ATHENS MEDICAL CENTER S.A.
(ΙΑΤΡΙΚΟ ΑΘΗΝΩΝ Ε.Α.Ε.)
5-7 Distomou Str., GR-151 25, Marousi
TAX ID NO.: 094129169 – ATHENS TAX OFFICE FOR SAs
GEMI NO.: 000356301000
Version: 15 October /2026
The company under the corporate name “ATHENS MEDICAL CENTER COMMERCIAL SOCIÉTÉ ANONYME” (ATHENS MEDICAL C.S.A.), headquartered at 5–7 Distomou Street, P.C. 151 25, Marousi, with Tax Identification Number (TIN): 094129169, Tax Office KEFODE ATTIKI, and General Commercial Registry No. (G.E.MI.) 000356301000, is the “Data Controller” of your personal data collected for the scheduling and implementation of the teleconference, in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 and the national implementing Law 4624/2019.
The company “ATHENS MEDICAL CENTER S.A.” (hereinafter referred to as the “Company”) respects the privacy of natural persons and takes very seriously the need to protect their personal data. The purpose of this Statement is to provide concise and transparent information regarding the practices followed for the processing and protection of personal data to any person interested in using and receiving telemedicine services through the Company’s TeleHospital online platform, accessible via the website www.telehospital.petros.aboutdev.gr and/or the corresponding mobile application for Android/iOS devices (hereinafter the “Application”), jointly referred to hereinafter as the “Platform.”
The Company retains the unilateral right to update, amend, add to and to change its services and this Notice from time to time, whenever it deems necessary, without prior notice, always within the legal framework currently in effect and in accordance with any changes to applicable national and European legislation on personal data protection (hereinafter referred to in total as the “Applicable Legislation”); any such changes shall enter into force when posted on this website. The Company encourages any interested party to review this Statement regularly and be informed of any changes that have taken place.
What personal data are
“Personal data” means any information relating to a directly or indirectly identified or identifiable living natural person, particularly by referencing a unique identifying detail (e.g. name, ID card number, address, etc.). Data pertaining to health (physical or mental condition, receiving medical services, etc.) are included under the umbrella term of “personal data”, but constitute a special data category.
Purposes and legal bases for processing personal data
As part of its activities as a primary and/or secondary healthcare service provider, as the case may be, the Company is required to keep medical records, as specified by Greek Law 3418/2005 (Code of Medical Ethics), and as such, it collects and processes personal data pertaining to natural persons who make use of its services.
The Company shall collect and process personal data for the following purposes, with the relevant legal basis for processing:
| S/N | PURPOSE OF PROCESSING | LEGAL BASIS | ||
| SUMMARY | GDPR | Greek Law 4624/2019 | ||
| 1 | Subject’s creation of an account on the Platform to provide appropriate and strictly personalised telemedicine services. | Provision of telemedicine services for preventive or occupational medicine and medical diagnosis as part of primary healthcare services through contracted health professionals. | Article 9 par. 2 (h) | Article 22 par. 1(b) |
| 2 | Identification, drawing up contracts and invoicing. | Performance of contract to which the data subject is a party or to take measures at the request of the data subject before concluding the contract. | Article 6 par. 1 (b) | – |
| 3 | Retention and storage of essential data and information relevant to the healthcare services provided for a period of 5 years from rendering services or issuing billing. | Establishing, exercising or substantiating legal claims, pursuing financial claims, either through a judicial, administrative or potentially extra-judicial procedure. | Article 9 par. 2 (f) | Article 25 par. 1 (c) |
| 4 | Storage and retention of medical records with special categories of personal data (sensitive data) for 10 years from the subject’s last visit to the Platform. | Compliance with the provisions of current legislation (Greek Law 3418/2005) | Article 6 par. 1 (c) | Article 27 par. 1 |
| 5 | Sending announcements and newsletters about company activities to the subject receiving services, scientific conferences and meetings (newsletters), and promotion of new and innovative healthcare services. | Subject’s consent | Article 6 par. 1 (a) | Article 28 par. 1 (a) |
| 6 | Use of cookies and related technologies | TECHNICAL COOKIES Performance of contract to which the data subject is a party or to take measures at the request of the data subject before concluding the contract | Article 6 par. 1 (b) | – |
| OPTIONAL COOKIES Subject’s consent | Article 6 par. 1 (a) in tandem with the provisions of Article 4 par. 5 of Greek Law 3471/2006, transposing European Directive 2002/58/EC (ePrivacy Directive) | Article 28 par. 1 (a) | ||
How personal data are collected
Your personal data are collected in the following ways:
(a) Directly from you: you provide them to us when the Company provides medical services to you, when you fill out online forms or send an email to receive information or to use the services available on the Platform.
