Privacy
Privacy notice
Last updated: TODO: launch date
This notice covers this website only. Research data handled under a client engagement is governed by the separate data processing agreement signed for that project, not by this notice.
What is collected, and why
If you use the contact form, we process your name, email address, stated role and the content of your message, in order to answer you and to take steps at your request before entering a contract (GDPR Article 6(1)(b)), and in our legitimate interest in responding to business enquiries (Article 6(1)(f)). Server logs record IP addresses briefly for security and abuse prevention (Article 6(1)(f)). Aggregate, cookieless usage statistics are collected to understand which pages are read (Article 6(1)(f)).
No cookies, no tracking
This site sets no cookies and runs no advertising or cross-site tracking. Fonts are served from this domain rather than from Google, so loading a page sends nothing to a third-party font service. Usage statistics are collected without cookies and without any identifier that follows you between sites, which is why you are not being asked to dismiss a cookie banner.
Special category data
This site is not designed to receive health data, and the contact form asks you not to send it. If you do send patient-level or health information unprompted, it will be deleted rather than retained, and we will ask you to resend the request without it through an agreed secure channel.
Who else processes your data
Vercel Inc. (website hosting and aggregate analytics; certified under the EU–US Data Privacy Framework, engaged under a data processing agreement incorporating Standard Contractual Clauses). Resend (delivery of contact form messages to our inbox). Cloudflare (Turnstile, which distinguishes human visitors from automated abuse of the form). No one else receives this data, and it is never sold or used for advertising.
International transfers
Some of the processors above are established in the United States. Transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses. Website request handling is configured to an EU region where the platform allows it.
How long it is kept
Enquiries that do not lead to an engagement are deleted after 12 months. Where an engagement follows, correspondence is retained for the period set out in the engagement contract. Aggregate statistics contain no personal data and are retained indefinitely.
Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, and to data portability. To exercise any of these, email the address above. You also have the right to complain to the Hellenic Data Protection Authority (dpa.gr) if you believe your data has been handled improperly.
Is providing data required?
No. The contact form is optional — you can email or telephone instead. Without a way to reach you, however, we cannot reply.