CONTACT

PRIVACY POLICY

Our group of companies (hereinafter referred to as the “Group”) consists of:
 a) PRIVATE DIAGNOSTIC LABORATORY PERSONAL LABORATORIES MEDICAL I.K.E., trading under the name PERSONAL LABS, with registered offices at 8 Ethnikis Antistaseos Street, Kalamaria, 55133, Greece, and
 b) PERSONAL WELLNESS HEALTH I.K.E., trading under the name PERSUP, also with registered offices at 8 Ethnikis Antistaseos Street, Kalamaria, 55133, Greece.

The Group operates in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “General Data Protection Regulation” or “GDPR”) and takes all necessary measures to ensure the security and protection of your personal data.

The Data Controller responsible for your personal data is PERSONAL WELLNESS HEALTH I.K.E., trading under the name PERSUP, with registered offices at 8 Ethnikis Antistaseos Street, Kalamaria, 55133, Greece (hereinafter referred to as the “Company”), telephone number +30 231 111 9200, email address info@personalwellness.health and website www.personalwellness.health.

Our Company may process, in its capacity as Data Controller and in accordance with this Privacy Policy, the personal data you provide to us when entering into transactions with us for the purpose of receiving our products and services. This Privacy Policy (hereinafter the “Policy”) applies both to transactions conducted at our physical premises and to transactions conducted through our online store.

Our Company implements appropriate technical and organizational measures to protect and secure your personal data against any form of accidental or unlawful processing. The processing of your personal data is carried out exclusively within the context of our commercial and customer relationship and is limited to what is strictly necessary for the secure provision of our products and services.

1. WHAT IS PERSONAL DATA?

“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”).

Such information typically includes a person’s full name, telephone number, postal address, email address, and other similar information.

2. WHAT ARE SPECIAL CATEGORIES OF PERSONAL DATA?

“Special Categories of Personal Data” include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying an individual, data concerning health, or data concerning a person’s sex life or sexual orientation.

3. WHAT IS THE PROCESSING OF PERSONAL DATA?

“Processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means.

Such operations may include collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making data available, alignment or combination, restriction, erasure, or destruction.

4. WHAT DO “DATA CONTROLLER”, “DATA SUBJECT”, “DATA PROCESSOR” AND “RECIPIENT” MEAN?

Data Controller

“Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Where the purposes and means of such processing are determined by Union or Member State law, the Data Controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Data Subject

“Data Subject” means the natural person whose personal data is being processed, such as customers, employees, and other individuals.

Data Processor

“Data Processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller.

Recipient

“Recipient” means a natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether or not that person or body is a third party.

However, public authorities which may receive personal data in the context of a specific inquiry in accordance with Union or Member State law shall not be regarded as recipients. The processing of such data by those public authorities shall comply with the applicable data protection rules according to the purposes of the processing.

5. WHAT ARE “GENETIC DATA”, “BIOMETRIC DATA” AND “HEALTH DATA”?

Genetic Data

“Genetic Data” means personal data relating to the inherited or acquired genetic characteristics of a natural person which provide unique information about that person’s physiology or health and which result, in particular, from the analysis of a biological sample from that individual.

Biometric Data

“Biometric Data” means personal data resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of a natural person, which allow or confirm the unique identification of that person, such as facial images or fingerprint data.

Health Data

“Health Data” means personal data relating to the physical or mental health of a natural person, including the provision of healthcare services, which reveals information about that person’s health status.

6. WHAT PRINCIPLES GOVERN THE PROCESSING OF YOUR PERSONAL DATA?

The processing of your personal data is governed by the following principles:

  1. a) Lawfulness, Fairness and Transparency
     Your personal data is processed lawfully, fairly, and transparently.
  2. b) Purpose Limitation
     Your data is collected for specified, explicit, and legitimate purposes.
  3. c) Data Minimization
     Your data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
  4. d) Accuracy
     Your data must be accurate and, where necessary, kept up to date. All reasonable steps are taken to ensure that inaccurate personal data is erased or rectified without delay.
  5. e) Storage Limitation
     Your personal data is retained only for as long as necessary for the purposes for which it is processed.

