Notice Regarding the Processing of Personal Data

1. Introduction

The company “Athens Medical S.A.” (hereinafter the “Company”) respects the privacy of natural persons and takes the need to protect their personal data very seriously. This information text provides every person interested in receiving medical services at any clinic of the Company and every visitor/user of the Company’s websites with concise and transparent information regarding the practices followed for the management and protection of personal data.

2. Purpose of the Policy

What is the purpose of this Policy? The purpose of this Policy is to provide information on how the personal data of the Company’s customers are collected, stored, used and transferred, the security measures taken by the Company to protect personal data, the reasons for and the period during which they are stored, as well as the type of personal data collected. It concerns every operation or set of operations performed, with or without the use of automated means, on personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction. The Company unilaterally reserves the right to update, amend, add to or modify its services and this Policy from time to time, whenever it deems this necessary, without prior notice, always within the applicable legal framework and in accordance with any changes to the applicable legislation on personal data protection. The Company encourages every interested party to review this Policy at regular intervals in order to stay informed about any changes that have been made.

3. Data Controller

Who is the Data Controller of your personal data? The company under the name “ΙΑΤΡΙΚΟ ΑΘΗΝΩΝ ΕΜΠΟΡΙΚΗ ΑΝΩΝΥΜΟΣ ΕΤΑΙΡΕΙΑ” and distinctive title “ΙΑΤΡΙΚΟ ΑΘΗΝΩΝ Ε.Α.Ε.”, with registered office at 5-7 Distomou Street, P.C. 151 25, Marousi, Tax Identification Number: 094129169, belongs to KEFODE ATTIKIS and has received G.E.MI. No. 000356301000, shall be the Data Controller of your data, in accordance with the applicable legislation (hereinafter the “Company”). The Company collects, processes and stores your personal data in accordance with General Regulation (EU) 2026/679, Law 4624/2019, as well as any other applicable legislation on personal data, the Code of Medical Ethics and the Guidelines and Decisions of the Hellenic Data Protection Authority. Our medical services are provided through the following facilities:

• ATHENS MEDICAL CENTER
• INTERBALKAN MEDICAL CENTER OF THESSALONIKI
• PALAIO FALIRO MEDICAL CENTER
• PSYCHIKO MEDICAL CENTER
• PERISTERI MEDICAL CENTER
• DAFNI MEDICAL CENTER

4. Definition of Personal Data

What is personal data? Personal data is any information relating to a specific natural person or a person whose identity can be established (e.g. name, identity card number, address, etc.). Data relating to health (physical or mental condition, receipt of medical services, etc.) are included within the general term personal data, but constitute a special category of data. The Company will not process your personal data without your consent. However, the Company reserves the right, in exceptional cases, to process your personal information to the extent permitted or required by law and/or by court decisions or prosecutorial orders/provisions.

5. Methods of Data Collection

How is personal data collected? Your personal data is collected in the following ways:

1. You provide it to us when entering Reception or other patient service points, when the Company provides medical services to you or to a person whom you lawfully accompany, when you contact us in order for you or a third party to receive medical services, when you submit a job application to the Company, when you complete electronic forms or send electronic mail (“e-mail”), in order to obtain information about or use the services available on the following websites of the Company (“Websites”):
   • www.iatriko.gr\](http://www.iatriko.gr%22>www.iatriko.gr\)
   • www.paidiatriko.gr\](http://www.paidiatriko.gr%22>www.paidiatriko.gr\)
   • www.medsana.ro\](http://www.medsana.ro%22>www.medsana.ro\)
   • www.athensmedicalgroup.com\](http://www.athensmedicalgroup.com%22>www.athensmedicalgroup.com\)
2. Automatically through the browser or mobile device you use to access the Websites.
3. It is provided to us by a third-party partner after you have given your consent (e.g. an insurance company, if you are a customer of an insurance company with which the Company has entered into a cooperation agreement for the coverage of your medical expenses).
4. With regard specifically to health data, the Company may collect it through third-party healthcare providers, such as Diagnostic Centers, physicians, hospitals and private clinics.

