ClinicaGo - Privacy Policy
Last updated: 20.07.2026
This Privacy Statement explains how “ClinicaGο PRIVATE COMPANY” having its registered office at 6 Peridou Street, Chania, 73136, Greece, with company registration (GEMI) number 194852058000 (“ClinicaGO”, “Company”, “we”, “us” or “our”) collects, uses, discloses and protects personal data when you access or use our website, platform, application, forms, communication tools or related services (the “Platform”). The Platform enables users, including international patients, to search for, request information from, communicate with and book services with independent healthcare providers in Greece, such as clinics, medical centres, diagnostic centres or other healthcare organisations (“Providers”).
This Privacy Statement applies to users of the Platform, including visitors, account holders, patients and persons acting on behalf of another patient (“you”, “User” or “Patient”).
Important notice: ClinicaGο is not a healthcare provider, clinic, hospital, diagnostic centre, medical practice or emergency service provider. ClinicaGο does not provide medical diagnosis, treatment, medical advice, second opinions, prescriptions or healthcare services. Healthcare services are provided exclusively by the relevant Provider. The Provider is responsible for medical assessment, diagnosis, treatment, informed consent, medical records, follow-up and any healthcare-related communication or decision.
Where a Provider processes your personal data for the purposes of medical assessment, healthcare provision, medical records, informed consent, billing for healthcare services or compliance with professional obligations, the Provider acts as an independent data controller. You should also read the privacy statement of the relevant Provider.
- Who is responsible for your personal data?
Depending on the processing activity, ClinicaGo and the Providers may have different roles under data protection law.
2.1 ClinicaGo as data controller
ClinicaGo acts as an independent data controller when we process personal data for our own purposes, including:
- a) operating and securing the Platform;
b) creating and managing user accounts;
c) receiving and managing treatment requests, booking requests or enquiries;
d) facilitating communication between you and Providers;
e) providing customer support;
f) managing payments made through the Platform;
g) sending service messages and administrative communications;
h) improving, maintaining and protecting the Platform;
i) keeping records of transactions, consents, confirmations and communications;
j) complying with legal obligations;
k) handling complaints, disputes, chargebacks, fraud prevention and legal claims.
2.2 Providers as data controllers
Each Provider acts as an independent data controller for personal data processed for its own healthcare, professional, regulatory, tax, accounting and medical purposes, including:
- a) medical assessment of your request;
b) review of medical information, questionnaires, forms or documents;
c) diagnosis, treatment planning and provision of healthcare services;
d) medical records and clinical documentation;
e) informed consent;
f) follow-up and post-treatment communication;
g) invoicing for healthcare services;
h) compliance with medical, professional, regulatory, tax and legal obligations.
ClinicaGo is not responsible for the Provider’s independent privacy practices. Providers must provide you with their own privacy information where required.
2.3 ClinicaGo as processor for Provider questionnaires
In some cases, the Platform may host, display, collect, temporarily store and transmit questionnaires, pre-assessment forms or medical history forms whose content, purpose and evaluation criteria are determined by a Provider. For those forms, the Provider acts as data controller and ClinicaGo acts as data processor only to the extent that ClinicaGo provides the technical means for hosting, displaying, collecting, temporarily storing and transmitting the relevant data on behalf of and under the instructions of the Provider.
ClinicaGo does not medically evaluate your answers and does not decide whether you are suitable for a healthcare service.
- Personal data we collect
We may collect and process the following categories of personal data:
- Identification and contact data
This may include: full name, email address, phone number, country of residence, nationality, where relevant, preferred language, date of birth or age, where relevant, passport or travel document information, where strictly necessary for a requested service or travel-related support.
- Account data
If you create an account, we may process: username or account identifier, password or authentication credentials, account settings, login history, account activity, security and authentication information.
- Treatment request and booking data
When you submit a request through the Platform, we may process: requested healthcare service or treatment category, preferred Provider, clinic, location or date, booking or appointment details, treatment package or indicative price information, communication history relating to your request, status of the request, booking, cancellation, no-show, rescheduling or completion, confirmations, consents and acceptance logs.
- Health-related data
Depending on the services you use, you may provide information concerning your health. This may include: symptoms, medical history, current or previous diagnoses, medications, allergies, previous treatments or surgeries, test results or medical documents, images, scans, reports or other health-related files, information submitted in questionnaires, pre-assessment forms or medical history forms, information concerning fertility, dental care, cosmetic procedures, rehabilitation, mental health, oncology, bariatric surgery or other medical fields, where relevant to your request.
Health-related data is special category data under the GDPR and is processed only where a valid legal basis and special condition applies.
- Payment and transaction data
Where payments are made through the Platform, we may process: payment amount, deposit amount, currency, payment status, refund status, transaction identifiers, payment provider references, chargeback or dispute information, invoice or receipt-related information.
Payment card data is processed by third-party payment providers, such as Stripe or other payment service providers. ClinicaGO does not store full payment card numbers unless expressly stated and legally permitted.
- Communication data
We may process communications exchanged through or in relation to the Platform, including: messages sent through contact forms, chat or messaging tools, emails, support requests, call notes, where applicable, notifications sent to you or to Providers, complaints, feedback or enquiries.