Personal data may be stored for longer periods where this is required solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, provided appropriate technical and organizational measures are implemented, including pseudonymization, and only where those purposes cannot be achieved through anonymization.

  1. f) Integrity and Confidentiality
     Your personal data is processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

7. WHAT PERSONAL DATA DO WE COLLECT?

We collect only the data that is strictly necessary in order to provide you with our products and services.

The collection of your personal data is always carried out after obtaining your explicit consent. Processing is limited exclusively to the purposes for which the data was provided and is subject to the terms set out in this Privacy Policy.

Within the context of our commercial relationship, our Company may collect some of the following categories of data:

  • Identification, demographic, tax, and insurance information, including, indicatively, full name, father’s name, mother’s name, date of birth, identity card or passport number, AMKA/social security number, health insurance details, gender, profession, tax identification number, receipt details, and other relevant information.
  • Your contact details, or those of third parties authorized by you to receive your results, including postal address, email address, and telephone number.
  • Debit or credit card information during online payment through our online store, processed within a secure payment environment.
  • Biological samples and genetic data for laboratory analysis. For example, we may collect and process biological samples in order to perform hematological, hormonal, biochemical, and other laboratory tests.
  • Health data relating, for example, to your physical condition, medical history, history of illness, medical opinions, medication you may be taking, surgical procedures you may have undergone, allergy history, and other relevant information.
  • If you choose to create a user/customer account on our website or participate in the dietary supplement needs assessment test, we may collect your name, gender, age, email address, password, and other relevant data.

If you choose to receive informational or promotional material from our Company by subscribing to our newsletter, we will collect your email address for this purpose.

If you choose to complete the online quiz, solely for the purpose of providing personalized recommendations according to your needs, we may collect information including your age, weight, email address, dietary habits, frequency and intensity of exercise, frequency of sun exposure, potential difficulties relating to mental fatigue or concentration, stress management, sleep, eye health, gastrointestinal issues, fertility or menopause, erectile function or prostate health, musculoskeletal or joint conditions, immune system disorders, weight management, and skin-related concerns.

The information you provide when completing the quiz will not be processed for any purpose other than providing you with recommendations based on your individual needs. We expressly state that such data is not stored by our Company and will not be used in the future for commercial or other purposes.

  • When browsing our website, we may collect browsing data such as your device’s IP address, as well as statistical data or information relating to your preferences, which may help us recommend products and services that may be of interest to you.
  • If you visit our physical premises, we may collect image and video data through CCTV and security cameras.
  • Personal data included in CVs submitted to our Company for employment purposes.
  • Personal data relating to employees, suppliers, or other partners where required in order to comply with our statutory insurance and tax obligations.
  • Personal data included in complaints submitted to our Company or in any other request addressed to us.

8. FOR WHAT PURPOSES DO WE COLLECT YOUR DATA?

We collect and process your personal data, either physically or electronically, for the following purposes:

  1. To assess health data provided by you in order to recommend personalized dietary supplements.
  2. To carry out appropriate laboratory analyses that enable us to provide products and services based on personalized recommendations.
  3. To make use of your insurance coverage.
  4. To communicate with you, send you your test results, or send informational and promotional material regarding the Group’s services, news, and offers.
  5. To complete and deliver your order to the address specified by you.
  6. To issue the legally required documentation for each transaction.
  7. To comply with our obligations arising under applicable legislation, particularly tax-related obligations.
  8. To send you confirmation and dispatch emails regarding your order, or information, promotions, and newsletters about our products and services that may be of interest to you, where you have consented to receive such material.
  9. To recommend the most suitable products and services based on your preferences or purchase history and to improve the products and services we provide.
  10. To assess your qualifications and suitability for employment with our Company and to contact you if you submit your CV.
  11. To allow you to create a customer account on our official website using a username and password.
  12. To respond to enquiries submitted by email, through our contact form, or by telephone.
  13. To enter into a contractual relationship with you as an employee, partner, or supplier.
  14. To protect and secure our premises.

9. WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR DATA?

The processing of your personal data is based on:

  1. a) Performance of a Contract
     The need to fulfil obligations arising from a transaction involving you.

For example, the processing of personal data required to complete and deliver your order is based on the performance of the sales contract between us.

