Privacy policy

1. Who is responsible for your information

The data controller is Demetris Stavrou IEPE, trading as European Institute of Plastic Surgery, registered in Cyprus with registration number HE339987.

Registered address: 38 Klimentos Street, Nicosia 1061, Cyprus.

Questions about this notice, and requests to exercise any of the rights in section 9, go to info@eips.com or drstavrou@eips.com. No data protection officer is appointed.

The practice operates in Cyprus. Where a clinic is hosted at another organisation's premises, that organisation may be a separate controller for its own records — see section 6.

2. What this notice covers

It covers the website at this domain, the enquiry form on it, telephone and WhatsApp contact with the practice, and the records created when you attend a consultation or have an operation. It does not cover other websites you reach from links here, each of which has its own notice.

The EIPS Virtual online consultation service — the EIPS Virtual mobile app and virtual.eips.com — is covered separately, in the section on the EIPS Virtual consultation app at the end of this notice.

3. What information is collected

Information you give us

• Enquiries. Your name, email address, telephone number if you give one, the country you are travelling from if you give it, the clinic and procedure you select, and whatever you write in the message. That message frequently describes your health, which makes it special category data under Article 9 of the GDPR.
• Appointments. The information needed to book and hold a consultation.
• Correspondence. Emails, WhatsApp messages and notes of telephone calls with the practice.
• Patient portal. If you are invited to the portal, the phone number or email we use to send your sign-in code, and a record of when you signed in and what you viewed.
• Questionnaire. Your answers to the pre-consultation questionnaire, if we send you one.

Information created when you are treated

• Clinical records: history, examination findings, diagnosis, the operation performed, anaesthetic records, post-operative notes and follow-up.
• Clinical photographs, where these are taken as part of your care.
• Billing and insurance records, including correspondence with an insurer where one is involved.

Information collected automatically

This site sets no advertising cookies. It uses Google Analytics to count visits and pages, but only after you have accepted it in the bar at the foot of the page; until then nothing from Google loads, and refusing is one press. What is recorded without asking is limited to the technical logs kept by the hosting provider, Cloudflare, in order to serve pages and defend against attacks. When you start filling in the enquiry form, it also runs Cloudflare Turnstile, an invisible check that the enquiry comes from a person rather than an automated program; it looks at technical signals from your browser, not at what you type. Cloudflare's handling of that information is set out in its Turnstile Privacy Addendum. The before-and-after gate on the results page stores your choice in your own browser's session storage; nothing is sent to us and it is deleted when you close the tab. What Google Analytics measures, what is switched off in it and how to change your answer are set out in the cookie policy.

4. Why we hold it, and on what lawful basis

Ordinary personal data is processed under Article 6 of the GDPR. Health information is special category data and needs a second, separate basis under Article 9. Both are set out below.

Responding to your enquiry

Article 6(1)(b) — steps taken at your request before entering into a contract. Where your enquiry describes your health, Article 9(2)(a) — your explicit consent, given by the checkbox on the enquiry form. You can withdraw that consent at any time; withdrawal does not affect processing already carried out.

Providing medical care

Article 6(1)(b) — performance of a contract with you. For the clinical record itself, Article 9(2)(h) — processing necessary for medical diagnosis, the provision of health care and treatment, and the management of health care services, carried out by or under the responsibility of a professional subject to the obligation of professional secrecy under Article 9(3) and the equivalent national law.

Keeping records we are required to keep

Article 6(1)(c) — compliance with a legal obligation, and Article 9(2)(h) for the clinical content of those records. Medical record retention is set by law in each country the practice operates in; see section 5.

Publishing before-and-after photographs

Article 6(1)(a) and Article 9(2)(a) — your explicit, specific, written consent, given separately from consent to treatment and never a condition of it. Consent can be withdrawn at any time and the images are removed when it is. No photograph is published without a consent record held against it.

Billing, insurance and accounting

Article 6(1)(b) and 6(1)(c). Where clinical detail has to be shared with an insurer to support a claim, Article 9(2)(a) — your explicit consent — or Article 9(2)(f) where it is needed to establish, exercise or defend a legal claim.

Running the patient portal and questionnaire

Article 6(1)(b), performance of a contract with you. For the health information involved, Article 9(2)(h), the provision of health care by professionals bound by professional secrecy.

Running and securing the website

Article 6(1)(f) — our legitimate interest in a site that stays available and is not attacked. This is limited to the technical logs described in section 3.

