Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains how DR. A. KARATZIAS DLC ("we", "us", "the practice", "the controller") collects and processes your personal data when you visit drkaratzias.com, contact us, or book a consultation. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the data-protection law of the Republic of Cyprus (Law 125(I)/2018).

We take particular care with health-related information, which receives special protection under Article 9 GDPR.

1. Who we are (Data Controller)

DR. A. KARATZIAS DLC — a Cyprus medical practitioners’ limited liability company ("DLC" / Greek "Ι.Ε.Π.Ε"), Registration No. HE 492233.

Registered office: Αγίου Νικολάου 59, Floor 1, Έγκωμη, 2408 Nicosia, Cyprus. The practice is led by Dr. Angelos Karatzias (MD, MSc, FEBOPRAS), with consultations in Nicosia.

• Phone: +357 22 020721
• Email (general & privacy requests): [email protected]
• Website: https://drkaratzias.com

We have not appointed a Data Protection Officer (not required at our size). Please direct all privacy requests to [email protected].

2. Scope

This policy covers personal data we process through our website and the enquiry tools on it. The clinical processing of your data as a patient (your medical record, consultation notes, treatment) is governed by your treating relationship with the practice and by medical-confidentiality law; the key points are summarised in sections 4 and 5 below.

3. What we collect, why, and on what legal basis

• Data we collect: Enquiry form: name, email, phone, pronouns, location, your message; Where it comes from: You, via the "Book a Session / Connect" form; Why we use it: To answer your enquiry and arrange a consultation; Legal basis (Art. 6 / Art. 9 GDPR): Art. 6(1)(b) (steps prior to a service at your request) and/or Art. 6(1)(f) (responding to enquiries). If your message reveals health information: Art. 9(2)(a) explicit consent / Art. 9(2)(h) provision of healthcare; Retention: Up to 24 months from last contact, then deleted, unless you become a patient (then medical-record retention applies)
• Data we collect: Online booking: handled on our external booking platform (Zenbooker); Where it comes from: You — on Zenbooker’s own site (our "Book" button takes you there in a new tab); Why we use it: To schedule and pay for your consultation (Cyprus €80); Legal basis (Art. 6 / Art. 9 GDPR): Art. 6(1)(b) (performance of the service). What you enter is processed by Zenbooker under its own privacy policy; we receive the booking to manage your appointment; Retention: We keep the appointment record per medical-record rules; the booking-platform copy is governed by Zenbooker
• Data we collect: Patient / clinical data (incl. health data, photographs); Where it comes from: You, during consultation and treatment; Why we use it: To provide medical care safely; Legal basis (Art. 6 / Art. 9 GDPR): Art. 9(2)(h) (provision of health care) + Art. 6(1)(b)/(c); Retention: 15 years from last treatment (minors: 15 years from age 18)
• Data we collect: Before/after photographs published on the website; Where it comes from: You, with separate written consent; Why we use it: To illustrate our work on our procedure pages; Legal basis (Art. 6 / Art. 9 GDPR): Art. 9(2)(a) explicit, specific, written consent (withdrawable at any time); Retention: Until you withdraw consent, then removed
• Data we collect: Analytics: anonymised usage statistics (pages visited, approximate location, device/browser, IP-anonymised) via Google Analytics 4; Where it comes from: Google’s tag loads for every visitor and, until you consent, sends only anonymous, cookie-free measurement signals (see section 6); the cookies load only if you consent; Why we use it: To understand how the site is used and improve it; Legal basis (Art. 6 / Art. 9 GDPR): Art. 6(1)(f) legitimate interest for the anonymous pre-consent signals; Art. 6(1)(a) consent for the cookie-based analytics; Retention: Per Google’s settings (e.g. up to 14 months)
• Data we collect: Visit statistics and session analytics: pages viewed, referring site, device/browser and approximate location (country/city) and, for a sample of visits, how pages are used (scrolling, clicks, taps) as heatmaps and session recordings, via Umami, our own analytics on our web agency’s server in the EU; all page text and anything typed are masked and the enquiry form is never recorded; no cookies and no IP address are stored; Where it comes from: Only if you consent to Analytics — Umami does not load before that; Why we use it: To understand how the site is used and where it is hard to use, and to improve it; Legal basis (Art. 6 / Art. 9 GDPR): Art. 6(1)(a) consent; Retention: Recordings: 30 days; heatmap data: 90 days; visit statistics: 14 months
• Data we collect: Newsletter (only if you subscribe): your email address, the date of your subscription and of your confirmation, and whether our newsletters are opened and their links clicked; Where it comes from: You, through the subscription form in the footer, confirmed by the link we email you (double opt-in); Why we use it: To send you Dr. Karatzias’s newsletter; Legal basis (Art. 6 / Art. 9 GDPR): Art. 6(1)(a) consent; you can unsubscribe at any time with the link in every email; Retention: Until you unsubscribe
• Data we collect: Server logs & security data: IP address, browser/OS, referring page, date/time, pages viewed; Where it comes from: Automatically, when you visit; Why we use it: To deliver the site, keep it secure, prevent abuse and diagnose faults; Legal basis (Art. 6 / Art. 9 GDPR): Art. 6(1)(f) (legitimate interest in a secure, working website); Retention: Typically up to 12 months
• Data we collect: Cookies / similar technologies; Where it comes from: Your browser; Why we use it: See section 6; Legal basis (Art. 6 / Art. 9 GDPR): Essential: Art. 6(1)(f); non-essential (analytics): Art. 6(1)(a) consent; Retention: See section 6