  1. b) Your Consent
     For example, where you provide health data for assessment and for us to recommend or provide an appropriate program, or where you provide a biological sample for laboratory analysis in order to provide personalized health and wellness programs or for microbiological analysis to identify potentially pathogenic microorganisms such as bacteria or viruses.

We will never process your health data unless we have first obtained your explicit consent and provided you with detailed information about the purpose of the processing.

This also applies where you have consented to receive informational material, news, and offers relating to our Group.

  1. c) Compliance with Legal Obligations
     Our obligation to comply with applicable regulatory requirements, particularly those relating to taxation, employment, and insurance.
  2. d) Legitimate Security Purposes
     The need to protect our staff and ensure the security of our premises.

10. WHO HAS ACCESS TO YOUR DATA?

Our Company grants access to your personal data only to authorized employees who, under their contractual obligations, are required to maintain the confidentiality of your information, prevent unlawful processing, and process your data only to the extent necessary and in accordance with the purposes of this Policy.

Furthermore, our Company will not transfer or disclose your personal data to third parties unless:

  1. a) such disclosure is required in order to comply with a legal obligation, such as tax obligations or compliance with prosecutorial or judicial orders; or
  2. b) the processing is carried out by companies cooperating with us which act either as Joint Data Controllers or as Data Processors on our behalf.

We ensure that our partners:

  • are contractually bound by confidentiality obligations;
  • implement appropriate technical and organizational measures to protect your personal data; and
  • do not transfer your personal data to third parties without our prior consent.

In addition, for reasons relating to the protection of the public interest in the field of public health, we may transfer your personal data to competent authorities where required by law, such as the Hellenic National Public Health Organization (EODY).

Companies and organizations that may have access to your data include, indicatively:

  • The company engaged by us to conduct laboratory analyses, including the other company within our Group, PRIVATE DIAGNOSTIC LABORATORY PERSONAL LABORATORIES MEDICAL I.K.E., trading under the name PERSONAL LABS, which acts exclusively as a Data Processor on our behalf.
  • Your insurance provider, where requested by you.
  • The company responsible for our bookkeeping and accounting obligations.
  • The courier company responsible for transporting and delivering your orders.
  • The company responsible for the development and technical support of our website.
  • The banking institution that processes personal data, such as debit or credit card details, during online payment through a secure payment environment.
  • The security company responsible for safeguarding our premises.

11. HOW LONG DO WE RETAIN YOUR DATA?

Our Company retains your personal data only for a predefined and limited period depending on the type of data and the purpose for which it was provided.

At the end of the relevant retention period, we ensure its secure deletion or destruction.

More specifically:

  1. i) Personal data relating to our tax, judicial, and other regulatory obligations is retained for the period required under the applicable legal framework.
  2. ii) Your personal health data is retained, in accordance with the applicable legal framework, for ten (10) years from the date of the patient’s last visit.

iii) If you have expressed an interest in receiving informational material from our Company, your consent remains valid until it is withdrawn.

You may withdraw your consent by contacting us using the Data Protection Officer’s contact details provided in this Privacy Policy or, in the case of informational emails, by selecting the unsubscribe link included in each email we send.

  1. iv) In all other cases, your personal data is retained for as long as required to fulfil the purpose for which it was provided.

12. DO WE TRANSFER YOUR DATA TO THIRD COUNTRIES?

Our Company does not transfer your personal data to third countries, meaning countries that are not Member States of the European Union.

Accordingly, we ensure that your personal data is processed only under the terms and safeguards provided by the GDPR framework.

13. IS YOUR DATA SECURE?

Recognizing the importance of protecting your personal data, our Company has implemented appropriate technical and organizational measures to ensure its security.

In particular, we implement the necessary security and preventive measures to prevent, to the extent reasonably possible, any unlawful or unauthorized processing of your data, as well as accidental or unlawful loss, alteration, unauthorized disclosure, or access by third parties.

We have also obtained ISO 9001:2015 quality certification and installed CCTV and security cameras at our premises.

14. WHAT RIGHTS DO YOU HAVE REGARDING YOUR PERSONAL DATA?

Right of Access

You have the right to receive accurate and clear information from us as to whether we collect and process your personal data.

