Instructions for Use

Medicilio RPM

Remote Patient Monitoring software — Patient Manual

Symbol	Particular	Value
Manufacturer	Manufacturer	Cantieri Digitali Medtech S.r.l., Corso di Porta Romana 6, 20122 Milano (IT), VAT/P.IVA IT11328810962
Caution	Consult the Instructions for Use	This document
UDI	UDI-DI	[UDI-DI placeholder to be assigned before placing on market]
MD	Device category	Medical Device: Class IIa software (MDSW)
REF	Trade name	Medicilio RPM
Version	Software version	1.0.0
CE	CE mark	[CE-NUMBER placeholder] · Notified Body: [NB-NUMBER placeholder]
Date	Date of issue	2026-09-07
eIFU	Electronic IFU	Available at https://ifu.medicilio.it per Regulation (EU) 2021/2226

EU MDR 2017/745 · Class IIa Medical Device Software (MDSW)
Software version 1.0.0 · Date of issue 2026-09-07
Cantieri Digitali Medtech S.r.l. · Corso di Porta Romana 6, 20122 Milano (IT)

1. Introduction

1.1 About the product

Medicilio RPM is a software medical device intended for the remote monitoring of patients enrolled in a clinician-prescribed care pathway. It collects measurements from compatible connected medical devices and from manual patient input, evaluates each measurement against clinician-set thresholds, raises alerts when thresholds are breached, and supports clinicians in producing AI-assisted telemonitoring reports that they must review and sign before any report is released to the patient.

Medicilio RPM is qualified as Medical Device Software (MDSW) per MDCG 2019-11 and is classified as Class IIa under EU Regulation 2017/745 (MDR).

1.2 About this manual

This document is the Instructions for Use (IFU) for Medicilio RPM. It combines the regulatory IFU content required by Annex I §23 of the MDR with the operational depth required by the intended users to operate the device safely.

1.3 Hardware, software and network specifications

Medicilio RPM is delivered as two end-user applications that connect to the manufacturer's cloud back end:

The "label" of a software medical device is the in-app device-identification screen, which carries the device identification per §23.2 and §23.4(a). In the patient application it is the foot of the Profile screen, below Logout: it states that Medicilio RPM is a medical device, with the software version, the release date and the device UDI, and carries a link to these Instructions for Use.

2. Contact details

2.1 Manufacturer

Cantieri Digitali Medtech S.r.l. Corso di Porta Romana 6 20122 Milano (MI), Italy VAT / P.IVA IT11328810962

2.2 Technical and clinical support

2.3 Feedback

Feedback on these Instructions for Use, or on the device, may be sent to info@medicilio.it. Feedback is not a substitute for the serious-incident reporting procedure described in §15.

2.4 Request a paper copy

These Instructions for Use are delivered electronically as permitted by Regulation (EU) 2021/2226. A printed copy is available, at no charge, within 7 calendar days of a written request sent to the support email above.

You can also open the current Instructions for Use from inside the app, using the link at the foot of the Profile screen. The link always opens the current patient edition.

3. Definition of symbols and precautions

The following symbols are used on the cover page and throughout this document, in accordance with ISO 15223-1:2021. Where a harmonised symbol does not apply, a description is provided in this section.

The IFU also uses four in-text callouts to draw attention to information of different criticality:

4. Warnings

The following warnings apply to all users of the device.

5. Intended use

5.1 Product name

Medicilio RPM : Remote Patient Monitoring software, software version 1.0.0.

5.2 Intended use / Intended purpose / Indications for use

Medicilio RPM is a medical device software platform intended for remote monitoring of adult patients by receiving, transmitting, storing, and presenting physiological parameter measurements from compatible connected devices and patient-reported data entered by the patient, to support healthcare professionals in clinical follow-up and chronic disease management.

Medicilio RPM includes an AI-assisted report generation function that produces draft summaries of patient data for review by a healthcare professional.

Medicilio RPM does not itself perform physiological measurements; physiological measurements are provided by the connected devices.

5.3 Intended user profile

Medicilio RPM addresses two target client populations: (1) healthcare provider organisations (hospitals, clinics, independent practices) that prescribe and operate the pathway, and (2) patients assigned to a pathway.

Within each client, the device has the following intended users.

5.3.5 Patient

5.4 Intended operational environment

Medicilio RPM is operated in two environments:

• The clinician environment: a clinical office or remote workstation with a managed computer, controlled physical access, and a professional network connection.
• The patient environment: the patient's home or any location in which the patient can use their mobile device with mobile data or Wi-Fi connectivity.

