Privacy Policy

1. Who is responsible for your data

The data controller is Dr Menelaos N. Zoulamoglou, MD, MSc, General Surgeon, practising as a self-employed physician.

• Offices: 106 Pentelis Ave, 15235 Vrilissia · 4 Athanasiadou St, Ampelokipi, Athens · 15 Oidipodos St, Thebes
• Email: info@advancedsurgery.gr
• Phone: +30 210 810 44 30

As a physician I am bound by medical confidentiality under Greek Law 3418/2005 (Code of Medical Ethics), an obligation that applies alongside and in addition to data protection law.

2. What data is collected

2.1 When you complete the appointment form

The contact page collects:

• First and last name
• Phone number and email address
• Preferred office
• Reason for contact (e.g. assessment, surgical planning, post-operative follow-up)
• The free-text content of your message

The message field and the reason for contact may contain health data, which falls under the special categories of Article 9 GDPR and receives enhanced protection. Please do not send more medical detail through the form than is needed for us to understand your request — full histories and test results are best discussed in person.

The form is not intended for emergencies. In an emergency call 166 or go to your nearest emergency department.

2.2 When you contact us by email or phone

Your contact details and the content of the correspondence are retained to the extent needed to answer your request.

2.3 Data collected automatically

• Server logs: the hosting provider records IP address, browser type, date and time, for security and technical operation.
• Cookies and local storage: see section 4.

The site does not create user accounts, does not profile visitors and does not make automated decisions about you.

3. Why we process your data and on what legal basis

Purpose	Legal basis
Responding to an appointment request or enquiry	Article 6(1)(b) GDPR — steps prior to entering into a contract for medical services
Processing health data to assess and provide medical care	Article 9(2)(h) GDPR — provision of health care by a health professional subject to the obligation of professional secrecy
Keeping a medical record for patients who attend	Article 6(1)(c) GDPR — legal obligation (Code of Medical Ethics)
Website security and technical operation	Article 6(1)(f) GDPR — legitimate interest in protecting the site
Traffic statistics (Google Analytics)	Article 6(1)(a) GDPR — consent, which you may withdraw at any time

4. Cookies and local storage

A choice banner appears on your first visit. No statistics cookies are activated before you consent.

Name	Purpose	Duration
as_cookie_consent	Stores your cookie choice (browser local storage, never transmitted). Necessary.	Until you delete it
_ga, _ga_*	Google Analytics 4 — aggregate, anonymous visit statistics with IP anonymisation. Optional.	Up to 2 years

You can change or withdraw your choice at any time by clearing this site's cookies in your browser settings, or by emailing us.

5. Who else has access

Your data is never sold, rented or shared for advertising purposes. The following providers are used, each as a processor or as an independent controller for its own role:

Provider	Role	Location
Hostinger	Website and email hosting	EU
Formspree	Delivery of appointment form messages	USA
Google Analytics	Traffic statistics (consent only)	USA / EU
Google Fonts	Font delivery; receives your IP address	USA / EU
Google Maps	Maps on the contact page; receives your IP address	USA / EU

Data may also be shared with a hospital or collaborating physicians only where required for your care and with your knowledge, and with public authorities where the law requires it.

Transfers outside the European Economic Area

Some of the providers above are based in the USA. Such transfers rely on the safeguards set out in Chapter V GDPR, such as standard contractual clauses or an adequacy decision. If you prefer to avoid transmitting your details through the form, you are welcome to contact us by phone or by direct email.

6. How long data is kept

• Enquiries that did not lead to a visit: up to 12 months from the last contact.
• Patient medical records: for as long as medical legislation requires, at minimum ten (10) years from the last visit, under the Code of Medical Ethics.
• Server logs: a short period, per the hosting provider's policy.
• Google Analytics data: per the account's retention setting; cookies expire within 2 years at the latest.

7. Your rights

Under the GDPR you have the right to:

• Access — find out what data we hold about you and receive a copy
• Rectification — ask for inaccurate details to be corrected
• Erasure — subject to legal obligations to retain medical records
• Restriction of processing
• Portability — receive your data in a structured, commonly used format
• Object to processing based on legitimate interest
• Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand

To exercise any right, email info@advancedsurgery.gr. We respond within one month. We may ask you to confirm your identity, so that medical data is never disclosed to the wrong person.

8. Security

The site runs exclusively over an encrypted HTTPS connection. Technical and organisational measures are in place to protect data against loss, misuse or unauthorised access. No transmission over the internet is entirely secure, which is why we recommend not sending sensitive medical detail through the form beyond what is strictly necessary.

9. Minors

This site is intended for adults. Requests concerning a minor should be submitted by a parent or legal guardian.

10. Links to other websites

The site links to third parties (scientific societies, social media). This policy does not cover their practices; please consult their own privacy policies.

11. Changes to this policy

This policy may be updated. The version in force is published on this page, with the date of last update shown at the top.

12. Lodging a complaint

If you believe your data is being processed unlawfully, please contact us first. You also have the right to lodge a complaint with the supervisory authority: