Legal Information
Privacy Policy
Vascular Therapy
https://vasculartherapy.gr
This Privacy Policy explains how Vascular Therapy ("we") collects and uses personal data when you use this website. We are committed to protecting your privacy in accordance with the GDPR (EU) 2016/679 and the applicable national legislation of the Hellenic Republic.
We take particular care because requesting an appointment with a vascular surgeon constitutes data concerning your health, which the law protects with special strictness.
1. Who we are (the Data Controller)
| Data Controller | Vascular Therapy |
| Address | Grigoriou Lampraki 132, Piraeus 185 32, Greece · Valaoritou 3, Chania 731 34, Greece |
| Clinic | Piraeus & Chania, Greece |
| Phone | +30 2110128129 |
| General email | [email protected] |
| Privacy email | [email protected] |
The practice is led by Dr. Triantafyllos Giannakopoulos, vascular surgeon.
2. Scope
This policy covers the personal data we process through this website only — primarily through the online appointment request. Personal data you provide during an in-person visit, by phone, or that forms part of your clinical medical record is governed by separate patient privacy documentation and medical confidentiality rules.
3. What data we collect, why, and on what legal basis
We only collect what you actively give us, plus limited usage data via Google Analytics (with your consent). We do not use advertising or cross-site tracking technologies.
§3.1 Appointment requests
"Book Appointment" form
When you request an appointment we collect: full name, phone number, email address, the doctor you prefer, your preferred date range, optionally the city, and any message you write. For verification, we also send a 6-digit verification code to your email.
Because this reveals that you are seeking vascular surgical care, this constitutes data concerning health — a "special category" of personal data.
Purpose
Receiving, verifying and responding to your appointment request
Legal basis (Art. 6)
Your consent (6(1)(a)) and steps taken at your request (6(1)(b))
Legal basis (Art. 9)
Explicit consent 9(2)(a) via the consent checkbox on the form
§3.2 Email verification (one-time code)
Data: email and a temporary 6-digit code. Purpose: verifying email control and preventing abuse. Retention: the code is stored for up to 10 minutes and deleted immediately after use. After successful verification, a temporary token is issued linking your email to the appointment form submission, retained for up to 15 minutes or until used.
§3.3 Newsletter subscription
Data: email address. Purpose: sending occasional updates and health tips to subscribers who opted in. Legal basis: consent (6(1)(a)). Retention: until you unsubscribe or withdraw your consent. We use a double opt-in process and you may unsubscribe at any time via the link in every email.
§3.4 Reviews on the Contact page
We display genuine Google reviews (commenter name, rating, text) already published by Google. This is third-party data displayed on the basis of legitimate interest (6(1)(f)). If you want your review removed, edit or delete it on Google or contact us.
§3.5 Map on the Contact page
If you choose to load the interactive Google Maps of our clinics, your IP address and device information are shared with Google to render the map. The map is loaded only with your explicit choice. Cookie Policy.
§3.6 Technical logs
The hosting provider (Netlify) and the backend provider (Supabase) automatically log standard server logs that may include your IP address, browser type and request time. Purpose: security and reliable website delivery. Legal basis: legitimate interest (6(1)(f)).
§3.7 Website preferences (local storage — not cookies)
We store a few small items in your browser's local storage to remember your language choice and to hide one-time interface hints. They stay on your device, contain no identifying information, and are not sent to us. Cookie Policy.
4. Who we share your data with (processors)
We do not sell your data or use it for advertising. We share it only with service providers ("processors") acting on our instructions under a data processing agreement.
| Provider | What it does for us | Data | Retention |
|---|---|---|---|
| Netlify, Inc. | Website hosting & content delivery | Page requests, IP (logs) | Per the provider's standard policy (unconfirmed period) |
| Supabase, Inc. | Runs the site's backend (appointments, email verification) and stores the related data | Email, one-time code, verification tokens, consent records | Varies by data category — see §6 |
| Resend, Inc. | Sends verification email and internal appointment notifications to clinic staff | Email + message content (verification code / appointment details, depending on the email) | Per the provider's send-log retention policy (unconfirmed period) |
| Google (Google Ireland / Google LLC) | Provides the interactive clinic map and displays Google reviews on the Contact page; also hosts the clinic staff Gmail inboxes that receive appointment-request emails | IP address (map only) · public review content · appointment request emails delivered to staff inboxes | Map: nothing stored by us; review cache refreshes every 24h; inbox retention is Google Workspace's own policy |
| Cloudflare, Inc. | Human/bot verification (Cloudflare Turnstile) on the appointment form | IP address, browser signals required for the Turnstile check | Per Cloudflare's Turnstile privacy policy — we do not store this data ourselves |
5. International transfers
Some of our providers are based in or store data in the United States (Netlify, Resend, Google, Cloudflare, and potentially Supabase). Where your data is transferred outside the EEA, we rely on:
EU-US Data Privacy Framework
EU adequacy decision for providers certified under it (including Resend and Google).
Standard Contractual Clauses
European Commission Standard Contractual Clauses, with additional safeguards where appropriate.
6. How long we keep your data
| Data | Retention |
|---|---|
| Email verification code | ≤ 10 minutes, or until used, then deleted |
| Post-code verification token | ≤ 15 minutes, or until used, then deleted |
| Appointment consent record | Retained as proof of consent; not auto-deleted yet — under review |
| Appointment request email to clinic | Not auto-deleted by us; remains in clinic inbox until manually deleted |
| Server logs | Per each provider's standard retention period |
| Local storage preferences | On your device until you delete them |
7. Your rights
Under the GDPR, you have the right to access your data, rectify inaccurate data, erase ("right to be forgotten"), restrict or object to processing, data portability, and — where processing is based on consent — the right to withdraw it at any time.
To exercise any right, contact us at [email protected] or at the address in §1. We respond within one month.
Greece (primary supervisory authority)
Hellenic Data Protection Authority — 1-3 Kifissias Ave., 115 23 Athens · +30 210 6475600
dataprotection.gov.cyGreece (for Greek residents)
Hellenic Data Protection Authority — 1-3 Kifissias Ave., 115 23 Athens · +30 210 6475600
dpa.gr/en8. Children
Our website and services are intended for adults. We do not knowingly collect data from children without appropriate consent. Under Greek law, the age of consent for online services is 15 years. Below this threshold, parental or guardian consent is required. A parent or guardian may of course request an appointment on behalf of a minor.
9. Security
HTTPS/TLS Encryption
All transmissions are encrypted in transit.
Email verification
One-time code to verify appointment requests.
Trusted providers
Use of reputable providers with appropriate security controls.
10. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date reflects the current version, and material changes will be highlighted on the website.
12. Related legal documents
13. Contact
Questions about this Privacy Policy: [email protected]
Vascular Therapy, Grigoriou Lampraki 132, Piraeus 185 32, Greece · Valaoritou 3, Chania 731 34, Greece · +30 2110128129