The device is not intended to be used in operating theatres, intensive care units, or in any environment where life-supporting decisions must be made in real time.

5.5 Intended patient population

Adult patients (18 years of age and older) requiring remote monitoring as part of clinical follow-up or chronic disease management. Patients must be able to use the mobile application, or have a designated caregiver acting on their behalf, and must have been prescribed a remote-monitoring pathway by an authorised clinician.

5.6 Intended clinical benefits

Candidate clinical benefits:

• Earlier detection of out-of-range vital parameters in the home setting, supporting clinical follow-up and decision-making.
• Improved adherence to the prescribed care pathway through structured reminders and activity scheduling.
• Increased continuity of care between in-clinic visits via documented telemonitoring and AI-assisted reports reviewed by a clinician.

5.7 Performance characteristics

Medicilio RPM is not a measuring device in itself: it records, evaluates and presents measurements taken by compatible connected medical devices listed in §6, each carrying its own CE marking and its own accuracy specification. The performance characteristics of Medicilio RPM are:

• Threshold evaluation: each measurement is compared against the per-pathway thresholds; if a high, low, weight-variation or boolean threshold is breached, an alert with the corresponding level is recorded.
• Alert routing: red-level alerts create a schedule notification for Medicilio Customer Support and emergency contact notifications via job queues.
• Report generation: telemonitoring reports are drafted by an AI component and require clinician review, editing and electronic signature before being released to the patient.

5.8 Contraindications

• Use in any clinical situation requiring real-time monitoring (e.g. ICU, perioperative care).
• Use as the sole monitoring modality for a patient whose clinical condition requires continuous in-person observation.
• Use by patients who cannot understand or operate the mobile application and do not have a designated caregiver.
• Use as a substitute for emergency medical care.

6. Compatible medical devices and accessories

Who can perform this action (associating devices to a pathway): Department Doctor, Independent Practice Doctor, Department Doctor Head, Medicilio Customer Support, Ops.

6.1 Compatible measurement devices : overview

Medicilio RPM is used with a configured patient home kit. The devices included depend on the monitoring pathway prescribed to the patient.

Each device has its own Instructions for Use. The user must follow the device manufacturer's IFU for setup, positioning, cleaning, calibration, battery handling, warnings, contraindications, and maintenance.

6.1.1 Medical devices

Medicilio RPM connects to CE-marked medical devices, predominantly Class IIa (with the possible exception of Class I devices, e.g. body-composition scales), across the following categories:

• Pulse oximeters
• Blood-pressure monitors (with or without integrated ECG)
• ECG recorders
• Infrared thermometers
• Spirometers
• Body-composition / weight scales

Each device retains its own CE marking, accuracy specification, and manufacturer's Instructions for Use, which must be followed for setup, positioning, cleaning, calibration, battery handling, warnings, contraindications, and maintenance (see the IMPORTANT note below).

The current list of compatible devices is kept updated and is available to users upon request by contacting Medicilio support (see §2.2).

6.1.2 Non-medical wellness devices

Medicilio RPM may also ingest data from non-medical wellness devices in the following categories: smartwatches (step count, heart rate) and body-composition scales. These devices are not regulated as medical devices; their manufacturers explicitly declare this, and their accuracy claims (where present) are wellness-grade, not clinical-grade. The specific models currently in use are available upon request by contacting Medicilio support (see §2.2).

6.2 Patient tablet (MDM-locked): Lenovo Tab M11

The patient receives, as part of the home kit, a tablet on which the Medicilio patient application is preinstalled. The tablet is locked by a Mobile Device Management (MDM) tool so that only the Medicilio application can run on it; navigation outside the app, installation of other applications, and access to the operating system are not permitted.

6.3 Measurement types

Medicilio RPM supports the following measurement types:

• Blood pressure (systolic / diastolic)
• ECG (electrocardiogram trace + interpretation flags)
• Heart rate
• Oxygen saturation (SpO₂)
• Body temperature
• Body weight
• Step count
• Peak expiratory flow (PEF, in litres per minute; the other spirometry values a spirometer can produce are not collected)

7. Logging in and logging out

7.1 Authentication method

Medicilio RPM uses passwordless authentication via one-time password (OTP) sent by email. There is no permanent password to remember.

7.2 Logging in

1. On the tablet provided in your home kit, open the Medicilio app.
2. Enter your email address. A 6-digit one-time password is sent to the same email.
3. Enter the OTP within its validity window.
4. The app loads to the home screen of your pathway.