What we do not do. Your enquiry and your clinical information are not used for marketing, are not sold, are not shared with advertising networks, and their content is not passed to any analytics product. If you have accepted analytics cookies, the fact that an enquiry was sent is counted; nothing you wrote travels with it. There is no advertising pixel on this site and no third-party form service handling your message; it is stored only in the practice's own system.

5. How long it is kept

Information is kept for as long as it is needed for the purpose it was collected for, and for as long as the law requires — which for medical records is the longer of the two.

Enquiries that do not lead to treatment

12 months after our last contact with you, then deleted automatically.

Questionnaire answers

Kept as part of your medical record.

Portal sign-in records

2 years. Sign-in codes are deleted when used or after 10 minutes.

Clinical records

6 years from the end of your treatment, after which they are securely destroyed.

Published photographs

Held while consent stands, and removed from publication when consent is withdrawn. The consent record itself is kept for 1 year so that the basis for publication remains demonstrable.

Billing and accounting records

6 years, as required by Cyprus tax and company law.

6. Who your information is shared with

Your information is shared only where it is necessary, and every organisation that processes it on the practice's behalf does so under a written agreement meeting Article 28 of the GDPR.

• Clinicians and staff involved in your care, including anaesthetic and nursing staff at the operating centre.
• The facility where your operation is performed, which keeps its own records as a separate controller.
• Processors acting on our instructions: Cloudflare (website and portal hosting, and the enquiry endpoint), Resend (which sends the enquiry email), Google Workspace (the practice mailbox), Supabase (the practice's patient-management system, hosted in the EU), and Twilio (which sends WhatsApp and text messages such as appointment reminders and portal sign-in codes); and, for your clinical care, the practice's clinical-photography storage.
• Your insurer, where you have asked us to support a claim.
• Regulators, courts and public authorities, where the law requires disclosure.

Where consultations are held at premises hosted by another clinic, that clinic is responsible for its own records of your attendance under its own privacy notice.

7. Transfers outside the EEA

The practice's intention is to keep personal data within the European Economic Area, and your enquiry is stored in the EU. Some of the processors that run the website are established in the United States — Cloudflare, which hosts the site, Google, which provides the practice mailbox, and Twilio, which sends text and WhatsApp messages — and personal data may be processed or accessed by them outside the EEA. Where that happens it is done under the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, and you can ask for a copy of the safeguard relied on.

8. How it is kept secure

Access to clinical information is limited to the people who need it to do their work and is subject to professional confidentiality obligations independent of data protection law. Personal information you send through this website is protected in transit by encryption (HTTPS), and it is stored only in the practice's own system, hosted in the EU. Clinical records are held in access-controlled systems, encrypted at rest and backed up regularly.

9. Your rights

Under the GDPR you have the right to:

• Access — a copy of the information held about you. The patient portal shows some of your information for convenience. It does not replace your right of access: to receive a full copy, write to info@eips.com.
• Rectification — correction of anything inaccurate or incomplete.
• Erasure — deletion, where there is no overriding obligation to keep it. Clinical records generally cannot be deleted on request while a statutory retention period is running.
• Restriction — to have processing paused while a dispute is resolved.
• Portability — to receive information you gave us in a machine-readable form.
• Objection — to processing carried out on the basis of legitimate interests.
• Withdrawal of consent — at any time, where consent is the basis relied on, including consent to publish photographs.
• Not to be subject to automated decision-making. The practice makes no decisions about your care by automated means and does not profile you.

To exercise any of these, contact info@eips.com. A response is due within one month. There is no charge unless a request is manifestly unfounded or excessive.

10. Complaints and supervisory authorities

If you are unhappy with how your information has been handled, tell the practice first — most issues are resolved faster that way. You also have the right to complain to a supervisory authority, whether or not you have raised it with us.

You may complain to the authority in the country where you live, where you work, or where the issue arose. In Cyprus, this is the Office of the Commissioner for Personal Data Protection, whose contact details are published on the Commissioner's own website.

11. Changes to this notice

When this notice changes materially the date at the top is updated and, where the change affects how your information is used, you are told directly rather than left to find it here.

Cookie policy Terms of use Contact the practice

EIPS Virtual consultation app and virtual.eips.com

Last updated: 1 November 2026

Who we are

EIPS Limited ("we", "us") operates the EIPS Virtual consultation service — the EIPS Virtual mobile app and the website at virtual.eips.com. We are the data controller for the personal data described below.