We do not sell your data, and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Health and other special-category data

Because we are a plastic-surgery practice, much of the information you share — even just which procedure you enquire about — is data concerning your health. Under Article 9 GDPR this is a "special category" and its processing is prohibited by default unless one of the specific Article 9(2) exceptions applies (a higher bar than the ordinary Article 6 grounds in section 3, and required on top of them). Article 9(3) further requires, for the healthcare exception, that the data be handled by — or under the responsibility of — a professional bound by medical secrecy, which Dr. Karatzias is.

We rely on different Article 9 exceptions depending on the activity:

• Activity: Naming a procedure / describing a concern in the enquiry form; Stage: Website (pre-patient); Article 9 basis: 9(2)(a) explicit consent
• Activity: Booking a consultation; Stage: Website → becoming a patient; Article 9 basis: 9(2)(a) explicit consent and/or 9(2)(h) provision of health care
• Activity: Publishing your before/after photos; Stage: Patient; Article 9 basis: 9(2)(a) explicit, separate, written consent
• Activity: Clinical record, consultation notes, treatment data; Stage: Patient; Article 9 basis: 9(2)(h) provision of health care (under professional secrecy, Art. 9(3))
• Activity: Retaining the record for the statutory period / to defend a claim; Stage: Patient; Article 9 basis: 9(2)(h) + 9(2)(f) establishment/exercise/defence of legal claims
• Activity: Medical emergency where you cannot consent; Stage: Patient; Article 9 basis: 9(2)(c) protection of vital interests

Where we rely on explicit consent (9(2)(a)), we ask for it separately and unambiguously at the point you provide the data (a clear opt-in, not pre-ticked, not bundled into general terms), you are told what it is for, and you can withdraw it at any time. Withdrawal stops future processing but does not undo processing already carried out, or processing we are legally required to continue (e.g. keeping a medical record for its retention period).

5. Before/after photographs

The before/after photographs on our procedure pages show real patients, all of whom are treated in Cyprus. We publish such images only where the patient has given separate, explicit, written and informed consent specifically for publication on the website and/or social media. Consent is voluntary, is not a condition of treatment, and can be withdrawn at any time — on withdrawal we remove the image from the website (note that copies already cached or shared by third parties may persist outside our control). If you are a patient and want an image removed, email [email protected].

6. Cookies and third-party content

Full details, including a cookie-by-cookie table and how to change your choices, are in our separate Cookie Policy.

