Privacy policy

The controller of your personal data is Ygeia Media, a sole proprietorship based in Cyprus. Wherever this page says “we” or “us”, it means Ygeia Media. The controller’s full details are available to anyone who requests them at [email protected].

For anything to do with your data, email us at [email protected]. We have not appointed a Data Protection Officer (DPO), as one is not required for a business of our size and type; requests are handled by the controller personally.

When we work for a medical practice or clinic and need to handle data about its own patients or customers (for example, enquiries from its ads), the practice is the controller of that data and we act on its behalf, under terms agreed with it in writing. This page does not cover that processing.

• We never sell, rent or trade your data with anyone.
• The website has no Meta Pixel, Google Analytics or any other advertising cookie.
• The only tool that uses cookies, Microsoft Clarity, loads only if you click “Accept”.
• Our forms are aimed at healthcare professionals and ask for business contact details — never health information.

When you send the contact form, or the form below our free Ad Check tool (currently available in Greek only), we receive whatever you enter: your name, the name of your practice or clinic, specialty, area, phone number and/or email, what you have tried so far and your message. Only a phone number or an email is required; everything else is optional.

Along with the form we record the page you sent it from and, if available, the website that brought you to us (for example a Google search). If you sent it from the Ad Check, we also keep the names of the rules the check flagged, so that our conversation can start from something concrete.

The text you paste into the Ad Check is analysed inside your own browser and is never sent to us — not even when you submit the form.

Once the form is sent, we receive a notification email and, if you gave an email address, you receive one automatic confirmation that we got it. No other automated emails follow.

To protect the form from mass automated submissions, your IP address is held temporarily, for 10 minutes, solely to count how many times the form has been sent from the same connection. It is not stored with your message.

Please do not include patient details or anyone’s health information in the form.

We run ads on Facebook and Instagram (Meta). Some of them include a sign-up form that opens inside the app, without you visiting our website. If you complete it, we receive the details it contains: usually your name, phone number and email and, depending on the form, your specialty, area or answers to a few short questions — together with which ad and form you completed and when.

Before you submit, the form shows you exactly which details will be sent to us, and you can correct anything Meta has pre-filled from your profile.

We use these details in the same way as those from our website form: to respond to what you asked for. We transfer them to our customer management system; in our Meta account they remain available for up to 90 days, as set by Meta itself.

Meta Platforms Ireland Ltd also processes the form data for its own purposes, as an independent controller, under its own privacy policy: www.facebook.com/privacy/policy. Because we have not installed the Meta Pixel on our website, Meta does not learn from us what you do there.

If you email us, call us or message us on WhatsApp, Instagram or Facebook, we see the details you contacted us with (name or account name, phone number, email address) and whatever you write. We use them to reply to you and, if the conversation continues, we note what is necessary in our customer management system.

WhatsApp, Instagram and Facebook belong to Meta, and anything you write there is also subject to Meta’s own terms.

From time to time we send a business email to a practice or clinic that has not contacted us, to show what we could do for it. For this we use only business details that are already public — practice name, specialty, address, business phone and email, website and public social media pages — from sources such as public registers of healthcare professionals, the provider directory of Cyprus’s General Healthcare System (GHS, known locally as GESY), the practice’s own website and public maps.

We send only a few emails (up to four, over about a month) and stop as soon as you reply. Every email has an unsubscribe link: if you click it, or tell us you are not interested, you will not hear from us again and your address goes on a suppression list — precisely so that we never write to you again.

Visit counter, no cookies. Each time a page is opened we record only which page you viewed, which website you came from (just its name, e.g. google.com), your country as estimated by Cloudflare from the connection, whether you are on a phone or a computer, the page language and the date. We keep no IP address, set no cookie and assign you no identifier — we have no way of knowing who you are.

Microsoft Clarity, only with your consent. If you click “Accept” on the cookie notice, Microsoft Clarity loads and records how the page is used (mouse movements, clicks, scrolling), so we can see what visitors find difficult and fix it. Clarity sets its own cookies (such as _clck and _clsk). If you click “Decline”, nothing loads.