You may request information regarding, among other things:

  • the purposes of processing;
  • the categories of personal data collected;
  • the sources of your data;
  • any recipients of your data;
  • the period for which your data will be retained or, where this is not possible, the criteria used to determine that period;
  • your right to request rectification, erasure, restriction, or objection to processing;
  • the existence of automated decision-making, including profiling;
  • the transfer of your personal data to a third country or international organization; and
  • the existence of appropriate safeguards relating to such transfers.

Right to Rectification

If you identify that the personal data we hold about you is inaccurate and requires correction, you may request that we rectify it using any of our available communication channels.

Right to Erasure / Right to Be Forgotten

You have the right to request the deletion of your personal data.

We will proceed with its deletion without undue delay where its retention is not necessary in order to comply with our legal obligations.

In particular, where you withdraw your consent and consent constitutes the sole legal basis for collecting and processing your data, we will delete your data as soon as we receive your request.

Right to Data Portability

You have the right to request that the personal data you have provided to us be supplied to you in an easily readable format or transferred to another Data Controller.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data where:

  1. a) you contest the accuracy of the data, for the period necessary to verify its accuracy;
     b) the processing is unlawful;
     c) we no longer require the data; or
     d) you object to automated processing.

Right to Object

You have the right to object at any time to the processing of your personal data.

In particular, you have the right to withdraw your consent at any time where processing is based on your consent.

If you object, we will cease processing your personal data without delay unless there are compelling legitimate grounds for the processing which override your rights.

In particular, where your personal data is used for direct marketing purposes relating to our products and services, you have the right to object at any time to the processing of your personal data for such marketing purposes, including profiling where it is related to direct marketing.

For example, if you receive newsletters relating to our products and services by email, you may choose to stop receiving them by selecting the relevant unsubscribe link provided at the end of each email.

15. HOW CAN YOU EXERCISE YOUR RIGHTS?

You may exercise your rights by contacting us:

  1. a) By post at the Company’s registered address:

PERSONAL WELLNESS HEALTH I.K.E.
 8 Ethnikis Antistaseos Street
 55133 Kalamaria, Greece

  1. b) By contacting our Data Protection Officer (DPO):

Email: dpo@personalwellness.health
 Telephone: +30 698 600 0264

Our Company will respond as soon as possible regarding the progress of your request.

In all cases, you will receive a response within one (1) month from the date on which we receive your request.

However, if your request is complex or if a large number of requests have been received during that period, we will inform you if an extension of up to two (2) additional months is required.

16. DO WE USE AUTOMATED DECISION-MAKING, INCLUDING PROFILING, WHEN PROCESSING YOUR DATA?

We carry out automated profiling through an automated process when you choose to complete the quiz available on our website.

Once the quiz has been completed, a member of our team will contact you to provide information regarding the next steps in the process.

It is important to note that we always request your explicit consent before carrying out this type of processing and ensure that you are clearly informed about the scope of your consent.

We also implement appropriate measures to protect your rights, freedoms, and legitimate interests.

In particular, you are able to contact our qualified professionals at any time in order to receive guidance regarding the suitability of products and services selected either by you or suggested through the quiz.

17. GOVERNING LAW AND DISPUTE RESOLUTION

The applicable law is Greek law, as interpreted and applied in accordance with the General Data Protection Regulation (EU) 2016/679 in conjunction with the provisions of Greek Law 4624/2019.

Any dispute arising in relation to this Privacy Policy shall fall under the exclusive jurisdiction of the courts of Thessaloniki.

If you believe that our Company has infringed your rights in relation to the processing of your personal data, you have the right to lodge a complaint with the Hellenic Data Protection Authority at www.dpa.gr, using the following contact details:

1–3 Kifisias Avenue
 115 23 Athens, Greece
 Telephone: +30 210 6475600
 Email: contact@dpa.gr

THIRD-PARTY WEBSITE DISCLAIMER

Our Company accepts no responsibility for the content of third-party websites to which you may be redirected while browsing our website by selecting links available on it.

This Policy may be reviewed and updated whenever we consider it necessary.

We encourage you to regularly visit our website, where the most recent version of our Privacy Policy is published.

This Privacy Policy was last updated on 7 September 2021.



Scroll to Top