 7-day period is not extended to those records.
Your rights
Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests and withdraw consent. Email elio.catapano@gmail.com with your request and the information needed to identify it. Proportionate information may be requested to verify identity. The ordinary response period is one month; any extension allowed by law must be explained and communicated. You may complain to the Italian data protection authority or another competent authority. The controller does not make solely automated decisions with legal or similarly significant effects on readers.
Cookies and similar technologies
Technical cookies support requested functions, language and security. Non-essential technologies require the appropriate choice before activation. You can manage and delete cookies in your browser, which may remove saved preferences. Newsletter consent is separate from cookie choices.
The current browsing configuration uses technical functions, without active advertising tools or browsing analytics. Accordingly, no general consent banner is shown. Optional choices in forms remain separate. If non-essential technologies are introduced, the relevant information and consent controls will be provided before activation.
Cookies and browser storage
Language cookies apply to the brugadasyndro.me domain. Other entries activate only with the functions described. Durations are the defaults in the installed configuration and code; deleting browser data can shorten them.
| Name/function | Trigger and purpose | Default duration |
|---|---|---|
| pll_language | Polylang language preference, when set by the application response. | One year; path /, Secure and SameSite=Lax. |
| comment_author_*, comment_author_email_*, comment_author_url_* | WordPress remembers comment details only when the optional form choice is selected. | One year, subject to application filters. |
| jetpack_comments_subscribe_*, jetpack_blog_subscribe_* | Jetpack remembers the blog/comment subscription choice submitted with a comment. | One year in the current code; not set by merely loading the page. |
| wpEmojiSettingsSupports | WordPress session storage: remembers the result of the browser emoji-support check. | Tab session; sessionStorage, not a cookie. |
| wordpress_[hash], wordpress_sec_[hash], wordpress_logged_in_[hash] | Administrator login, separate from ordinary reading. | Without Remember Me: session cookie, with a default authentication lifetime of 2 days. With Remember Me: 14-day authentication; the cookie can include an additional 12-hour technical grace period. |
WPForms Analytics and its _wpfuuid identifier are disabled. Anonymous checks on 23–24 October 2026 of sample Italian and English pages found the language cookie and technical emoji storage, with no iubenda requests or external resources in the final page loads examined. Subscription and comment functions send data to the services described when used.