(b) Automatically through the browser or mobile device you use to access the Platform. Further, technical information that constitutes personal data, such as the internet protocol address (IP address) of your device [including your desktop computer, laptop, tablet or smartphone]. This technical information is used to ensure the proper function and performance of the Platform and is not stored permanently on Company infrastructure.
Specifically, the use of your device camera (image and sound data) is required to conduct the desired teleconference as part of operating the TeleHospital service, firstly, to confirm your identity by the competent doctor/health professional and, secondly, to provide the necessary health services, but without recording or storing the teleconference.
(c) Through the healthcare professionals conducting the teleconsultation, personal data and health data are collected that are relevant to the provision of medical diagnosis, including medical history, symptom-related information, medication prescribing data, medical reports/findings, referrals for diagnostic tests, laboratory and imaging test results, as well as any other information necessary for the diagnosis, care, prevention and, to the extent possible, treatment of diseases or abnormalities affecting human health.
(d) Through public bodies and authorities, in the context of compliance with a legal obligation, or through official public registers in the course of carrying out lawful transactions with you (such as the cross – checking of personal identification details for identification purposes or the verification of information through e – government services), having obtained your consent where required.
When registering for the service provided by the Platform, you will be asked to fill out certain fields on a form, as well as to select a username and password.
Categories of subjects and data collected
| SUBJECT CATEGORIES | DATA CATEGORIES |
| RECIPIENTS OF TELEMEDICINE SERVICES – FINANCIAL TRANSACTORS | Identification and demographic data: First/Last name, father’s name, sex, date of birth, and ID card or passport photo Insurance information: Social Security Number (AMKA) Contact information: postal address, telephone and email address Tax information: Tax Identification Number Health information: Information on medical record as part of the Company’s provision of medical or nursing services, or health information regarding medical services not provided by the Company but which were reported to it either directly by the data subject or by third parties. Bank and financial information: billing information and transaction history. |
| THIRD-PARTY TREATING PHYSICIANS | Identification and demographic data: full name Professional information: Specialisation, professional registry number, type of facility where employed, registered business address |
| VISITORS TO TELEHOSPITAL.GR WEBSITE | Identification and demographic data: First/Last name Contact information: Email, mobile phone number Other information: Any information provided voluntarily by the visitor/user in the empty fields of a contact form. Digital data: IP address, cookies, browser type |
| USERS OF APPLICATION ON ANDROID & APPLE MOBILE DEVICES | Identification and demographic data: First/Last name Login particulars: username, password Contact information: Email, mobile phone number Mobile device information: type of device used to connect to the application, details of operating system device uses Other user information: Anonymous user behaviour data for statistical analysis |
| AUTHORIZED THIRD PARTIES | Identification details: First, Last name, father’s name, and ID card or passport photo Contact information: mobile phone number, email |
Principles governing the Company’s processing of personal data
The Company processes your personal data in a legitimate, transparent and legal manner for the clearly defined purposes stated here. Your personal data the Company processes are limited to those absolutely essential for achieving these purposes; they are accurate and current, retained for a period determined by the purpose for processing and protected by appropriate technical and organisational security measures, and their transfer to third countries outside the EU/EEA occurs in some cases provided there are appropriate safeguards in place, e.g. standard contractual clauses approved by Implementing Decision of the European Commission 2021/914, as in force.