When registering for a service provided by the above websites, you will need to complete certain fields, as well as select a username and password. In cases where your consent is required for the collection of your personal data, such as for receiving a newsletter on a regular basis, it is explicitly requested from you and you have the right to withdraw it at any time.

6. Categories of Personal Data

What personal data is collected? In summary, the personal data collected and further processed includes:

1. Your name, address and, more generally, contact details (including e-mail address and telephone number), as well as those of your relatives.
2. Health data relating to medical or nursing services provided by the Company or health data regarding medical services that were not provided by us but were communicated to us either by you or by third parties.
3. Information you provide to us for payment of your medical expenses, such as bank card information.
4. Other information resulting from the use of websites and other digital platforms that we use for the purpose of informing you, regarding the following services provided by the Company through its websites and/or your registration for one or more of them:
   • Receiving a newsletter on a regular basis.
   • Receiving electronic correspondence or correspondence containing announcements/news.
   • Receiving periodical publications in electronic form on a regular basis (“IATRIKOS KOSMOS” magazine).
   • Management of your medical record, provided that you have received services from the Group.
   • Recording health data and receiving information.
   • Submission of enquiries regarding services related to Medical Tourism.
   • Image data that we collect when you enter our buildings through the operation of closed-circuit security cameras (CCTV), in accordance with the provisions of the applicable legislation.

In addition to the above data that you provide to the Group, technical information constituting personal data may also be collected, such as, for example, the Internet Protocol address of your device [e.g. desktop computer, laptop, tablet, smartphone]. This technical information is used for the proper operation and performance of the websites and electronic services and is not permanently stored in the Group’s infrastructure. Further details regarding the technologies used on the Group’s websites (“cookies”, “internet tags”, etc.) are provided in the Company’s Personal Data Protection Policy (see Chapter 15 below).

7. Data Processing Principles

Which principles govern the processing of personal data by the Company? The Company processes your personal data fairly and lawfully for clearly defined purposes referred to in this Policy. Your personal data processed by the Company is limited to what is strictly necessary for achieving these purposes, is accurate and up to date, is retained for a period determined by the purposes of processing, is protected by adequate security measures and is not transferred to countries that do not ensure a satisfactory level of protection.

8. Purposes and Legal Basis of Processing

For what purposes is your personal data collected and what is the legal basis?

• Personal data (ordinary and health data) is collected and processed by the Company’s personnel, physicians and employees authorised according to service, for the purpose of providing healthcare services to you, including diagnosis, treatment and medical visits.Your data forms part of the patient medical record created for the purpose of providing you with medical diagnosis, assessment and treatment services, healthcare provision and clinical exchange of information in accordance with the provisions of Law 3418/2005.The legal basis for this specific processing is the Provision of Healthcare Services in accordance with General Regulation (EU) 2016/679 and Law 4624/2029.Your data will be subject to automated and non-automated processing by authorised personnel where strictly necessary within the context of scientific research or for statistical purposes. The legal basis in this case is the purpose of scientific research or statistical purposes in accordance with Article 9 para. 2 point i of (EU) 2016/679.
• Personal data (ordinary and health data) is collected and processed by the Company’s personnel for the coverage of your hospitalisation expenses by the Social Security Body (e.g. EOPYY), in accordance with social security legislation, or by your private insurance company, in accordance with the terms of your insurance contract, after having first obtained your explicit consent for the transfer of your data for this purpose.Consequently, the legal basis for this processing is your prior explicit consent. In the event that you do not wish this transfer to take place, we inform you that you are obliged to pay the Company the full amount of the medical expenses and subsequently seek reimbursement from your social security body or private insurance company by submitting the appropriate supporting documents.
• Your personal data (ordinary and health data) is collected and processed for the purposes of any protection of the Company’s legitimate interests, such as the establishment, exercise, defence and support of legal claims of any kind. Consequently, the legal basis is the legitimate interest of the Company.
• Personal data (ordinary and health data) is collected and processed for the Company’s compliance with obligations arising from the applicable legislation, such as, for example, tax legislation, or for satisfying requests from public Authorities (e.g. Police, Judicial Authorities). Consequently, the legal basis is the Company’s compliance with legal obligations.
• Personal data (ordinary data) may be processed by the Company for conducting patient/customer satisfaction surveys regarding the quality of the Company’s services, which are always optional.In this case, the legal basis for processing is the fulfilment of the Company’s legitimate interest in continuously improving its services.