7.3 Logging out

Open the profile screen and select Esci.

7.4 Session management

Sessions expire automatically after a period of inactivity:

30 days for the patient, on the Medicilio-provided MDM-locked tablet (see §6.2);

Closing the mobile app does not, by itself, terminate the session, explicit logout is required to terminate the session on demand.

8. Using the patient app

8.1 Daily activities

The patient operates Medicilio RPM exclusively from the MDM-locked tablet supplied in the home kit (see §7.2). Once the pathway is active, the app presents the activities scheduled for the day, ordered by how soon they must be done.

Activities include:

• Measurements (using a connected device or, where applicable, manual entry, see §6).
• Drug intakes (timed reminders to take a prescribed drug).
• Questionnaires (clinician-prescribed surveys).

Where an activity has a recommended time, that time belongs to one of three slots, always shown with its hours: Morning 05:00–12:00, Afternoon 12:00–18:00, Evening 18:00–24:00. Whatever the activity, the day closes at 23:59:59 and nothing can be recorded for that day afterwards.

Your clinician decides, for each measurement, whether its timing matters clinically:

• A fixed measurement can only be recorded while its slot is open. Once the slot has passed, the app no longer accepts it and it is recorded as not performed.
• A flexible measurement counts whenever you record it during the day. The app shows the recommended time as advice rather than as a deadline.

Questionnaires have no time slot at all: you can complete them at any point in the day.

8.2 Today screen

The first screen on the tablet shows the Today view. It is split into two zones.

The top zone stays in place while the rest of the screen scrolls. It carries a small number of summary cards, each of which opens a panel with more detail when tapped:

• Adherence: how consistently you have been completing your activities.
• Guides and tutorials: the instruction videos for the devices you actually have, plus general guides such as how to connect the gateway and how to use the tablet.
• Steps: the steps you have taken today against your goal, shown as a percentage and capped at 100%.

The lower zone scrolls and contains, in order:

• Any technical-issue cards, when something in your home kit needs attention (see §14).
• Today's reminders: today's appointments and any report or result waiting to be read. These are reminders only. There is nothing to tick off, and they do not count towards your adherence.
• To do today: the activities still to be completed, ordered by how soon they are due.
• To do later: activities that are not yet open because their time has not arrived.
• Completed: what you have already done today.

Each activity shows its name, its recommended time, and its current state.

8.3 Taking a measurement with a connected device

1. Tap the measurement activity in the Today list. The screen shows the title, a tutorial video for that device, and the same instructions as numbered steps. The video does not start on its own: tap play to watch it, or open it full screen.
2. Follow the positioning instructions for the device carefully. The home kit also includes the manufacturer's printed instructions for each device.
3. Start the device as instructed by its own IFU (typically a single power-on or Start button).
4. Hold still and wait for the device to complete the measurement.
5. Once the device transmits over Bluetooth, the measurement appears in the app and is sent to the Medicilio cloud back end for threshold evaluation.
6. The app shows a confirmation screen with the recorded value(s). Tap Done to return to the Today list.

• Blood pressure: sit quietly for 3 minutes before measurement; place the cuff on the bare upper arm at heart height. The measurement takes about 30 seconds. The same reading also reports your heart rate.

• ECG: rest fingers on both contact pads as shown; the recording lasts 30 seconds. AI interpretation flags (e.g. "Atrial Fibrillation") appear on the result screen but are not diagnostic: they are forwarded to the clinician for review.

• Oxygen saturation: insert the index finger fully into the oximeter, hand resting on a flat surface. The result appears in 8–12 seconds. The same reading also reports your heart rate.

• Body temperature: point the probe at the forehead or use ear mode; press the trigger. Reading is available in 1 second.

• Body weight: step on the scale with bare feet, stand still until the value stabilises. Only the weight reading is collected by Medicilio RPM; body-composition parameters reported by the scale are not part of the intended use (see §6.1).

• Peak flow (where prescribed): sit comfortably with your back straight, breathe in deeply, and blow hard into the mouthpiece for at least 3 seconds. A shorter blow cannot be used, and the app asks you to repeat it.

8.4 Taking a manual measurement

1. Open the activity in the app.
2. Tap Enter manually.
3. Type the value(s) in the input fields and confirm.
4. The measurement is stored with an explicit manual data-source tag, visible to the clinician.

Peak flow cannot be entered manually. The reading reaches your care team only from the device.

8.5 Drug intakes

1. Open the drug-intake activity. You can do this at the recommended time, or later the same day if you were not able to record it straight away.
2. The app shows the drug name, the dose and any clinician notes.

