Privacy & Data Protection Policy

Our website is committed to protecting the personal data of its visitors and patients, in accordance with the General Data Protection Regulation (GDPR) and applicable legislation.

Collection and Use of Data

Personal data may be collected when you contact the medical practice, use forms or digital services on the website, request information, or schedule appointments.

Depending on the case, this may include identification and contact details, appointment-related information, and health data necessary for providing medical services.

Data is used for:

• Communication and appointment management.
• Providing medical services.
• Maintaining medical records.
• Fulfilling legal and professional obligations.
• Security and proper operation of the website and practice services.
• Sending updates on practice activities, only with required consent.

Processing is based, as applicable, on providing the requested service, fulfilling legal obligations, providing healthcare services, legitimate interest in security and service operation, or user consent.

Medical Confidentiality & Record Keeping

The physician is bound by medical confidentiality and implements appropriate technical and organizational measures for data protection.

According to Article 14 of Law 3418/2005, keeping a medical record is mandatory. In private practices, records are retained for ten years from the last visit.

Digital Services

The website may provide a digital assistant solely for general information regarding the practice and its services. The digital assistant does not perform diagnoses, psychiatric evaluations, or treatment proposals. Please do not enter emergencies or highly sensitive personal and medical data.

For information and appointment management via the Digital Secretary, a specific supplementary policy applies:

Read the Digital Secretary Privacy Policy →

Technical Providers & Recipients

Access to data may be granted to the physician, specially authorized personnel, and necessary technical providers of hosting, security, communication, automation, and appointment management services.

These providers process data only to the extent necessary to provide their services and in compliance with applicable data protection obligations.

When data transfer outside the European Economic Area is required, legal safeguards under GDPR are applied.

Analytics & Cookies

The website uses Google Analytics and the Google tag to collect traffic statistics and measure performance. Google Advanced Consent Mode v2 is applied: prior to your consent, no Analytics or advertising cookies are stored on your device, and only limited cookieless measurement signals are sent. Upon consent, full measurement cookie storage is enabled. Ad personalization remains permanently disabled.

You can manage or delete cookies through your browser settings.

Retention Periods

Personal data is retained only as long as necessary for the purpose collected or required by law.

Temporary communication data and technical logs are deleted when no longer necessary. Data forming part of the medical record is retained for the statutory ten-year period from the last visit.

Your Rights

Subject to legal conditions, you have the right to:

• Access your data.
• Correct inaccurate or incomplete data.
• Deletion (Right to be forgotten).
• Restrict processing.
• Data portability, where applicable.
• Object to processing.
• Withdraw consent, when processing is based on it.

The right to deletion is not absolute. Data retained due to legal obligation (such as medical records) cannot be deleted before the end of the mandatory retention period.

To exercise your rights, contact contact@drgkikas.com. Identity verification may be requested for data protection.

Policy Updates

This policy may be updated when practice services, technologies, or legal frameworks change. The current version and last update date will be available on this page.