Where messaging tools enable communication between you and a Provider, ClinicaGo may technically host or transmit messages through the Platform. The Provider remains responsible for medical content, advice or healthcare-related communication.
- Technical, device and usage data
When you use the Platform, we may collect: IP address, device identifiers, browser type and version, operating system, device type, language settings, time zone, pages visited, clicks, interactions and navigation events, logs, timestamps and security events, referral source or campaign identifiers, cookie and similar technology data.
- Marketing and preference data
Where permitted, we may process: communication preferences, newsletter subscriptions, marketing consent status, language preferences, campaign source, interactions with our marketing communications.
We do not use health data for advertising targeting unless this is legally permitted and appropriate consent or another valid legal basis has been obtained.
- How we collect your personal data
We collect personal data:
- a) directly from you when you use the Platform, create an account, submit a request, complete a form, make a payment or contact us;
b) from Providers, where they update the status of your request, booking or service;
c) from payment providers, such as Stripe, in relation to payment status, refunds, disputes or transaction identifiers;
d) from technical systems, cookies and similar technologies when you use the Platform;
e) from persons acting on your behalf, where they submit a request for you;
f) from publicly available or third-party sources, only where lawful and relevant.
- Why we use your personal data and legal bases
The table below summarises the main categories of personal data we process, the purposes for which we process them and the legal bases we rely on under the GDPR.
Categories of personal data | Purpose of processing | Legal basis |
Identification and contact data | To identify you, create and manage your account, communicate with you, respond to your requests and provide Platform-related support | Performance of a contract or steps prior to entering into a contract |
Account data | To create, maintain, secure and manage your user account | Performance of a contract |
Treatment request and booking data | To receive, manage and process treatment requests, booking requests, preliminary assessment requests and related communications through the Platform | Performance of a contract or steps prior to entering into a contract |
Health-related data | To transmit your request and relevant information to the Provider, to enable the Provider to review your request, assess medical suitability and communicate with you in relation to the requested healthcare service | Explicit consent, where required; processing necessary for the establishment, exercise or defence of legal claims, where applicable; where ClinicaGo acts as processor, processing is carried out on behalf of the Provider and under the Provider’s instructions |
Provider questionnaire or medical history form responses, where the form content, purpose and evaluation criteria are determined by the Provider | To technically host, display, collect, temporarily store and transmit the form responses to the relevant Provider | Where ClinicaGo acts as processor: processing on behalf of the Provider under Article 28 GDPR. The Provider is responsible for determining the applicable legal basis under Articles 6 and 9 GDPR |
Communication data | To enable communication between you, ClinicaGo and, where applicable, the relevant Provider; to provide support; to maintain records of communications | Performance of a contract; Legitimate interests in providing support, managing requests and keeping appropriate records |
Payment and transaction data | To facilitate deposit payments, manage payment confirmations, refunds, chargebacks, disputes, fraud checks and payment-related records | Performance of a contract; legitimate interests in payment administration, fraud prevention and dispute management; compliance with legal obligations |
Technical, device and usage data | To operate, maintain, secure, troubleshoot and improve the Platform; to prevent fraud, misuse, unauthorised access and cyberattacks | Legitimate interests in security, fraud prevention, service improvement and business continuity; consent where required for non-essential cookies or similar technologies |
Marketing and preference data | To send newsletters, updates or marketing communications, where permitted; to manage communication preferences | Consent |
Legal, compliance and dispute data, such as complaints, claims, correspondence, transaction records, fraud flags, sanctions or compliance checks | To comply with legal obligations, respond to lawful requests, prevent fraud, handle complaints, establish, exercise or defend legal claims and protect the rights of ClinicaGo, Providers or Users | Compliance with legal obligations; legitimate interests in legal protection, compliance and dispute management; establishment, exercise or defence of legal claims |
Data concerning persons represented by you, such as a minor, family member, dependent or other patient on whose behalf you submit a request | To process a request submitted on behalf of another person and facilitate communication with the relevant Provider | Performance of a contract or steps prior to entering into a contract |
- Explicit consent for health data
Where required, we may ask for your explicit consent before processing health-related data through the Platform or transmitting it to a Provider. You may withdraw consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing before withdrawal. If you withdraw consent, we may no longer be able to provide certain Platform functions or transmit your request to a Provider. A Provider may separately request consent or rely on another legal basis for its own processing of your health data.
- Sharing your personal data
We may share personal data with the following categories of recipients.
7.1 Healthcare Providers
We share personal data with Providers when necessary to manage your request, booking, communication, pre-assessment, treatment package or healthcare-related enquiry. Providers process your data as independent controllers for their healthcare and professional purposes.
7.2 Payment providers
We share payment-related data with payment service providers, such as Stripe or other providers, to process deposits, payments, refunds, chargebacks, fraud checks and transaction records.
7.3 Technology and hosting providers
We may share data with providers of hosting, cloud infrastructure, software, customer support tools, email systems, security tools, analytics tools and other technical services.
