Privacy Policy

1. Who we are

This website, www.drdiana.eu, is operated by Diana Vulcanescu DLC, trading as Dr. Diana Vulcanescu Regenerative & Anti-Aging Clinic ("we", "us", "our"). We are the data controller for the personal data described in this policy.

Dr. Diana Vulcanescu, BSc MSc PgDip MRCGP(int)
Diana Vulcanescu DLC · VAT: 10421811U · Reg. No.: HE421811
Athalassas Avenue 54, Office 102, Strovolos, Nicosia 2023, Cyprus
Tel: +357 22316779 · Mob: +357 96910055
info@drdiana.eu · www.drdiana.eu

We are committed to protecting your privacy and handling your personal data in line with the EU General Data Protection Regulation (GDPR) and the Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data.

2. The personal data we collect

Depending on how you interact with us, we may collect:

• ·  Contact details – name, email address, phone number and postal address.
• ·  Appointment information – the treatment or consultation you are interested in, preferred dates and any message you send us.
• ·  Health information – information you provide in our new patient forms, consultation questionnaires or during your visit, such as medical history, medications, allergies and skin concerns. This is special-category data and is handled with extra care (see section 4).
• ·  Order information – products purchased, delivery address, order history and communication about your order.
• ·  Payment information – payments are processed securely by our payment providers. We do not store your full card details.
• ·  Technical and usage data – IP address, browser and device type, pages visited and how you arrived at our website, collected through cookies and similar technologies.
• ·  Marketing preferences – whether you have agreed to receive news and offers from us.

3. How and why we use your data

We use your personal data only for clear and lawful purposes:

• ·  To respond to your enquiries and manage appointments – based on taking steps at your request before entering into a contract, and on our legitimate interest in running the clinic.
• ·  To provide medical and aesthetic care – including assessing your suitability for treatment, keeping medical records and following up after treatment.
• ·  To process and deliver online orders – based on the performance of our contract with you.
• ·  To meet legal obligations – such as accounting, tax and medical record-keeping requirements.
• ·  To improve our website and services – using analytics, based on our legitimate interests or your consent where required.
• ·  To send you news and offers – only where you have given your consent. You can unsubscribe at any time.

4. Health data

Information about your health is special-category personal data under the GDPR. We process it only for the purposes of medical diagnosis and the provision of health care, under the responsibility of a registered medical professional bound by medical confidentiality, or with your explicit consent where required. Access is limited to the clinical team who need it to care for you.

Please do not send detailed medical information through general contact forms or social media messages. Our team will ask for it through the appropriate channel when needed.

5. Who we share your data with

We do not sell your personal data. We share it only where necessary with:

• ·  Service providers who help us run our website and business, such as our website and online store platform (Wix.com), payment providers, email services and IT support.
• ·  Delivery and courier services to deliver your orders.
• ·  Analytics and advertising providers, such as Google, where you have consented to the relevant cookies.
• ·  Professional advisers, such as accountants and lawyers, under duties of confidentiality.
• ·  Public authorities where we are required to by law.

All service providers are required to keep your data secure and use it only on our instructions.

6. International transfers

Some of our service providers may process data outside the European Economic Area, for example in the United States. Where this happens, we make sure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or an adequacy decision, including the EU–US Data Privacy Framework.

7. How long we keep your data

• ·  Medical records are kept for the period required by Cypriot law and medical professional guidelines.
• ·  Order and invoice records are kept for as long as required by tax and accounting laws.
• ·  Enquiries that do not lead to an appointment or order are deleted when they are no longer needed.
• ·  Marketing data is kept until you unsubscribe or ask us to delete it.

8. Cookies

Our website uses cookies and similar technologies. Essential cookies are needed for the website and online store to work, for example to keep items in your cart. Analytics and marketing cookies help us understand how visitors use the website and measure our advertising, and are used only with your consent. You can change your cookie preferences at any time through the cookie banner or your browser settings.

9. Your rights

Under the GDPR you have the right to:

• ·  Access the personal data we hold about you
• ·  Ask us to correct inaccurate or incomplete data
• ·  Ask us to delete your data, where we are not legally required to keep it
• ·  Restrict or object to certain processing, including direct marketing
• ·  Receive your data in a portable format
• ·  Withdraw your consent at any time, where processing is based on consent

To exercise any of these rights, email us at info@drdiana.eu. We will respond within one month. We may need to verify your identity before acting on your request.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).

10. Security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including secure (HTTPS) connections, access controls and confidentiality obligations for our staff.

11. Children

Our website and online store are intended for adults. We do not knowingly collect personal data from children through this website. Treatment of patients under 18 takes place only with the consent of a parent or legal guardian.

12. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page, with the date of the last update.

13. Contact us

For any question about this policy or your personal data, contact us at info@drdiana.eu or write to us at Athalassas Avenue 54, Office 102, Strovolos, Nicosia 2023, Cyprus.