[ PRIVACY AND PERSONAL DATA ]
Privacy policy
Last updated: 5 October 2026
Data controller
For clinic functions, the controller is the Practice of Prof. Demosthenes Bouros / Pneumogenesis, 58 Kifissias Avenue, Marousi 15125, Greece. Contact: iatrikobouros@gmail.com, +30 210 615 7002.
What we collect and why
The appointment form collects your name, email, phone, visit reason, preferred times, and an optional note. We use these only to receive, review, and answer your request. Do not submit a detailed medical history or emergency information through the form.
Legal basis
We process details needed to respond to your request and, where the content is health data, with your explicit consent. You may withdraw consent before the visit is finalised without affecting processing that was already lawful.
Providers and transfers
Hosting and database services run on OpenAI Sites / Cloudflare infrastructure and transactional email is delivered through Resend. These providers support the technical delivery of the service. Where data is processed outside the EEA, applicable contractual and organisational safeguards are used.
Retention and security
Pending or rejected requests are deleted or anonymised after 12 months. Confirmed requests are retained only as long as needed for care administration and legal obligations. We use encryption in transit, restricted access, and random tracking codes.
AI educational assistant
“Ask Pneumogenesis” sends your general question to OpenAI only after you confirm consent. Do not submit names, identity numbers, contact details or identifiable health records. Questions and answers are not stored in the site database. API requests use store: false; this does not exclude security or other retention under OpenAI’s data policy. Abuse prevention stores only daily counts and a daily cryptographic hash of the IP address. Old counts are cleaned on subsequent requests after two days. The assistant cannot access appointments, drafts or email.
Your rights
You may request access, correction, erasure, restriction, or portability, and object where applicable. Contact the email above. You may also complain to the Hellenic Data Protection Authority.