Privacy Policy

1. Data Controller

2. Data We Collect

Through website forms (appointment, contact, newsletter):

• Parent/guardian name, email address, phone number
• Child's name, date of birth (optional), reason for visit
• Email address for newsletter subscription
• Message content from contact form inquiries

During medical consultations:

• Medical history, examination findings, and laboratory test results
• Diagnoses, treatment plans, and prescribed medications
• Vaccination records and growth charts
• Billing details and insurance information

Automatically collected:

• Anonymized usage data via Google Analytics (only after cookie consent)
• Essential cookies: session identifier, CSRF protection token

3. Legal Basis for Processing

We process your data based on the following legal grounds under GDPR Articles 6 and 9:

• Contract (Art. 6(1)(b)): Appointment scheduling, service delivery, billing
• Legal obligation (Art. 6(1)(c)): Medical record keeping per Greek Law 3418/2005, tax and insurance documentation
• Vital interests (Art. 6(1)(d)): Emergency medical situations
• Consent (Art. 6(1)(a)): Newsletter subscription, analytics cookies, Google Maps loading
• Healthcare provision (Art. 9(2)(h)): Processing of health data for medical diagnosis, treatment, and care management

4. How We Use Your Data

For Treatment Purposes: We use your child's health data to provide medical care, coordinate with other specialists, and ensure continuity of care.

For Financial Purposes: We use data for billing and payment collection, including submitting claims to insurance companies.

For Operational Purposes: We may use data for quality improvement, staff training, and operational needs that support patient care.

For Communication: Appointment confirmations, reminders, and medical notifications via email.

Other Permitted Uses: We may use or disclose data without your consent for public health activities, reporting abuse or neglect, compliance with legal requirements, or in emergency situations.

5. Data Retention Periods

We retain your data for the following periods, after which it is securely deleted or anonymized:

6. Third-Party Processors

We use the following third-party service providers to operate this website and our practice. Each operates under a Data Processing Agreement:

• Google Analytics (Google LLC): Website traffic analysis (loaded only after consent)
• Google Maps (Google LLC): Map display on contact page (loaded only after consent or click)
• Amazon Web Services (AWS), eu-north-1: Media file storage (S3 bucket in Stockholm)
• SMTP2GO (SMTPeter B.V.): Transactional email delivery (appointment confirmations, notifications)
• DigitalOcean / Laravel Forge: Website hosting infrastructure

7. International Data Transfers

Some of our processors transfer data outside the European Economic Area:

• Google (USA): Covered by the EU-US Data Privacy Framework
• AWS (Stockholm region): Data stored within the EU. AWS is also certified under the EU-US Data Privacy Framework for any support access.
• SMTP2GO (New Zealand): New Zealand has an EU adequacy decision (Commission Decision 2013/65/EU)

8. Cookies & Tracking

Essential cookies (always active):

• Session cookie: identifies your browsing session (expires on close)
• CSRF token: protects form submissions against cross-site attacks
• Cookie consent preference: stored in your browser for 6 months

Analytics cookies (require consent):

• Google Analytics (GA4): anonymized pageview and interaction data. Loaded only after you click "Accept" in the cookie banner.

Third-party embeds (require consent or click):

• Google Maps: displayed on the contact page only after you click "Load Map" or have accepted analytics cookies
• Google Fonts (Inter): self-hosted on our server, no data sent to Google

You can change your cookie preferences at any time via the "Cookie Settings" link in the footer.

9. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right of Access: You have the right to request access to and copies of your child's medical records. We will respond within 30 days.

Right to Rectification: If you believe any information in your child's record is inaccurate or incomplete, you may request correction.

Right to Erasure: You may request deletion of your data, unless there is a legal obligation to retain it (e.g., medical records under Greek law).

Right to Restriction of Processing: You may request restriction of processing of your data under certain conditions.

Right to Data Portability: You may request transfer of your data to another healthcare provider.

Right to Object: You may object to the processing of your data for specific purposes.

Right to Withdraw Consent: Where processing is based on consent (newsletter, cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us using the details in Section 1. We will respond within 30 days.

10. Security Measures

We maintain physical, electronic, and procedural security measures to protect health data:

• Secure electronic medical records with passwords and encryption
• Restricted data access based on responsibilities
• Regular staff training on security matters
• Secure storage and destruction of physical records
• Confidentiality agreements with partners who handle data
• HTTPS encryption on all website pages
• Database encryption at rest

11. Children's Data

As a pediatric practice, we routinely process children's data. All data concerning children is provided by and with the consent of a parent or legal guardian. Under Greek law (implementing GDPR Art. 8), the age of digital consent is 15. For children under 15, parental consent is required for any online data collection.

By booking an appointment or submitting a form that includes your child's information, you confirm that you are the parent or legal guardian and consent to the processing of your child's data as described in this policy.

12. Supervisory Authority

You have the right to file a complaint with the Hellenic Data Protection Authority (HDPA) if you believe your data protection rights have been violated. Filing a complaint will not affect the care provided at our practice.

13. Changes to This Policy

We reserve the right to modify this privacy policy. Changes will be posted at our practice and on our website with an updated "Last Updated" date. The current version always applies to all data we maintain. For material changes, we will display a notice on the website.

By using the services of Dr. Doxa Kotzia's practice, you acknowledge that you have read this Privacy Policy and understand how your child's health data may be used and disclosed.