We use cookies and similar technologies, and load some content from third parties. Third-party content means that, when a page loads, your browser contacts that third party, which necessarily receives your IP address.

The Google Analytics measurement tag is a partial exception to "loads only on consent": it loads for every visitor from the first page view, but in a privacy-preserving default state (Google's Consent Mode) — until you consent, it sets no cookie and sends only anonymous, cookie-free measurement signals with no identifier attached: page views and basic interaction signals such as a tap on the phone number or booking link, or confirmation that an enquiry was sent. No name, email address, phone number, message text or other form content is ever included. Only after you consent does it set the _ga cookies listed in our Cookie Policy.

Umami, by contrast, does not load at all unless you consent to Analytics, and it sets no cookies. With your consent it counts the pages you visit and, for a sample of visits, records how our pages are used (scrolling, clicks and taps) as heatmaps and session recordings. All page text and anything typed into a form are masked, and the enquiry form is never recorded. Umami runs on our web agency’s own server in the EU and no other company receives the data (see section 7); recordings are deleted after 30 days, heatmap data after 90 days and visit statistics after 14 months. Withdrawing your consent stops it immediately.

Your choices. When you first visit, a consent banner lets you Accept all, Reject all, or Manage preferences by category. Non-essential cookies (analytics) are switched off by default and only load if you opt in, and withdrawing analytics consent clears those cookies and reloads the page; from then on you are treated as a visitor who has not consented — no cookie is set and only anonymous, cookie-free measurement signals are sent. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer. We group cookies as:

• Strictly necessary (always on, no consent needed) — needed to make the site work and keep it secure.
• Functional (consent) — the embedded location map (OpenStreetMap).
• Analytics (consent; before it, Google Analytics runs cookie-free and Umami does not load) — Google Analytics 4 and Umami (see below).

Third-party services we use, embed or link to:

• Service: Google Analytics 4; Category: Analytics — measurement tag loads for all visitors, cookie-free until you consent; What it does: Anonymised usage statistics; IP is anonymised; no cookie or identifier before consent; Their policy: policies.google.com/privacy
• Service: Umami (self-hosted); Category: Analytics — loads only on consent; What it does: Visit statistics, heatmaps and session recordings on our web agency’s own server in the EU; all text masked, the enquiry form never recorded; no cookies; no other company receives the data; Their policy: — (runs on our web agency’s server)
• Service: Zenbooker (external link); Category: Link — opens externally; What it does: Our "Book" buttons open Zenbooker’s own site in a new tab — nothing is embedded, no script loads, and no data is sent from our pages. You book and pay on Zenbooker, under its privacy policy; Their policy: zenbooker.com/privacy
• Service: OpenStreetMap (location map); Category: Functional — loads only on consent; What it does: Shows the clinic location; a keyless embed with no API key or third-party tracking script; Their policy: osmfoundation.org/wiki/Privacy_Policy
• Service: Cloudflare Turnstile (spam protection); Category: Security — loads only when you start filling in a form; What it does: Checks that a person, not a bot, is using our newsletter or enquiry form; it processes your IP address and browser and connection characteristics, never what you type, and sets no cookie on our website (see section 7); Their policy: cloudflare.com/privacypolicy
• Service: Social media links (Instagram, TikTok, Facebook, YouTube); What it does: Plain links to our profiles — not embedded trackers; data is only shared if you click through; Their policy: the respective platform

You can also control or delete cookies in your browser settings; blocking some cookies may affect how the site works.