Recipients of personal data collected and processed by the Company
Apart from the duly authorized personnel of the Company and the specialized physicians collaborating with it, access to your personal data, strictly limited to what is necessary for each specific processing purpose, may also be granted to the following authorized third parties for the purposes stated. In every such case where the Company transfers your data to Third Parties acting as data processors on its behalf, the Company, on the one hand, determines the purposes and specific aspects of the processing itself (method, means, retention period, etc.) and, on the other hand, signs a specific agreement to ensure that the processing of the data is carried out in accordance with the applicable legal framework and that all appropriate measures are taken to protect the confidentiality and security of the data. Furthermore, as provided by law, the Company may disclose your data to public authorities, social insurance funds, judicial, public, and independent authorities, police departments, prosecutorial authorities, etc., insofar as this is absolutely necessary for the protection of lawful rights or the fulfillment of legal obligations.
| COMPANY NAME | PURPOSE | CONTACT INFORMATION |
| VIDAVO SA | Development and operational support of the TeleHospital telemedicine platform on behalf of the Company. The company VIDAVO S.A. acts as the Technical Provider that created and operates the Platform and provides support and maintenance services for it. | Address: 10th km Thessaloniki-Nea Moudania Road, BALKAN CENTER, Building D, GR-57001 Thessaloniki. Tel.: +30 2310474762 Email: vidavo@vidavo.eu |
| Hetzner Online GmbH | Cloud computing services with facilities/infrastructure in Germany and Finland to operate the VIDAVO SA Vida24 service. | Address: Industriestr. 25, 91710 Gunzenhausen, Germany Tel.: +49 98315050 Email: support@hetzner.com |
| ALPHA BANK SA (e-Commerce department) | Online payment services | Address: 40 Stadiou Str., GR-10564 Athens Tel.: +30 210326 0000 Email: contact-DPO@alpha.gr |
| ZONEPAGE GP | support of www.telehospital.petros.aboutdev.gr website(including contact form) | Address: 451 Mesogeion Ave., GR-15343 Agia Paraskevi, Attica Tel.: + 30 210 0108900 Email: gdpr@wearedope.com |
| Microsoft Ireland Operations Limited | Cloud computing, enterprise applications and IT infrastructure services supporting the operation of the platform | One Microsoft Place South County Business Park, Leopardstown Dublin 18, D18 P521 Ireland Tel.: +353 (1) 706-3117 Email: data-protection@ema.europa.eu (or via webform at aka.ms/privacyresponse) |
| Jitsi (8×8 l International Limited / 8×8 Romania (Engineering Hub) / EU Operations) | Videoconferencing and audiovisual communication services for the provision of telemedicine sessions and remote communication | 8×8 International International Limited / 8×8 Romania (Engineering Hub) 110 Bishopsgate London, EC2N 4AY United Kingdom Tel.: +44 (0) 207 096 6060 Email: global-privacy@8×8.com |
Personal data are collected and processed by authorised staff in each department and Company partners solely for the purpose of providing each service. They are only transferred to authorised third parties which have expressly committed to maintaining confidentiality when they are required to have access as part of providing said services (e.g. consulting physicians) or other written and valid legal commitment, or where the requirement for confidentiality arises from their duties as provided by law.
On your instructions, your personal data may be transferred to third parties (e.g. to another doctor of your choice, authorized third party) as well as to the Company’s partner businesses (e.g. insurance companies with which you have entered into an agreement and which cover the cost of the medical expenses).
The Company undertakes not to commercialize your personal data by offering them for sale/rental, providing/transferring/disclosing, or communicating them to third parties, nor to use them in any other manner or for purposes other than those for which they were collected, which could jeopardize your privacy, rights, or freedoms, unless required by law, a court decision/order, an administrative act, or where this constitutes a contractual obligation necessary for the proper operation of the Company’s Platform, the performance of its functions, and the appropriate provision of the services selected by you.
Retention period for personal data
The personal data the Company collects are retained for a predetermined and limited time period only in electronic form, depending on the purpose for processing; once the period has lapsed, they are deleted from its records, unless current legislation specifies or permits a different retention period, such as where specific provisions for tax or labour issues are concerned.