3. The app asks whether you have taken the dose.
4. If you have taken it within the recommended time, tap to confirm. The intake is recorded as taken on time.
5. If the recommended time has passed, select the part of the day in which the dose was actually taken. Only parts of the day that have already gone by can be selected. The intake is recorded as taken outside the recommended time.
6. If you have not taken the dose, select one or more reasons from the list and confirm.

A medication can be recorded until 23:59:59 of the day it was due. If nothing is recorded by then, it is closed as not recorded. Your care team sees this as distinct from a dose declared as not taken.

8.6 Questionnaires

1. Open the questionnaire activity, at any point in the day that suits you : questionnaires are not tied to a time of day. The app shows the questionnaire title and the number of questions.
2. Answer each question. Question types include single choice, multiple choice, free text, and numeric scales.
3. Review the answers in the summary screen.
4. Tap Continue. The answers are stored against the pathway and are visible to the clinician.

8.7 Receiving an alert after a measurement

If a measurement result requires attention, you will receive a push and in-app notification prompting you to repeat the measurement, and see a Re-measurement requested screen immediately after the result. You are asked to repeat the measurement within a short window (typically 5–10 minutes). One of two outcomes follows:

• If the repeat measurement is fine, the notification is cleared automatically. You won't receive any further message about it.
• If the repeat measurement still shows a problem, your care team and your emergency contacts are notified right away. You will also receive a message advising you to contact emergency services if you are not feeling well.

This notification to your care team is not an emergency response. It is handled without a guaranteed immediate reply, and it is not a substitute for calling 112 in a suspected emergency. If you feel unwell, do not wait for the app or for Medicilio staff to respond, call 112.

Whenever a measurement needs confirming and you have not yet responded, a card appears among your activities on the home screen, naming the measurement concerned. It stays there until you complete the flow or your care team closes the alert.

Tapping the card asks who took the measurement and then guides you through measuring again if that is needed. If the repeat measurement is within range you can move on to your next activity; if it is still out of range you are advised to call the emergency number.

The device itself may signal that a reading did not work: the cuff moved, the ECG trace was too noisy, or the value is outside what is physically possible. The reading is then not shown to you or to your care team. The app shows an error screen, you receive a notification, and the activity reopens so you can measure again.

8.8 Viewing one's own measurements, reports and appointments

Procedure — View own measurement history

Open the History entry from the main menu. Select the day for which you want to see the completed or uncompleted activities.

Procedure — View own signed telemonitoring reports

Open Reports from the Documents tab in the History.

1. The list shows all signed reports. Reports not signed yet are not visible.
2. Tap a report to read it in full screen. Tap the download icon to save a PDF copy to the tablet.

Procedure — View own appointments

1. Open Appointments from the Visits tab in the History.
2. Upcoming appointments are at the top; past appointments below.
3. Tap an appointment to see the detail, the assigned clinician, and (for televisits/teleassistance) the Join televisit action when the slot opens

Procedure — Create a new appointment request

The patient can request an appointment from the mobile app; the Medicilio Customer Support confirms the slot.

1. From the Profile tab, tap Request teleassistance.

2. Choose the appointment type and a preferred date / time slot.
3. Optionally add a reason or symptom description.

4. Submit. The Medicilio Customer Support receives a notification and the Appointment is now available in the visit history under the Future Visits section, where it is possible to review the request or delete it.

8.9 Updating personal info, emergency contacts and subscription

Procedure — Update personal information

1. Open the Profile entry from the main menu.
2. Edit the editable fields (phone, address); identity fields (tax code, date of birth) are read-only and can be changed only by the Medicilio Customer Support.
3. Tap Save.

Procedure — Update own emergency contacts

1. From the Profile screen, tap Emergency contacts.
2. Add, edit or remove contacts.
3. Tap Save. The alert service is updated immediately.

Procedure — View subscription details

1. From the Profile screen, tap Subscription.
2. The app shows the current pathway, the activation fee, the monthly fee, and the next billing date.

9. Appointments and video consultations

9.1 Appointment durations and types

Durations: 30, 45 or 60 minutes.

Two appointment types require a video session:

• televisit: a remote consultation between the clinician and the patient.
• teleassistance: a remote support session, typically operated by a Healthcare Professional.

Procedure — Patient joins a televisit

1. On the tablet, open the Today screen at the scheduled time. Starting 15 minutes before the appointment, the Join button becomes active, allowing the user to connect to the appointment.

