Privacy policy

Last updated: 01/11/2026

This page explains which personal data we collect when you visit drkotrotsos.com, book an appointment or request an online second opinion, why we use it, how long we keep it and what rights you have. Your data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Greek Law 4624/2019 and the Greek Code of Medical Ethics (Law 3418/2005).

1. Who is responsible for your data

Ioannis Kotrotsos, ENT Surgeon, Phoniatrician, Paediatric Audiologist

Kifisias Avenue 90, 115 26 Athens, Greece

Phone: +30 694 486 8483

Email: info@drkotrotsos.com

For any question about your data, you can write to us at info@drkotrotsos.com.

2. What data we collect and why

When you visit the website

Our server automatically records technical details of each visit: IP address, date and time, the page you opened, browser and device type. We need them to run the website properly and securely, for example to detect attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). These logs are deleted after 90 days.

Cookies and visitor statistics

We use cookies that are necessary for the website to work, for example to remember the language you chose, to complete an appointment booking and to remember your cookie choices. These do not require your consent (Art. 4(5) Greek Law 3471/2006).

With your consent, we also use Google Analytics 4, via Google Tag Manager, to see how the website is used: which pages are read, how long visitors stay, which country or city they come from (approximately), which device they use and how they found the website. Google Analytics 4 does not store your IP address. It uses the cookies _ga and _ga_*, which last up to 2 years, and statistical data is deleted after 14 months. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the "Cookie settings" link at the bottom of every page. If you do not give consent, Google Analytics is not activated.

When you book an appointment online

To book an appointment, you enter your full name, email, phone number and the type of visit. If the appointment is for a child, it is booked by the parent or guardian, who also gives us the child's details. We use this information to arrange the appointment, send you a confirmation and a reminder, and contact you if a change is needed. The legal basis is the provision of the service you request (Art. 6(1)(b) GDPR). If you mention anything about your health in the notes, it is processed by the doctor for your medical care (Art. 9(2)(h) GDPR).

The booking system runs within the website itself and your data is stored on our own server. It is not transferred to the company that developed the software.

Second opinion online

For an online second opinion, in addition to the booking details, you upload the tests and medical documents you would like the doctor to review, and the consultation takes place by video call via Google Meet. Your tests and anything you discuss are health data. They are processed only by the doctor, who is bound by medical confidentiality, for the purpose of giving you his medical opinion (Art. 9(2)(h) and 9(3) GDPR). The video call is not recorded.

Payments

Where a service is paid online, payment is made via Stripe. You enter your card details directly with the payment provider, and we neither see nor store them. We only receive the payment confirmation, the amount, the date, your name and your email, which we need for the service and to issue a receipt. The legal basis is the provision of the service (Art. 6(1)(b) GDPR) and our tax obligations (Art. 6(1)(c) GDPR).

When you contact us

When you call us, email us or send us a message on Viber, we use your details and whatever you write to us only to reply and handle your request (Art. 6(1)(b) and (f) GDPR). Viber messages pass through the Rakuten Viber service, which applies its own privacy policy.

Instagram and social media

Our recent Instagram posts are shown at the bottom of every page. The images are loaded from Meta's servers, so your browser connects to them and transmits your IP address. The links to Facebook, Instagram, YouTube and TikTok are simple links: they do not transfer any of your data to these platforms until you click on them. When you visit our profiles there, the platforms' own privacy policies apply.

3. Medical confidentiality

Anything you tell us about your health, through the form, email, phone or video call, is covered by medical confidentiality (Art. 13 Greek Law 3418/2005). Access is limited to the doctor and the practice staff, who are also bound by confidentiality.

4. Who we share your data with

We do not sell your data and we do not use it for advertising. We share it only with those needed to run the website and its services:

• MedWise, Athens: hosting and technical maintenance of the website, as processor, under a contract in accordance with Art. 28 GDPR. The server is located in Greece
• Google Ireland Limited: Google Analytics, Google Tag Manager, Google Meet and email (Google Workspace)
• Stripe: online payments
• Meta Platforms Ireland Limited: display of Instagram posts on the website
• Public authorities, only where required by law

5. Transfers outside the European Union

Google and Meta may also process data in the United States. Such transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which both companies are certified, and on the Commission's standard contractual clauses.

6. How long we keep your data

• Server logs: 90 days
• Google Analytics statistics: 14 months
• Medical data and medical records: 10 years from the last visit, as required by the Greek Code of Medical Ethics (Art. 14 Law 3418/2005)
• Details of a booking that did not lead to a visit: 12 months
• Payment records: as long as required by tax law
• Emails and messages: as long as needed to handle your request

7. Your rights

You have the right to request access to your data, rectification, erasure, restriction of processing and data portability, and to object to processing based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before. Medical data cannot be erased while the obligation to keep medical records applies.

To exercise any of your rights, write to us at info@drkotrotsos.com. We will reply within one month. If you believe that the processing of your data breaches the law, you can lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr).

8. Security

The website uses an encrypted connection (HTTPS). Access to booking details and to the tests you upload is restricted, the server is updated regularly and we keep backups.

9. Changes to this policy

If the way we process your data changes, we will update this page and the date at the top.