Privacy policy

1. Who is responsible for your information

The data controller is Demetris Stavrou IEPE, trading as European Institute of Plastic Surgery, registered in Cyprus with registration number HE339987.

Registered address: 38 Klimentos Street, Nicosia 1061, Cyprus.

Questions about this notice, and requests to exercise any of the rights in section 9, go to [email protected] or [email protected]. No data protection officer is appointed.

The practice operates in Cyprus. Where a clinic is hosted at another organisation's premises, that organisation may be a separate controller for its own records — see section 6.

2. What this notice covers

It covers the website at this domain, the enquiry form on it, telephone and WhatsApp contact with the practice, and the records created when you attend a consultation or have an operation. It does not cover other websites you reach from links here, each of which has its own notice.

3. What information is collected

Information you give us

• Enquiries. Your name, email address, telephone number if you give one, the country you are travelling from if you give it, the clinic and procedure you select, and whatever you write in the message. That message frequently describes your health, which makes it special category data under Article 9 of the GDPR.
• Appointments. The information needed to book and hold a consultation.
• Correspondence. Emails, WhatsApp messages and notes of telephone calls with the practice.

Information created when you are treated

• Clinical records: history, examination findings, diagnosis, the operation performed, anaesthetic records, post-operative notes and follow-up.
• Clinical photographs, where these are taken as part of your care.
• Billing and insurance records, including correspondence with an insurer where one is involved.

Information collected automatically

This site sets no advertising cookies. It uses Google Analytics to count visits and pages, but only after you have accepted it in the bar at the foot of the page; until then nothing from Google loads, and refusing is one press. What is recorded without asking is limited to the technical logs kept by the hosting provider, Cloudflare, in order to serve pages and defend against attacks. The before-and-after gate on the results page stores your choice in your own browser's session storage; nothing is sent to us and it is deleted when you close the tab. What Google Analytics measures, what is switched off in it and how to change your answer are set out in the cookie policy.

4. Why we hold it, and on what lawful basis

Ordinary personal data is processed under Article 6 of the GDPR. Health information is special category data and needs a second, separate basis under Article 9. Both are set out below.

Responding to your enquiry

Article 6(1)(b) — steps taken at your request before entering into a contract. Where your enquiry describes your health, Article 9(2)(a) — your explicit consent, given by the checkbox on the enquiry form. You can withdraw that consent at any time; withdrawal does not affect processing already carried out.

Providing medical care

Article 6(1)(b) — performance of a contract with you. For the clinical record itself, Article 9(2)(h) — processing necessary for medical diagnosis, the provision of health care and treatment, and the management of health care services, carried out by or under the responsibility of a professional subject to the obligation of professional secrecy under Article 9(3) and the equivalent national law.

Keeping records we are required to keep

Article 6(1)(c) — compliance with a legal obligation, and Article 9(2)(h) for the clinical content of those records. Medical record retention is set by law in each country the practice operates in; see section 5.

Publishing before-and-after photographs

Article 6(1)(a) and Article 9(2)(a) — your explicit, specific, written consent, given separately from consent to treatment and never a condition of it. Consent can be withdrawn at any time and the images are removed when it is. No photograph is published without a consent record held against it.

Billing, insurance and accounting

Article 6(1)(b) and 6(1)(c). Where clinical detail has to be shared with an insurer to support a claim, Article 9(2)(a) — your explicit consent — or Article 9(2)(f) where it is needed to establish, exercise or defend a legal claim.

Running and securing the website

Article 6(1)(f) — our legitimate interest in a site that stays available and is not attacked. This is limited to the technical logs described in section 3.

What we do not do. Your enquiry and your clinical information are not used for marketing, are not sold, are not shared with advertising networks, and their content is not passed to any analytics product. If you have accepted analytics cookies, the fact that an enquiry was sent is counted; nothing you wrote travels with it. There is no advertising pixel on this site and no third-party form service handling your message.

5. How long it is kept

Information is kept for as long as it is needed for the purpose it was collected for, and for as long as the law requires — which for medical records is the longer of the two.

Enquiries that do not lead to treatment

30 days, then deleted.

Clinical records

6 years from the end of your treatment, after which they are securely destroyed.

Published photographs

Held while consent stands, and removed from publication when consent is withdrawn. The consent record itself is kept for 1 year so that the basis for publication remains demonstrable.

Billing and accounting records

6 years, as required by Cyprus tax and company law.

6. Who your information is shared with

Your information is shared only where it is necessary, and every organisation that processes it on the practice's behalf does so under a written agreement meeting Article 28 of the GDPR.

• Clinicians and staff involved in your care, including anaesthetic and nursing staff at the operating centre.
• The facility where your operation is performed, which keeps its own records as a separate controller.
• Processors acting on our instructions: Cloudflare (website hosting and the enquiry endpoint), Resend (which sends the enquiry email), and Google Workspace (the practice mailbox that receives it); and, for your clinical care, the practice's patient-management system and its clinical-photography storage.
• Your insurer, where you have asked us to support a claim.
• Regulators, courts and public authorities, where the law requires disclosure.

Where consultations are held at premises hosted by another clinic, that clinic is responsible for its own records of your attendance under its own privacy notice.

7. Transfers outside the EEA

The practice's intention is to keep personal data within the European Economic Area, and your enquiry is stored in the EU. Some of the processors that run the website are established in the United States — Cloudflare, which hosts the site, and Google, which provides the practice mailbox — and personal data may be processed or accessed by them outside the EEA. Where that happens it is done under the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, and you can ask for a copy of the safeguard relied on.

8. How it is kept secure

Access to clinical information is limited to the people who need it to do their work and is subject to professional confidentiality obligations independent of data protection law. Personal information you send through this website is protected in transit by encryption (HTTPS), and the website itself stores none of it. Clinical records are held in access-controlled systems, encrypted at rest and backed up regularly.

9. Your rights

Under the GDPR you have the right to:

• Access — a copy of the information held about you.
• Rectification — correction of anything inaccurate or incomplete.
• Erasure — deletion, where there is no overriding obligation to keep it. Clinical records generally cannot be deleted on request while a statutory retention period is running.
• Restriction — to have processing paused while a dispute is resolved.
• Portability — to receive information you gave us in a machine-readable form.
• Objection — to processing carried out on the basis of legitimate interests.
• Withdrawal of consent — at any time, where consent is the basis relied on, including consent to publish photographs.
• Not to be subject to automated decision-making. The practice makes no decisions about your care by automated means and does not profile you.

To exercise any of these, contact [email protected]. A response is due within one month. There is no charge unless a request is manifestly unfounded or excessive.

10. Complaints and supervisory authorities

If you are unhappy with how your information has been handled, tell the practice first — most issues are resolved faster that way. You also have the right to complain to a supervisory authority, whether or not you have raised it with us.

You may complain to the authority in the country where you live, where you work, or where the issue arose. In Cyprus, this is the Office of the Commissioner for Personal Data Protection, whose contact details are published on the Commissioner's own website.

11. Changes to this notice

When this notice changes materially the date at the top is updated and, where the change affects how your information is used, you are told directly rather than left to find it here.

Cookie policy Terms of use Contact the practice