9. Data Transfer

To whom is your personal data transferred?

• Your data is transferred to our Departments and to nursing, medical and administrative personnel responsible for providing our services to you.
• Your data is transferred, following your consent, to cooperating third parties (e.g. another physician of your choice) / businesses cooperating with the Company (e.g. insurance companies with which you have entered into a contract for the purpose of covering your medical expenses), as well as to Social Security Bodies and Insurance Funds.
• Our Company may transfer your data, where necessary, to third-party legal entities, specialised external Diagnostic Centers for carrying out specialised diagnostic/medical examinations, with which our Company cooperates for the provision of its medical services to you, as well as to suppliers responsible for the maintenance of medical technology equipment, suppliers of Special Medical Materials, external collaborating Physicians, Software and Application providers, archival storage companies, as well as website management companies and companies conducting customer satisfaction surveys, which are bound by confidentiality obligations, where they are required to have access within the context of providing such services (e.g. physicians for diagnostic purposes) and with whom we enter into contracts containing specific agreements for the safeguarding and protection of personal data.

Such third parties have contractually undertaken towards the Group to use personal data only for the above purposes and not to transfer personal information to third parties or disclose it to third parties, unless required by law.

10. Transfer Outside the EU

Do you transfer my data to countries outside the EU? No transfer takes place to countries outside the E.U./E.E.A., except in very rare cases where required by law, a court decision/order, an administrative act, or where necessary within the context of diagnosis/treatment or following the relevant explicit authorisation of the patient, with all adequate safeguards, contractual clauses and technical measures for secure transfer provided for by legislation being applied in order to address potential risks associated with such transfers.

11. Data Retention Period

For how long is my personal data retained? Your personal data is retained in our records for as long as provided for under the applicable national legislation and, more specifically, according to Law 3418/2005, it is stipulated that we are obliged to retain your data for 10 to 20 years from each admission or visit, depending on the primary or secondary healthcare medical services we provide, and for at least 30 years for data related to blood donation. In addition, other legislation may provide for different retention periods for your personal data, depending on the nature of the medical procedure. We will also retain your data for as long as required until the limitation period for any claims of our Company has expired. Finally, closed-circuit television (CCTV) recording data is retained for 15 days and is then permanently deleted.

12. Rights of Data Subjects

What are my rights? What can I do if I have an issue with the processing of my personal data? You have the right at any time to ask us what personal data of yours we process, for what purposes we do so, whether we provide it to third parties and to whom, as well as other related information. You also have the right to receive a free copy of your personal data upon request, in accordance with the procedure communicated to you each time in connection with your request. Other rights that you have under the relevant personal data protection legislation include the right to request the updating and/or rectification of your data, access to it, cessation and/or restriction of its processing and its deletion from the Company’s systems, provided that there is no other legal obligation requiring its retention. You also retain the right to data portability and/or to object to the processing of your personal data. More specifically, with regard to the newsletter service, you have the option to unsubscribe by following the instructions contained in each newsletter, so that the processing of personal data associated with this service is discontinued. You may exercise all the above rights by submitting a written request to [dpo@iatriko.gr](mailto:dpo@iatriko.gr). In any event, you have the right to contact the competent Hellenic Data Protection Authority (HDPA, www.dpa.gr\) and/or to seek judicial remedy. Each request submitted must be accompanied by appropriate identification documents and the required information must be provided (e.g. the data requiring rectification), as described in the terms of use of the respective service. The Company may request the provision of additional information necessary to confirm your identity. The Company makes every possible effort to ensure that your requests are answered without delay and, in any event, within one month of their receipt. This deadline may be extended by a further two (2) months, where required, taking into account the complexity of the request and the number of requests. You will be informed of such extension and the reasons for the delay within one month of receipt of the request by the Company. If you submit the request electronically, the response will be provided to you, where possible, by electronic means, unless you request otherwise (e.g. a written letter). In any event, you may contact the Group’s Data Protection Officer, the Hellenic Data Protection Authority (HDPA) and/or seek judicial remedy if you consider that your above rights have been infringed.