2. Tap Join. A confirmation screen appears, tap Connect to proceed. The patient app opens the video session in full-screen. Grant the app permission to use the camera and microphone (only asked on first use).
3. During the call, the local video feed is displayed at the top of the screen and the clinician's video is shown below. The following controls are available:

• Microphone – mute and unmute the audio.
• Camera – turn the video on or off.
• Chat – open the in-call chat to send text messages to the clinician.
• Share – share documents with the clinician during the session.

4. When the consultation ends, the clinician closes the session. The patient returns to the Today screen automatically.

Procedure — Cancel an appointment

1. Open the History tab and navigate to the Visits section.
2. Locate the teleassistance request and tap Delete. A confirmation dialog appears asking whether the request should be deleted.
3. Tap Confirm. The request is removed.

Note: Only teleassistance requests submitted by the patient can be deleted, and only while they have not yet been accepted by the Medicilio Customer Support. Once the request has been taken in charge, it can no longer be deleted or modified. To change the details of a pending request, delete it and submit a new one. Appointments scheduled by a clinician cannot be cancelled from the patient app.

Procedure — Sign and download an appointment PDF

After an appointment moves to Completed status, the clinician can produce a report or clinical note for that session. The signed report is visible to the patient under the Documents section in the patient menu on the tablet.

10. Documents and chat

10.1 Documents

Who can upload documents: Patient

Who can delete a document: Patient (only their own documents, and only if the healthcare professional has not yet viewed the document).

10.2 Document constraints

10.3 Patient document upload

A patient can upload supporting documents (e.g. lab results) directly to their pathway from the patient tablet. Two upload methods are available: taking a photo with the tablet camera, or transferring files from another device via QR code. QR-code sessions expire after 30 minutes.

Procedure

1. On the tablet, open Documents in the History tab and tap Upload documents

2. When prompted, select how to upload:

• Take a photo: the camera opens and the photo is sent directly.
• Upload from another device: the app displays a QR code and a 30-minute countdown timer.

3. If uploading from another device, scan the QR code with the camera of any other device (e.g. a personal phone). The QR code opens a browser page on that device.

4. Select the file or files on the second device and confirm.
5. The tablet shows the upload progress and a confirmation when complete. The same session can be reused until the countdown expire

Procedure — Delete one's own document

Who can perform this action: Patient (only on documents uploaded by the patient and not yet reviewed by a healthcare professional).

1. On the tablet, open the Documents in the History tab and select the document you want to remove.
2. Tap Delete.

3. If a healthcare professional has already reviewed the document, the action is blocked and the app shows a message instructing the patient to contact the clinical team.

4. Confirm to remove. The deletion is recorded in the audit log.

10.4 In-app chat

Both chat channels are created as soon as your pathway becomes active. The chat icon shows a badge when there are messages you have not read.

Two chat channels exist in the patient app.

Procedure — Send a chat message

1. Open the Chat entry from the main menu.
2. Tap the relevant channel ("Supporto di Medicilio" or "Supporto Medico Dottore").

3. Type the message in the input box; attach a photo or document if needed (subject to the constraints in §10.2).
4. Tap Send. A read indicator appears once the message is read by the Medicilio Customer Support or the clinical team.

You can edit or delete a message after sending it, from that message's own actions. This applies only to messages you sent yourself. If editing or deleting is no longer available, the app explains why.

11. IT security and data protection

11.1 Hosting and data residency

Medicilio RPM is hosted on Google Cloud Platform in the EU region (Belgium, Frankfurt and Milan). All clinical data and personal data are stored in the EU. Databases and their backups are held in the regions named above. Object storage, which holds archived application logs, uses Google Cloud EU multi-region storage and may therefore hold data in any European Union member state.

11.2 Personal data and GDPR

Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended. The Data Controller is the healthcare provider organisation that prescribes the pathway; Cantieri Digitali Medtech S.r.l. acts as Data Processor.

11.3 Transport and at-rest protections

• All client-server traffic uses HTTPS / TLS.
• Database storage uses Google Cloud-managed encryption at rest.
• Documents are stored in Google Cloud Storage; download URLs are signed and valid for one hour.

Medicilio's information-security controls follow the principles of confidentiality, integrity and availability appropriate to a Class IIa MDSW under MDR §23.4(ab) and MDCG 2019-16. This Instructions for Use does not cite specific information-security management standards; the underlying organisational controls are documented in Medicilio's internal Quality Management System.

