Privacy Policy

This Privacy Policy explains which personal data we collect when you visit the website tsarouhas-asi.gr (hereinafter “the Website”), for what purpose we use them, on what legal basis, for how long we retain them and what your rights are, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Law 4624/2019.

Data controller

Data controller: Ioannis K. Tsarouhas, Orthopedic Surgeon, 101 Vasilissis Sofias Avenue, Athens (with practices also in Petroupoli, Chania and Heraklion, Crete). Telephone: 210 6464 744, email: tsarouhasmd@gmail.com.

Which data we collect

Contact and appointment request form. Full name, telephone number, email address, the practice that serves you, preferred time to be contacted and, optionally, a brief description of your problem. The description of the problem may include information about your health, which constitutes special category data. We process it only with your explicit consent, which you give by ticking the relevant box before submitting the form, and exclusively in order to prepare our communication with you and your appointment.

Telephone communication. When you call us, we record the details that are necessary for scheduling the appointment (full name, telephone number, reason for the visit).

Sending examinations for a second opinion or remote assessment. If you send us imaging studies (X-rays, MRI, CT) or a medical history electronically, these data are used only for the medical assessment you requested and are kept in your medical record in accordance with medical legislation.

Browsing data. The Website uses cookies and similar technologies for statistical and advertising purposes, only if you accept them. Details are given in the Cookie Policy.

Server (server logs). The hosting provider automatically records technical information (IP address, browser type, time of visit) for reasons of security and proper operation.

Purposes and legal basis of processing

• Communication and scheduling of appointments: taking pre-contractual steps at your request (Article 6(1)(b) GDPR). For any health information you provide to us through the form: explicit consent (Article 9(2)(a) GDPR).
• Provision of medical services and keeping of a medical record: Article 9(2)(h) GDPR in conjunction with the Code of Medical Ethics (Law 3418/2005).
• Replying to enquiries and second opinion: our legitimate interest in responding to your requests (Article 6(1)(f) GDPR) and, for health data, your explicit consent.
• Traffic statistics and advertising: your consent through the cookie management tool (Article 6(1)(a) GDPR, Article 4(5) of Law 3471/2006).
• Security of the Website: our legitimate interest (Article 6(1)(f) GDPR).

Recipients of the data

Your data are processed only by the doctor and the authorised secretarial staff, who are bound by a duty of confidentiality. Access to them may be given, as processors and only to the extent necessary, to the hosting provider of the Website, the email service provider and the company that provides technical support for the Website (BeThree). We do not sell and do not transfer your data to third parties for their own purposes. The providers of statistical and advertising services (Google, Meta) receive browsing data only if you have given your consent to the corresponding cookies, and they may process them outside the EU on the basis of the transfer mechanisms approved by the European Commission.

Retention period

• Contact form details: up to 12 months from the last communication, unless a medical relationship arises, in which case they are incorporated into the medical record.
• Medical record: ten (10) years from the last visit, as laid down by the Code of Medical Ethics.
• Cookie data: in accordance with the duration of each cookie stated in the Cookie Policy.
• Server logs: up to 12 months.

Your rights

You have the right of access to your data, the right to rectification, erasure (where there is no legal obligation to retain them), restriction of processing, portability and objection, as well as the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal. You can exercise your rights by sending an email to tsarouhasmd@gmail.com. We will reply within one month. If you consider that the processing infringes the legislation, you have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Avenue, 115 23 Athens, www.dpa.gr).

Security

The Website operates exclusively over an encrypted connection (HTTPS). The form data are stored in a protected environment with restricted access, and technical and organisational measures appropriate for health data are in place. We recommend that you do not send sensitive information through non-secure channels.

Minors

The Website is addressed to adults. Appointment requests for minors are submitted by their parent or legal guardian.

Links to third parties

The Website contains links and embedded content from third parties (YouTube, Google Maps, Google Reviews, social networks). These websites have their own privacy policies, for which we bear no responsibility.

Changes to the policy

This policy may be updated. The date of the last update is shown at the top of the page. Material changes will be announced on the Website.