7. Who we share your data with

We share personal data only with service providers who process it on our instructions under a written data-processing agreement (with the one exception for Cloudflare Turnstile stated below), and with authorities where legally required:

• Resend (email delivery) — transmits your enquiry to us.
• Google (Google Analytics 4) — anonymous, cookie-free measurement signals for all visitors (see section 6); cookie-based analytics only with your consent.
• Our web agency and hosting provider — stores the website and server logs on a server in the EU (Finland) and, only if you consent to Analytics, the Umami visit statistics, heatmaps and session recordings.
• Brevo (newsletter) — stores your email address and sends the newsletter, only if you subscribe and confirm. Brevo (Sendinblue SAS) is an EU company based in France.
• Cloudflare (website delivery, security and Turnstile spam protection) — every visit to our website, including its images and videos, passes through Cloudflare’s network, which processes your IP address and technical request data to deliver the pages and protect the site against attacks. When you use one of our forms (the newsletter or the enquiry form), Cloudflare Turnstile also checks that you are a person and not a bot: it processes technical data — your IP address and your browser and connection characteristics (such as the user agent) — and never sees what you type into the forms. The purpose is to keep our website secure and our forms free of spam and abuse; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Turnstile loads only when you start filling in a form and sets no cookie on our website. Cloudflare, Inc. acts as our processor; for Turnstile it also acts as a controller in its own right, only to improve its bot detection. The data is not used for advertising.
• Zenbooker — our external booking platform: you enter booking/payment details on Zenbooker’s own site (not ours), and Zenbooker provides your booking to us so we can manage your appointment. Its own privacy policy governs that data.

We do not sell or rent your personal data to anyone.

8. International transfers

Some providers are based outside the European Economic Area, primarily in the United States. Where data is transferred outside the EEA, we rely on an appropriate safeguard under Chapter V GDPR:

• Google (Google Analytics 4) — Google LLC is certified under the EU-US Data Privacy Framework.
• Resend (email delivery) — certified under the EU-US Data Privacy Framework, and its data-processing agreement also incorporates the European Commission’s Standard Contractual Clauses.
• Cloudflare (website delivery, security and spam protection) — Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, and its data-processing agreement also incorporates the European Commission’s Standard Contractual Clauses.

Our online booking runs on an external platform (Zenbooker, US-based): you provide your details to it directly when you choose to book, under its own privacy policy — this is not a transfer made by our website. You can ask us for a copy of the relevant safeguards.

9. How long we keep your data

We keep personal data only as long as necessary for the purpose it was collected for, or as required by law (see the retention column in section 3). Medical records are kept for 15 years from your last treatment (for minors, 15 years from their 18th birthday), in line with Cyprus record-keeping and claim-limitation requirements. Website enquiry/lead data is kept for up to 24 months. When a retention period ends, we securely delete or anonymise the data.

10. How we protect your data

We use appropriate technical and organisational measures — including HTTPS/TLS encryption in transit, access controls, rate-limiting against abuse, and limiting who can see your data — to protect it. No internet transmission is ever 100% secure; you are always free to contact us by phone instead (+357 22 020721).

11. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure ("right to be forgotten"), subject to our legal obligation to retain medical records;
• restriction of processing;
• data portability (receive your data in a structured, machine-readable format);
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, where processing is based on consent (without affecting prior processing);
• not be subject to solely automated decisions with legal or similar effect (we do not do this).

To exercise any right, email [email protected]. We will respond within one month (extendable by two further months for complex requests, in which case we will tell you). Exercising your rights is free unless a request is manifestly unfounded or excessive.

12. Complaints

If you believe we have mishandled your data, please contact us first so we can put it right. You also have the right to lodge a complaint with a supervisory authority:

Cyprus — Office of the Commissioner for Personal Data Protection. 1 Iasonos Street, 1082 Nicosia (P.O. Box 23378, 1682 Nicosia). Tel: +357 22 818 456 · Email: [email protected] · dataprotection.gov.cy

13. Children

Our services are directed at adults. We do not knowingly collect data from children under 18 without the involvement of a parent or guardian. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The current version is always published here with its "Last updated" date. Material changes will be highlighted on the site.

15. Definitions

The terms used here follow the GDPR. In short: "personal data" is any information relating to an identified or identifiable person; "processing" is any operation performed on personal data; "controller" is the party that decides why and how data is processed (that’s us); "processor" is a party that processes data on the controller’s behalf; "consent" is a freely given, specific, informed and unambiguous agreement to processing; "special-category data" includes health data, which receives extra protection.