12. Cybersecurity for users

12.1 Account

• Each user has a personal account tied to a single email address.
• Authentication is passwordless: a one-time password is sent to the registered email at every login.
• One-time passwords are single-use and expire shortly after they are generated. Sharing an OTP with another person grants that person access to the account.
• Sessions expire after a period of inactivity (see §7.4).

12.2 What to do if your account is compromised

If you suspect that an unauthorised person has access to your Medicilio account or to the email inbox associated with it:

6. Stop using the device for any clinical action.
7. Notify Medicilio support at the email and phone numbers in §2.2, providing the email address associated with the account and a brief description of the suspected compromise.
8. Medicilio support revokes the affected email from the Kinde identity provider back office, which terminates the user's ability to authenticate. Any active session is invalidated at the next token refresh, and no further one-time password can be issued for that email until the account is re-provisioned.
9. The user must be re-provisioned by an authorised role before regaining access (see §7: provisioning).
10. The data controller documents the suspected compromise in line with its incident-response procedure (GDPR Article 33 / 34 where applicable).

12.3 Patient device hygiene

13. Maintenance and software updates

13.1 Software updates

Medicilio RPM is delivered as cloud software (back end) and as two client applications (web and mobile). The release cadence is approximately one release every three months; security and hotfix releases may be issued more often.

13.2 Data backup

Patient and pathway data are backed up by the manufacturer as part of the cloud back-end operation. Users do not need to perform local backups.

13.3 Account recovery

See §12.2.

13.4 Patient-side maintenance

The patient is responsible for:

• Keeping the MDM-locked tablet charged and connected to power as needed; the Medicilio app updates itself automatically over the network : the patient does not need to install updates manually.
• Charging and not modifying the home-kit measurement devices.
• Not tampering with the MDM-lock configuration of the tablet, with the SIM card, or with the home gateway.
• Reporting any tablet, measurement-device or kit fault to the Medicilio Customer Support (see §2.2).

14. Troubleshooting

The table below covers the most common user-facing failure modes.

14.1 Technical-issue cards in the app

When something in your home kit stops working, a card appears on the home screen for as long as the problem lasts. Tapping it opens a page explaining what the app has detected, with numbered steps to put it right and the technical-support telephone number at the bottom.

When you tap "I have done this, check", the app checks whether the problem is fixed. If it is, the card disappears. If it is not, the service centre is alerted and will contact you, and the card stays on the home screen. If more than one thing needs attention, you see one card per problem.

15. Reporting of serious incidents

Any serious incident that occurs in relation to Medicilio RPM must be reported to:

• The manufacturer: Cantieri Digitali Medtech S.r.l., at the vigilance email info@medicilio.it
• The Italian competent authority: Ministero della Salute, Direzione Generale dei dispositivi medici e del servizio farmaceutico, Ufficio 5 Dispositivovigilanza. Reports may be submitted through the Banca dati dei dispositivi medici (vigilance section) operated by the Ministero della Salute.

A "serious incident" is defined in Article 2(65) of MDR 2017/745 as an incident that, directly or indirectly, led, might have led or might lead to: the death of a patient, user or other person; the serious deterioration of a person's state of health; or a serious public-health threat.

16. End-of-use, account deletion and data retention

16.1 Ending pathway use

When a pathway reaches its planned end, it is marked as Completed. If it needs to be ended early, it is marked as Cancelled. In both cases, any future scheduled activities are removed and the associated devices are released from the patient's record. The patient receives an email when the pathway reaches its planned end or is cancelled early.

16.2 Patient and account deletion

Who can delete a patient record: Department Doctor Head, Independent Practice Doctor, Medicilio Customer Support, Ops.

When a patient record is deleted, the following sequence is applied:

4. Personally identifying information (PII): name, surname, tax code, date of birth, address, contact details, emergency contacts, is exported to a sealed audit-only store maintained by Medicilio under documented data-protection controls.
5. The operational patient record is then removed from the application; PII is no longer accessible through the Medicilio RPM user interface to any role.
6. Clinical and billing data that must be retained for the periods set out in §16.3 are kept in their respective retention stores in scrubbed form, i.e. without PII linkage, so that data retention obligations can be met without continued processing of the patient's identity.

16.3 Data retention

Clinical data linked to a pathway are retained for 10 years from the end of the pathway, in accordance with the applicable Italian SSN rules on healthcare records and with the GDPR principle of storage limitation. At the expiry of the retention period, retained clinical data are deleted or further anonymised so that they can no longer be attributed to an identified or identifiable patient.

17. Glossary

18. Manual versions