Privacy Policy

Privacy Policy

Last updated: 23 July 2026

This Privacy Policy explains how Evexia Plus collects, uses, stores and protects the personal information you share with us through evexiaplus.ie and any other public-facing Evexia Plus website (the "website"). It applies to everyone who contacts us through this website, including patients, family members, GPs and other healthcare professionals.

We have written this policy in plain English. If anything is unclear, or if you want to exercise any of your rights, contact us at ireland@evexia.com.

1. Who we are

The data controller responsible for your personal information is International Centre for Recovery and Rehabilitation S.A., trading as Evexia Plus.

Registered office: 35th km Thessaloniki - Nea Moudania, 63080 Chalkidiki, Greece.

We have appointed a Data Protection Officer. You can contact our Data Protection Officer directly at dpo@evexia.com.

For any data protection question or request, you can also reach our Irish team at ireland@evexia.com or on +353 1 263 3051.

2. What information we collect

We only collect what we need to respond to you and, where relevant, to assess whether our rehabilitation programme is suitable.

Contact details you give us. When you complete a callback or enquiry form, or email or call us, we collect your name, phone number, email address and any other details you choose to include.

Health information you choose to share. To help us understand your enquiry, you may tell us about a patient's medical condition, diagnosis, treatment history or care needs. Information about health is a special category of personal data under Article 9 of the GDPR, and we treat it with particular care. You are never required to share health information to contact us, and you should share only what you are comfortable sharing at this stage.

Technical and usage data. When you visit the website, limited technical data may be collected through cookies and similar technologies, such as your device type, browser, approximate location (derived from your IP address) and how you use our pages. This only happens for non-essential purposes if you have given your consent. See our Cookie Policy for the full detail.

We do not collect financial information, payment card details, government identifiers, or any personal information beyond what is necessary for the purpose described to you.

3. Why we use your information, and our lawful basis

Under the GDPR we must have a lawful basis for using your personal information. Our bases are:

• Your consent, and our legitimate interest in responding to enquiries, for your contact details. When you send us an enquiry you are asking us to reply, and it is in our legitimate interest, and yours, that we do so.
• Your explicit consent under Article 9(2)(a) of the GDPR, for any health information you choose to share. When you submit the form you confirm your consent to us using the contact details and any health information you provide in order to respond to your enquiry. You can withdraw this consent at any time (see section 7).
• Our legitimate interest in keeping the website secure and working well, for essential technical data.
• Your consent, for all non-essential cookies and tracking, including analytics and advertising technologies. These are only used if you accept them through our cookie banner.

We use your information to respond to your enquiry and arrange a callback or email reply from our Irish team; to assess, with our clinical team, whether our programme may be suitable and what the next steps could be; to send you the information you ask for about our services and the EU Cross-Border Healthcare Directive; and to keep the website secure and improve how it works.

We do not sell, rent or trade your information. We do not share your information with third parties for their own marketing. We do not make any decision about you by automated means alone.

4. Who has access to your information

Within Evexia Plus, your information is seen only by the people who need it: our Irish team, who are your first point of contact; the Physical Medicine and Rehabilitation Physician and clinical team who assess suitability; and the administrative staff who support your enquiry.

We use a small number of carefully chosen service providers ("processors") who handle data on our behalf and under contract. They may only use your data on our instructions:

• Webflow, Inc. hosts the website and processes form submissions, which are stored in Webflow and emailed to our Irish team.
• Cloudflare, Inc. provides content delivery and security for the website.
• Our business email provider delivers and stores the email correspondence between us.
• CookieYes Limited records your cookie consent choices.
• Google (Google Ireland Limited / Google LLC) provides Google Analytics and Google Ads, used only if you accept analytics or advertising cookies.
• Microsoft Corporation provides Microsoft Clarity analytics, used only if you accept analytics cookies.
• Meta Platforms, Inc. provides the Meta Pixel, used only if you accept advertising cookies.

We may also disclose information where we are legally required to do so, for example to comply with a court order or a lawful request from an authority.

5. International transfers

We operate in Greece and reply to Irish families from Ireland, both within the European Economic Area (EEA). Some of our service providers are based in the United States. Where your information is transferred outside the EEA, that transfer is protected by an appropriate safeguard under Chapter V of the GDPR, namely the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses under Article 46. You can ask us for more detail about these safeguards at any time.

6. How long we keep your information

We keep your information only for as long as we need it.

• Enquiries that do not lead to admission: we keep your enquiry and correspondence for up to 24 months, so we can follow up helpfully if you contact us again, and then delete it.
• Patients who are admitted: clinical records are kept by the hospital in line with Greek medical-record law, which sets minimum retention periods (generally at least ten years, and longer for the records of children).

When information is no longer needed, we securely delete or anonymise it.

7. Your rights

Under the GDPR you have the right to be informed, to access your information, to rectify inaccurate or incomplete information, to erase your information where there is no overriding reason to keep it, to restrict or object to our use of it, to data portability, and to withdraw consent at any time where we rely on your consent, including your consent to us using health information. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

To exercise any right, contact ireland@evexia.com or our Data Protection Officer at dpo@evexia.com. We will respond within one month. There is normally no charge.

If you are unhappy with how we have handled your information, you have the right to complain to a data protection supervisory authority. As our operations are based in Greece, our lead authority is the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, Greece; www.dpa.gr). If you are resident in Ireland, you may also complain to the Data Protection Commission (21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland; www.dataprotection.ie). We would, however, appreciate the chance to resolve your concern first.

8. Children's information

We do not knowingly collect personal information directly from children. In Ireland the digital age of consent is 16. Where an enquiry concerns a child, we expect it to be made by a parent or guardian. If you believe a child has given us information without the consent of a parent or guardian, contact us at ireland@evexia.com and we will delete it.

9. How we keep your information secure

We use appropriate technical and organisational measures to protect your information, including encryption of the website in transit (HTTPS), access controls that limit who can see your data, and confidentiality obligations on our staff and processors. No method of transmission or storage is completely secure, but we take these obligations seriously. If you become aware of a security concern, please tell us at ireland@evexia.com.

10. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top, and, where the change is significant, we will take reasonable steps to bring it to your attention.

11. How to contact us

For any question about this policy or your personal information:

Data Protection Officer: dpo@evexia.com
Irish team: ireland@evexia.com · +353 1 263 3051
Post: International Centre for Recovery and Rehabilitation S.A., 35th km Thessaloniki - Nea Moudania, 63080 Chalkidiki, Greece.