13. Data Security

Is my data secure? The Company considers the privacy of persons whose personal data it processes, whether customers, employees or third parties, to be of the utmost importance and makes every possible effort to protect it, both with regard to the confidentiality/secrecy of the information and with regard to its integrity (so that it is not altered, accidentally destroyed, etc.). Within this framework, the Company implements an Information Security Management System, which follows the best practices of the international ISO 27001 standard. The Company takes all appropriate organisational and technical measures designed to protect information against loss, misuse, unauthorised access, disclosure, distortion or destruction and ensures the fair and lawful collection and processing of personal data as well as its secure retention in accordance with the relevant provisions of Greek, European Union and international law regarding the protection of individuals from the processing of personal data, as well as the decisions of the Hellenic Data Protection Authority, safeguarding the secrecy and confidentiality of any information that comes to its knowledge. More specifically, this Policy fully takes into account the provisions and articles of Regulation (EU) 2016/679 of the European Parliament on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“General Data Protection Regulation” – “GDPR”) and continuously makes every possible effort to comply with it. Access to the contact details of visitors/users of the Company’s Websites is restricted to authorised persons who are bound by confidentiality obligations (employees, service providers) and who are reasonably considered to need to know this information in order to provide products or services to visitors/users of the Websites or to perform their work. The Company expressly prohibits, within the Company’s workplaces, the use by personnel and associates of photographic cameras, video cameras, as well as the use of the photography and video recording functions of mobile phones.

14. Data on the Websites

How is my personal data collected and used on the Websites? Personal data is collected on the Company’s Websites in the following cases:

• When you request information about the healthcare services provided by the Company through the Websites.
• When you register and request to receive electronic correspondence or correspondence containing Company announcements/news.
• When you register for and use the services of the Company’s Websites.
• When you register and request to receive the Company’s periodical publications in electronic form on a regular basis (“IATRIKOS KOSMOS” magazine).
• When you voluntarily participate in the Company’s healthcare services and health programmes.
• Through the use of “Cookies” or similar technologies (see the next question below for further details).

The personal data collected in each case includes, indicatively, the following:

• Receiving a newsletter on a regular basis: e-mail address.
• Management of the medical records of patients who have received healthcare services from the Company: all personal data included in the medical record, including health data, medical examination results, physicians’ reports, financial data, etc.
• Recording health data and receiving information: medical history details, contact details [e-mail address, postal address, telephone number, etc.].
• Submission of enquiries regarding healthcare services related to Medical Tourism: full name, age, health data/medical history, contact details [e-mail address, postal address, telephone number, etc.].
• Monitoring the proper operation and improving the functionality and performance of the websites: Internet Protocol address, website browsing patterns, information regarding the use of a website, browser history, geolocation data, HTTP protocol data, etc. This data is retained in aggregate form so that, to the extent possible, users cannot be identified.

The collection and processing of personal data is carried out solely and exclusively for:

• the provision of personalised information and services,
• the provision of healthcare services in accordance with the user’s preferences and characteristics,
• the statistical analysis of traffic and use of the Group’s websites,
• meeting users’ requirements as well as direct communication for the purpose of providing information about the Group’s new healthcare services (provided that users have given their consent).

Further transfer to cooperating third-party organisations will take place following a request by the visitors/users themselves. The user’s consent is explicitly requested, after they have been informed of the purposes and legal basis for the use of personal data, and constitutes an essential prerequisite for any processing or transfer of the user’s personal data.