Specifically, the Company retains personal data relating to the user’s account on the Platform, including a copy of their National Identity Card for identification purposes, as well as information and files uploaded by the user in each case and per service, for a period of one (1) year following the user’s last login. All medical records are retained for a period of one (1) month from the date of their upload to the TeleHospital platform, with a cloud computing service provider whose facilities are located within the European Union (EU) and which implements appropriate security safeguards. We clarify that DICOM files relating to diagnostic imaging examinations provided directly by the patient, are taken into consideration for the purposes of the medical assessment, are temporarily stored on the platform for one month and are subsequently deleted and do not form part of Patient’s medical record maintained by the Company. Furthermore, with regard to health-related data forming part of the medical record, the Company is required to maintain a physical and/or electronic patient medical file consisting of general and special categories of personal data, in accordance with Article 14 of the Code of Medical Ethics (Greek Law 3418/2005). The retention period for such data is ten (10) years from your last use of the Platform or your last in-person visit to the Company’s facilities (hospitals).
Teleconferences are not recorded, and therefore no sound or image data are retained.
In any case, if legal proceedings are pending beyond the aforementioned time periods, we will retain your data until the conclusion of the legal case through a final and irrevocable court decision.
As to the information users provide indirectly depending on the medium used to connect to the Platform, such as device or digital fingerprint, please refer to the Cookies Policy.
Data Security
The Company takes care to adopt appropriate technical, organisational and contractual measures, ensuring a high level of security and protection of the data being processed. Examples of such measures include: · Internal Policies and Procedures for the Protection of Personal Data. · Confidentiality and non-disclosure clauses in contracts with our service providers and business partners. · Incident management and a disaster recovery plan. · A data recovery plan. · Maintenance of backup copies. · Access levels according to each user’s role. · Maintenance and regular upgrading of hardware and software. · Periodic security checks of systems and infrastructure. · Encryption and pseudonymisation, such as the SSL protocol for credit card information or login credentials.
Furthermore, the Company adopts and implements appropriate internal policies and procedures in line with a wide range of international certification standards, which ensure the implementation of best practices that are directly or indirectly related to the proper management of the personal data collected, as applicable.
In addition, VIDAVO, as the technical provider, holds all currently required certifications and has undertaken to provide, with respect to the software, digital content and digital services supplied through the TeleHospital Platform, all prescribed security updates in accordance with the applicable national and European legislation on the supply of digital content/services.
Rights
The Company takes appropriate measures, so you can exercise the rights assured by Existing Legislation regarding collection and processing of personal data pertaining to you. These rights are:
i.The right of access to your data.
ii.The right to rectification of your data.
iii.The right to erasure of your data (“right to be forgotten”), conditionally (e.g. provided the erasure does not conflict with a provision of law).
iv.The right to restriction of processing of your data, under the specified provisions of Article 18 GDPR.
v.The right to portability of your data.
vi.The right to object to processing of your data, under the specified provisions of Article 21 and 22 GDPR.
vii.The right to withdraw prior consent.
With regard to any issue related to exercising your rights or for any clarification of issues related to the processing of your personal data, you may contact the Company’s Data Protection Officer, as follows:
| DATA PROTECTION OFFICER (DPO) Address: Filadelfeos & 1 Kefalariou streets |
| GR- 14562, Kefalari-Kifisia |
| Athens, Greece |
| Email: dpo@iatriko.gr |
Additionally, if you believe the processing of your personal data violates your rights and/or the provisions of GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Greece, the competent supervisory authority is the Hellenic Data Protection Authority, 1-3 Kifisias Ave, GR-11523, Athens, https://www.dpa.gr/
The Company is bound to make every possible effort so your requests can be answered without delay, and no later than 1 month after receiving them. This deadline may be extended by 2 more months, if necessary, based on the complexity of the request and number of requests. You will be notified within 1 month of the Company’s receipt of your request regarding any extension and the reasons for the delay. If you submit your request via electronic means, the response will be provided electronically, if possible, unless you specify otherwise (e.g. by written letter).
For further information on the Company’s Privacy Policy, please refer to the website, www.iatriko.gr, using the link Notification of Personal Data Processing .