EIPS Limited, Severis Building, Floor 3, 9 Archiepiskopou Makareiou III, Nicosia 1065, Cyprus. Contact: info@eips.com

What we collect

Account and contact details — your name, email address, phone number, country, date of birth and preferred language. If you sign in with WhatsApp, your mobile number is used to send you a one-time sign-in code. WhatsApp alerts are sent only if you switch them on, and contain no medical details — only a note that a new message is waiting in the app.

Health information — the procedure you are interested in, your main concern, previous surgeries, current medications, smoking status, the photographs and any video you upload for assessment, and the messages you exchange with the surgeon. Under the GDPR this is special-category data and we treat it accordingly.

Payment records — the amount, status and payment reference for the consultation fee. Card details are entered directly with our payment provider and never reach our systems.

Technical data — your account identifier, a device token used to send you notifications, the app version, and diagnostic data if the app encounters an error.

Why we may process it

• To create and operate your account, and to provide the consultation you have asked for (performance of our contract with you, GDPR Article 6(1)(b)).
• To provide health care. Your clinical information is processed for the purpose of a consultation given by a licensed surgeon who is bound by professional secrecy (GDPR Article 9(2)(h)).
• To take payment for the consultation fee (Article 6(1)(b)).
• To keep the service secure and working, including crash diagnostics (legitimate interests, Article 6(1)(f)).
• To meet legal obligations, including medical record-keeping (Article 6(1)(c)).

Automated processing and artificial intelligence

We use AI to support the service. You should know exactly where:

• Photo quality check. When you upload a photograph it is analysed automatically to judge whether it is usable — lighting, framing and focus. It is a technical check only. It does not diagnose anything and makes no clinical assessment.
• Message translation. If you choose to translate a message, that message is processed to produce the translation.
• Draft replies for the surgeon. The surgeon can generate a suggested draft reply, which draws on your consultation details and conversation. The draft is only ever a starting point: the surgeon reviews and edits it, and nothing is sent to you unless the surgeon sends it.

These features are provided by Anthropic acting as our processor. Your data is not used to train AI models.

No decision producing legal or similarly significant effects about you is made by automated means. Every clinical judgement is made by the surgeon.

Who processes your data

We do not sell your data. We share it only with providers who process it on our instructions:

• Supabase — database, file storage, authentication. Switzerland (Zurich).
• Anthropic — photo quality check, translation, draft replies. United States.
• Stripe — payment processing. United States / EU.
• Google (Firebase) — push notifications, website hosting. United States.
• Google Drive — encrypted backups. United States.
• Sentry — crash and error diagnostics. EU.
• Resend — notification emails. United States.
• Twilio — WhatsApp sign-in codes and WhatsApp alerts (only if you choose them). United States.
• Meta (WhatsApp) — delivery of WhatsApp messages sent via Twilio. United States / EU.

Switzerland is recognised by the European Commission as providing an adequate level of data protection. Transfers to providers in the United States are made under the Standard Contractual Clauses included in each provider's data processing terms.

How your data is protected

Data is encrypted in transit and encrypted at rest. Consultation photographs and video are held in private storage that is not publicly accessible; they are served only through short-lived links to you and to the treating surgeon. Backups are encrypted before they leave our systems.

Access to your consultation is limited to you and the treating surgeon.

Please note: the service is not end-to-end encrypted. Your consultation is readable by the treating surgeon, which is necessary for the surgeon to advise you. An earlier version of this policy described the service as end-to-end encrypted; that description was inaccurate and has been corrected.

How long we keep it

We keep your consultation records for as long as your account is open, and afterwards for as long as we are required to retain medical records.

Backups are kept as a rolling set of the most recent 14 daily snapshots. Deleted data disappears from backups as those snapshots age out.

Deleting your data

You can delete your account at any time from Profile → Delete Account in the app. This permanently erases your account, consultations, messages, uploaded photographs and video, and notification records. You can also ask us at info@eips.com.

Some records may be retained where we are legally required to keep them.

Your rights

You have the right to access your data, correct it, have it erased, restrict or object to how we use it, and receive a copy in a portable format. Where we rely on your consent, you may withdraw it at any time.

To exercise any of these, contact info@eips.com.

If you believe we have handled your data improperly, you may complain to the Office of the Commissioner for Personal Data Protection (Cyprus), or to the supervisory authority where you live.

Children

The service is intended for adults aged 18 or over. We do not knowingly provide consultations to children.

Changes

If we change how we handle your data we will update this page and change the date above.