7.4 Professional advisers
We may share personal data with lawyers, accountants, auditors, insurers, consultants and other professional advisers where necessary.
7.5 Authorities and courts
We may disclose personal data to courts, regulators, law enforcement authorities, tax authorities or other public bodies where required by law or necessary to protect rights, safety or legal interests.
7.6 Business transfers
If ClinicaGo is involved in a merger, acquisition, financing, restructuring, sale of assets or similar transaction, personal data may be disclosed as part of that transaction, subject to appropriate safeguards.
- International transfers
ClinicaGo is based in Greece and the Platform is intended to connect users with Providers in Greece. If you access the Platform from outside the European Economic Area, your personal data may be transferred to and processed in Greece or other countries where our service providers are located.
Where we transfer personal data outside the EEA to countries that do not provide an adequate level of protection, we use appropriate safeguards where required, such as European Commission Standard Contractual Clauses, adequacy decisions, transfer impact assessments or other lawful transfer mechanisms.
Providers may also transfer or access your data internationally according to their own systems and privacy practices. You should review the Provider’s privacy notice.
- How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
Retention periods may vary depending on the type of data and purpose, including:
- a) account data: for as long as your account remains active and for 3 months thereafter;
b) request and booking data: for as long as needed to manage the request, booking, payment, dispute or legal claim;
c) payment records: for the period required by tax, accounting and payment regulations;
d) support communications: for as long as needed to respond and keep appropriate records;
e) technical logs: for a limited period necessary for security and troubleshooting;
f) legal claim records: for the period necessary to establish, exercise or defend legal claims.
Where ClinicaGo processes data as processor on behalf of a Provider, retention is governed by the Provider’s instructions and applicable legal requirements.
Healthcare Providers are responsible for retaining medical records and healthcare documentation according to their own legal and professional obligations.
- Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.
These measures may include:
- a) access controls;
b) authentication mechanisms;
c) encryption where appropriate;
d) secure transmission;
e) logging and monitoring;
f) vendor due diligence;
g) data minimisation;
g) incident response procedures;
h) regular review of security measures.
You are responsible for keeping your account credentials confidential and for using secure devices and networks.
- Cookies and similar technologies
We use cookies and similar technologies to operate the Platform, remember preferences, analyse usage, improve services and, where permitted, support marketing.
Some cookies are necessary for the Platform to function. Others require your consent, depending on applicable law.
For more information, please see our Cookie Policy.
- Marketing and advertising
We may send you marketing communications only where permitted by law.
We will not use your health data or information revealing your interest in specific healthcare services for targeted advertising unless this is legally permitted and appropriate consent or another valid legal basis has been obtained.
You can opt out of marketing communications at any time by using the unsubscribe link or contacting us.
- Automated decision-making and profiling
ClinicaGο does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
The Platform may use filters, sorting tools or search features to help display Providers or services. These tools do not constitute medical advice, medical assessment or medical suitability determination.
Any decision about your medical suitability, treatment or healthcare service is made solely by the relevant Provider.
If we introduce automated tools that materially affect users, we will update this Privacy Policy and provide any required information or rights.
- Your rights
Subject to applicable law, you may have the following rights:
- a) right of access to your personal data;
b) right to rectification of inaccurate or incomplete data;
c) right to erasure;
d) right to restriction of processing;
e) right to object to processing;
f) right to data portability;
g) right to withdraw consent at any time, where processing is based on consent;
h) right not to be subject to certain automated decisions;
i) right to lodge a complaint with a supervisory authority.
To exercise your rights against ClinicaGο, contact us using the details below.
If your request concerns processing carried out by a Provider as an independent controller, we may direct you to the relevant Provider or cooperate with the Provider where appropriate.
- Complaints
If you have concerns about how we process your personal data, please contact us first so that we can try to resolve the issue.
You also have the right to lodge a complaint with a data protection supervisory authority. In Greece, the competent authority is the Hellenic Data Protection Authority.
- Data concerning other persons
If you submit personal data about another person, including a child, family member, dependent, patient or person you represent, you confirm that you have the authority, consent or other lawful basis to do so.
You must ensure that the person has been informed about the processing of their personal data, including this Privacy Policy and the Provider’s privacy notice where applicable.
- Children
The Platform is intended for adults. You must be at least 18 years old to create an account or submit a request through the Platform. If you submit a request on behalf of a child or minor, you confirm that you are the parent, guardian or otherwise legally authorised person.
- Third-party websites and services
The Platform may contain links to third-party websites or services, including Provider websites, payment providers, travel services, maps or other tools. We are not responsible for the privacy practices, content or security of third-party websites or services. You should review their privacy policies before using them.
- Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be posted on the Platform with a new “Last updated” date. Where required by law, we will notify you of material changes or request your consent.
- Contact us
For questions about this Privacy Policy or to exercise your data protection rights, you may contact us at:
Company: ClinicaGo PRIVATE COMPANY
Address: PERIDOU 6, CHANIA, CHANION / CHANION, 73136
Email: support@clinicagoappp.com
Telephone: +30 6987782684
If your request concerns a healthcare Provider’s independent processing of your personal data, you should also contact the relevant Provider directly.