Privacy Policy

Since 25 May 2018, the processing of personal data in European Union Member States has been governed by Regulation (EU) 2016/679 (GDPR). This policy describes the main categories of data processed by the clinic, the purposes and legal grounds of processing, retention periods and the rights of data subjects.

Andreas Moutsoudis clinic provides plastic, reconstructive and aesthetic surgery services and may process both ordinary personal data and special-category data, such as medical-record information and photographs, where necessary for the provision of services and the operation of the clinic.

I. Personal data controller

The clinic is located at 3 Kouskoura Street, Thessaloniki, Greece, and can be contacted by telephone at +30 2312 311 350. It is legally represented by Andreas Moutsoudis.

II. Categories of data subjects

The clinic may collect necessary data relating to:

• patients and prospective patients,
• job applicants and current employees,
• external associates, other collaborators and suppliers.

III. Data we process

A. Patients

Depending on the circumstances, this may include name, identity-card or passport details, address, contact details, tax information and payment details. Special categories may include medical records and photographs where required.

B. Job applicants and employees

This may include identity details, address, education and qualifications, family status, contact details, tax and social-security information and bank-account details. The original V1 policy also refers to photographs as special-category data.

C. External associates

This may include identity details, address or place of work, education and qualifications, contact details, tax information and bank-account details.

IV. Sources of data

As a general rule, the data is collected directly from the data subjects.

V. Purposes of processing

A. Patients

• communication and appointment scheduling,
• entering into, performing or ending a medical-services agreement,
• creating and maintaining records or registers,
• managing payments and tax documents,
• communication where necessary,
• establishing, exercising or defending legal claims,
• sending informational communications where the required legal basis exists.

B. Job applicants and employees

• assessing qualifications and possible recruitment,
• communication and record keeping,
• compliance with legal obligations,
• organisational communications and, where applicable, publication through digital media.

C. External associates

• considering and managing a professional relationship,
• entering into, performing or ending a service agreement,
• record keeping and payment management,
• communication, legal claims and legal compliance,
• organisational communications and, where applicable, publication through digital media.

VI–VII. Circumstances and lawfulness of processing

Depending on the circumstances, processing may be based on:

• the data subject’s consent,
• performance of a contract or steps taken before entering into a contract,
• compliance with legal and tax obligations,
• protection of vital interests, particularly in relation to health and safety,
• performance of a task carried out in the public interest, where applicable,
• legitimate interests connected with the proper operation of the clinic,
• establishing, exercising or defending legal claims,
• obligations in employment, social-security and social-protection law.

VIII. Retention period

Requests submitted through the contact form and related replies are retained for as long as necessary to manage and document the communication, taking into account any pending requests or legal claims. They are not currently subject to automated deletion after a predefined two-year period. Medical records, photographs and other patient data are subject to separate retention requirements, determined according to the category of data, the purpose of processing and any applicable legal, tax or medical obligation.

IX. Cookies and similar technologies

The website uses cookies and similar technologies for its essential operation and security. Optional audience-measurement cookies are activated only after the visitor makes an explicit choice. We do not use cookies for advertising tracking, personalised advertising or Google Ads conversions.

Necessary cookies

Necessary cookies support website operation, session management, security, contact-form submission and storage of privacy choices.

• drmoutsoudis_v2_session: used for session management and security functions and retained until the browser is closed.
• drm_cookie_consent: stores the consent-policy version and the visitor’s Analytics acceptance or rejection choice. It is retained for six months and contains no name, contact details, message content or health information.
• analytics_exclude: a special Analytics exclusion preference for the specific browser, when enabled through the protected mechanism, retained for up to one year.

Analytics cookies

With prior consent, we use Google Analytics 4 to understand website usage and page performance. The service may process information such as the page visited, device and browser information, session statistics, navigation interactions and approximate geographical location.

• _ga: may be used to distinguish users.
• _ga_<container-id>: may be used to persist session state.

Under the current configuration, the _ga and _ga_<container-id> cookies use the default Google Analytics 4 duration of up to two (2) years. Their actual duration may vary depending on the browser and may be renewed during visits. We do not send names, email addresses, telephone numbers, message content or health information to Google Analytics. An accepted contact-form submission may be recorded only as a general statistical event and only where Analytics consent was granted beforehand.

Consent management and withdrawal

Analytics remains inactive on the first visit. Visitors may accept or reject Analytics without affecting access to the website or operation of the contact form. The choice can be changed or withdrawn at any time using the “Cookie settings” control in the footer. Withdrawal stops future optional measurement and attempts to remove the relevant first-party Analytics cookies from that browser.

IXA. reCAPTCHA Enterprise and external content

The contact form is protected by Google reCAPTCHA Enterprise to prevent malicious, automated or abusive submissions. For risk assessment, technical information may be submitted to the service, including a security token, IP address, browser or device information, user agent, hostname and the technical action being assessed. Message content, names, email addresses, telephone numbers and health information are not included in the server-side reCAPTCHA assessment implemented by the website.

reCAPTCHA may use the _GRECAPTCHA cookie for its risk-analysis service. Its classification as a necessary security service, exact duration and related transfer information are subject to final legal verification.

Some pages include YouTube videos in privacy-enhanced mode and YouTube preview images, while the site also loads the Font Awesome Kit as an external technical resource for displaying icons. With the current implementation, requests to these providers may occur before a consent choice and may disclose technical information such as the visitor’s IP address and browser information. The need for separate consent and the final technical treatment must be confirmed before production activation of the new mechanism.

X. Disclosure and transfer of personal data

Staff members and associates who process data are subject to confidentiality obligations. Data may be disclosed to public services, tax or social-security authorities and other bodies where required by law.

Patient data may, to the extent necessary, be disclosed to cooperating physicians, medical staff, laboratories or clinics for diagnosis, prevention or treatment, following the required information and consent where applicable.

Information may also be disclosed where required by law, a court order or another binding procedure.

XI. Personal data protection procedures

The clinic applies organisational and technical measures to limit unauthorised access and data breaches. Access is provided only to authorised staff within the scope of their duties.

The website uses an encrypted HTTPS connection for data transmission.

Despite these measures, the nature of the internet does not permit an absolute guarantee against every malicious or unauthorised access attempt.

XII. Data-subject rights

You may submit a request to the controller by email at info@drmoutsoudis.gr or in writing at the clinic’s address. Subject to the conditions of the GDPR, your rights may include:

1. access to and review of your personal data,
2. rectification of inaccurate data,
3. withdrawal of consent where processing is based on consent,
4. erasure where the legal requirements are met,
5. restriction of processing,
6. data portability,
7. objection to processing in the cases provided by the GDPR,
8. lodging a complaint with the competent supervisory authority.

These rights apply subject to any legal or contractual obligations requiring specific processing or retention to continue.

XIII. Processors

The clinic may engage other legal or natural persons to provide services requiring personal-data processing, subject to the applicable contractual and legal obligations.

XIV. Changes to this Privacy Policy

The clinic may update this Privacy Policy. The version in force is published on the website, and visitors are encouraged to review it periodically.

The Privacy Policy is clinic content and all relevant rights are reserved.

Last Updated: 12 October 2026