15. Cookies and Internet Tags

What are Cookies & internet tags? Cookies are small text files containing information that is stored in the browser of the visitor’s/user’s computer while browsing the Website and can be removed at any time. The Company’s Websites use cookies for the following purposes:

• For the proper operation of the Websites, at the required speed.
• To identify the device you use to browse the Websites, the browser and/or operating system you use, for the purpose of providing a personalised browsing and/or usage experience on the Company’s Websites.
• To store your settings during a visit or between visits (such as, for example, the username you have provided, your preferred language or the use of social media), so that you do not have to re-enter certain data.
• To improve the performance and/or security of the Websites.
• To provide content based on your interests and needs.
• To analyse the way in which you browse and/or use the Websites.

The Company DOES NOT use cookies in the following cases:

• To collect personal data without your consent.
• To transfer your data to advertising companies.
• To transfer your data to third parties without your consent.

The types of cookies used by the Company’s Websites are “persistent cookies” and “session cookies”. In addition, certain third-party services enabled on the Websites, such as “social media buttons”, place their own cookies on your computer, over which the administrators of the Company’s Websites have no control. The session cookies used by the Company’s Websites are deleted after you finish browsing and/or after closing the browser. Persistent cookies remain on your computer or other device until you delete them or until the period predetermined in the cookie expires. You may configure the browser you use in such a way that it either warns you about the use of cookies in specific Website services or does not permit the acceptance of cookies under any circumstances. More information regarding the general use of cookies as well as methods for blocking or restricting them can be found on the websites: http://cookiepedia.co.uk/all-about-cookies\ http://www.allaboutcookies.org/\ You may also delete cookies from the computer or device you use whenever you wish. However, please note that if cookies, or some of them, are not accepted, certain features of a website may not be fully available. The Company’s Websites also use “internet tags”. This method is used to measure visitors’ response to the Websites. The Company confirms that, through “internet tags” and cookies, NO personal, identifiable information about website visitors, such as names, addresses, e-mail addresses or telephone numbers, is collected or sought.

16. Children’s Data

What applies on the Company’s Websites regarding children’s personal data? The Company undertakes not to process personal data from visitors/users of its Websites under the age of sixteen (16) without having first obtained the consent of the person who has parental responsibility for the child (their parent or guardian), through direct communication, offline or via the internet.

17. Links to Third-Party Websites

What applies regarding links to other websites? The Company’s Websites may contain references through hyperlinks to other websites, for whose content and services the Company bears no responsibility, nor does it guarantee their continuous and secure accessibility. Under no circumstances should the Company be considered to accept or adopt the content or services of the websites to which the hyperlinks lead or to be associated with them in any way. For any issue that may arise during the use of the above websites, the respective owner of that website is solely responsible. In the case of hyperlinks to other websites, the Company is not responsible for the terms followed by those websites regarding the management and protection of personal data. We use social media to present the Company’s work and services through widely used and modern channels. The Company’s use of social media is specifically indicated on our Websites. For example, you can watch informative videos by healthcare professionals working at our Company’s clinics, which we upload to our personal page on “YouTube”, and follow (from our Websites) our links on Twitter and LinkedIn. The Company strongly encourages users to consult the respective policy of each third-party organisation (e.g. search engine service providers, social media service providers such as Facebook, LinkedIn, Twitter, etc.) in order to be informed about the practices they follow for the purpose of protecting their personal data. The Company’s Websites may contain displayed material with advertising/informational content, purpose and character. The Company bears no responsibility towards the visitor/user, or any third party, for any unlawful act or omission, inaccuracy or failure to comply with the laws and regulations of any country or of the European Union in relation to the content of such information. The Company is not obliged to examine and does not examine the legality or otherwise of the informational material displayed on the above websites and therefore no liability of any kind may be attributed to it. Such responsibility lies with the advertisers, sponsors and/or creators of the displayed advertising material.

 

Read the NOTICE REGARDING THE PROCESSING OF PERSONAL DATA