GDPR & Data Protection

Physiologio is committed to handling personal data with respect, transparency, and legal compliance. We design our platform with data protection in mind from the outset (“privacy by design and by default” — GDPR Article 25), and we take our obligations under Regulation (EU) 2016/679 (“GDPR”) and applicable Cyprus and EU national data protection law seriously.

This page provides a focused summary of our data protection approach, your rights, and how to exercise them. For full details of what data we collect and how we use it, please read our Privacy Policy.

Physiologio operates in a dual capacity:

• As a data controller for website visitors and platform account holders (clinic staff).
• As a data processor for patient records entered into the platform by subscribing clinics (who are the data controllers for their patients’ data).

We adhere to all seven data protection principles set out in GDPR Article 5:

• Lawfulness, fairness, and transparency: We process data on a valid legal basis and are transparent about how and why we process it.
• Purpose limitation: Data is collected for specified, explicit, and legitimate purposes and is not processed in ways incompatible with those purposes.
• Data minimisation: We only collect data that is adequate, relevant, and necessary for the purposes for which it is processed.
• Accuracy: We take reasonable steps to ensure data is kept accurate and up to date. Users can update their own account details at any time.
• Storage limitation: Personal data is kept in a form that permits identification no longer than necessary (see retention periods in our Privacy Policy — Section 8).
• Integrity and confidentiality: We apply appropriate technical and organisational security measures to protect data against unauthorised access, disclosure, loss, or destruction.
• Accountability: We maintain records of processing activities, enter into DPAs with sub-processors, and can demonstrate compliance upon request.

If you are an individual whose personal data is processed by Physiologio as a data controller (i.e. you are a website visitor, or a clinic staff member with an account), the following rights apply to you under the GDPR:

To exercise any of your GDPR rights regarding data controlled by Physiologio, please contact us by:

• Email (preferred): support@physiologio.com
  Please include “Data Subject Request” in the subject line and specify which right(s) you wish to exercise.

Identity Verification

To protect your personal data, we may ask you to verify your identity before processing your request. This is to ensure we do not disclose or modify data to or at the direction of an unauthorised person. We will request only the minimum information necessary for verification and will not use it for any other purpose.

What to Include in Your Request

• Your full name and the email address associated with your account
• The specific right(s) you are exercising
• Any additional context that helps us locate and process your data

Requests are free of charge. However, if requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or refuse to act on the request, in accordance with GDPR Article 12(5).

We will acknowledge receipt of your request promptly and keep you informed of progress.

If you are not satisfied with how we have handled your personal data or responded to a request, you have the right to lodge a complaint with a data protection supervisory authority. You may contact the authority in the EU/EEA country where you reside, work, or where the alleged infringement occurred.

We always encourage you to contact us at support@physiologio.com first so that we have the opportunity to address your concern directly and efficiently.

We apply technical and organisational security measures appropriate to the risk involved in processing personal data, particularly given that the platform processes special category health data. Key measures include:

Security is an ongoing commitment. We conduct regular security reviews and update our practices in line with evolving threats and industry standards. If you discover a potential security vulnerability, please report it responsibly to support@physiologio.com.

GDPR Article 28 requires that any data processor used by a data controller is bound by a written Data Processing Agreement (DPA) that sets out the subject matter, duration, nature, purpose, and type of processing, as well as the obligations and rights of the controller.

Clinics Using Physiologio

By accepting our Terms & Conditions, subscribing clinics enter into a DPA with Physiologio (see Terms, Section 7). This DPA governs how Physiologio processes patient data on the clinic’s behalf as a data processor.

If your clinic requires a separately signed DPA document for your own compliance records or for regulatory purposes, please contact us at support@physiologio.com and we will arrange this.

Physiologio’s Sub-Processors

Physiologio, in turn, has DPAs in place with all third-party sub-processors that handle personal data on our behalf — including Amazon Web Services EMEA SARL (platform hosting, Ireland), Vercel Inc. (website hosting), Stripe Technology Europe Ltd (payments, Ireland), and our email and SMS notification providers. A current list of sub-processors is available in our Privacy Policy — Section 6. We notify subscribing clinics of any changes to this list with at least 14 days’ notice.

Records of Processing Activities

We maintain internal Records of Processing Activities (ROPA) as required by GDPR Article 30, documenting the purposes, categories, recipients, and retention periods for all personal data we process, both as controller and as processor.

Health data is classified as special category data under GDPR Article 9 and carries heightened protection obligations. The processing of health data is generally prohibited unless a specific exception in Article 9(2) applies.

Physiologio handles health data exclusively as a data processor, acting on the documented instructions of the clinic (data controller). The clinic bears the primary legal responsibility for ensuring:

• A valid Article 9(2) exception applies to all health data they process — typically Article 9(2)(h) (healthcare provision) or Article 9(2)(a) (explicit consent).
• Patients have been informed of how their health data is used, including the use of Physiologio as a processing tool.
• Health data is only recorded by qualified or appropriately supervised healthcare professionals subject to professional confidentiality obligations.
• The national health law applicable in Cyprus and/or Greece (as relevant to the clinic) is complied with — including any specific requirements for medical record processing that go beyond GDPR.

For any GDPR-related enquiry, data subject access request, or compliance question:

• Email: support@physiologio.com
• DPO: Not yet appointed — contact the above email address