Your choice is saved in your browser (localStorage, under the name ym-cookie-consent), so we don’t ask you on every page. To change it, clear this site’s data in your browser settings; the notice will appear again.

We do not use Google Analytics, the Meta Pixel or any other advertising cookies. The website’s fonts are served from our own server, not from Google.

• To respond to your request (form, ad form, message, call) and send you a proposal: steps taken at your request before entering into a contract — Article 6(1)(b) GDPR.
• To provide our services to clients: performance of a contract — Article 6(1)(b). For invoicing and accounting records: legal obligation — Article 6(1)(c).
• To follow up on a request that was left open, protect our forms from abuse, measure traffic anonymously and send business emails to practices: our legitimate interests — Article 6(1)(f). You can always object.
• For Microsoft Clarity: your consent — Article 6(1)(a) GDPR and Cyprus electronic communications law. You can withdraw it at any time.

We do not make decisions about you by solely automated means, and we do not profile you.

We do not share data with third parties for their own purposes. To run our business we use the following providers, who process data on our behalf and only as far as necessary:

• Cloudflare — website hosting, page delivery, protection against attacks and the service that receives our forms.
• Google (Firebase / Google Cloud) — the database where forms are stored, and our customer management system.
• Brevo (France) — email delivery: form notifications, confirmation emails and business emails to practices.
• Microsoft — only if you consent to Clarity.
• Meta (Facebook, Instagram, WhatsApp) — when you complete a form in one of our ads or message us there; as explained above, Meta is also an independent controller for its own purposes.
• Our email provider, where your emails and our notifications arrive.

We may also share data with our accountant or with a public authority where the law requires it.

Some of these providers (Cloudflare, Google, Microsoft, Meta) are based in, or have infrastructure in, the United States or elsewhere outside the European Economic Area. Where such a transfer takes place, it relies on the EU–US Data Privacy Framework (for certified companies) or on the European Commission’s Standard Contractual Clauses.

• Enquiries that did not lead to working together (forms, ad forms, messages): up to 24 months from our last contact, then deleted. Sooner if you ask us.
• Clients: for as long as we work together, and afterwards for as long as tax and accounting law requires for financial records.
• Business emails to practices: sending records for up to 24 months. If you ask us not to contact you again, we keep only your email address on the suppression list, so we can honour that.
• IP address for form protection: 10 minutes.
• Visit counter: contains nothing that identifies you.
• Microsoft Clarity: as long as Microsoft sets for the service (session recordings are currently kept for about 30 days); its cookies expire after one year at most.

Under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) you have the right:

• to find out what data we hold about you and receive a copy;
• to have anything incorrect or incomplete corrected;
• to have it erased;
• to have its processing restricted;
• to receive it in a machine-readable format, so you can pass it on elsewhere;
• to object to processing based on our legitimate interests — in particular to business emails from us, which we stop without asking any questions;
• to withdraw your consent at any time, without affecting anything done before.

To exercise any of these rights, email us at [email protected]. We respond free of charge and within one month at the latest. If we need to confirm that a request really comes from you, we may ask you to confirm it from the email address or phone number you originally gave us.

If you feel we have not handled your data properly, we would like to hear about it first. You always have the right, however, to lodge a complaint with the Cyprus Commissioner for Personal Data Protection:

• 1 Iasonos Street, 1082 Nicosia (P.O. Box 23378, 1682 Nicosia)
• Phone: +357 22 818456
• Email: [email protected]
• Website: www.dataprotection.gov.cy

If you live in another EU country, you can also contact the data protection authority in your own country.

Only the controller has access to the customer management system, through a personal account. Our database rules allow a visitor only to submit a new form — not to read anything already stored. All communication with the website is encrypted (HTTPS).

If anything material changes, we will update this page and the date at the top. The version you are reading applies from 17 October 2026.