Privacy Policy

Last updated: 30 October 2026

This Privacy Policy explains how Evexia Plus collects, uses, stores and protects the personal information you share with us through evexia.ie and any other public-facing Evexia Plus website (the "website"). It applies to everyone who contacts us through this website, including patients, family members, GPs and other healthcare professionals.

We have written this policy in plain English. If anything is unclear, or if you want to exercise any of your rights, contact us at info@evexia.ie.

1. Who we are

The data controller responsible for your personal information is International Centre for Recovery and Rehabilitation S.A., trading as Evexia Plus.

Registered office: 35th km Thessaloniki - Nea Moudania, 63080 Chalkidiki, Greece.

We have appointed a Data Protection Officer. You can contact our Data Protection Officer directly at dpo@evexia.com.

For any data protection question or request, you can also reach our team at info@evexia.ie or on 01 263 3051.

2. What information we collect

We only collect what we need to respond to you and, where relevant, to assess whether our rehabilitation programme is suitable.

Contact details you give us. When you complete a callback or enquiry form on our website or in one of our Facebook, Instagram or TikTok adverts, or when you email, call or message us (including on Facebook Messenger, Instagram or WhatsApp), we collect your name, phone number, email address and any other details you choose to include.

Forms in our Facebook and Instagram adverts. Some of our adverts on Facebook and Instagram include a short form. When you open it, Meta may fill in your name, email address and phone number from your Facebook or Instagram account; you can check and change them before you send it. When you press submit, Meta passes us the details in the form and your answers to its questions. The form does not ask about anyone's health. We use these details only to reply to your request, as we would for an enquiry made on our website.

Forms in our TikTok adverts. Some of our adverts on TikTok include a short form. When you open it, TikTok may fill in your name, email address and phone number from your TikTok account; you can check and change them before you send it. When you press submit, TikTok passes us the details in the form. The form does not ask about anyone's health. We use these details only to reply to your request, as we would for an enquiry made on our website.

Health information you choose to share. To help us understand your enquiry, you may tell us about a patient's medical condition, diagnosis, treatment history or care needs. Information about health is a special category of personal data under Article 9 of the GDPR, and we treat it with particular care. You are never required to share health information to contact us, and you should share only what you are comfortable sharing at this stage.

Technical and usage data. When you visit the website, limited technical data may be collected through cookies and similar technologies, such as your device type, browser, approximate location (derived from your IP address) and how you use our pages. This only happens for non-essential purposes if you have given your consent. See our Cookie Policy for the full detail.

We do not collect financial information, payment card details, government identifiers, or any personal information beyond what is necessary for the purpose described to you.

3. Why we use your information, and our lawful basis

Under the GDPR we must have a lawful basis for using your personal information. Our bases are:

• Your consent, and our legitimate interest in responding to enquiries, for your contact details. When you send us an enquiry you are asking us to reply, and it is in our legitimate interest, and yours, that we do so.
• Your explicit consent under Article 9(2)(a) of the GDPR, for any health information you choose to share. When you submit the form you confirm your consent to us using the contact details and any health information you provide in order to respond to your enquiry. You can withdraw this consent at any time (see section 7).
• Our legitimate interest in keeping the website secure and working well, for essential technical data.
• Your consent, for all non-essential cookies and tracking, including analytics and advertising technologies. These are only used if you accept them through our cookie banner.

We use your information to respond to your enquiry and arrange a callback or email reply from our team; to assess, with our clinical team, whether our programme may be suitable and what the next steps could be; to send you the information you ask for about our services and the EU Cross-Border Healthcare Directive; and to keep the website secure and improve how it works.

When you reach our website from a Google advert, Google adds a click identifier to the link. If you then contact us, we keep this identifier with your enquiry and later tell Google whether the enquiry went on to a clinical assessment or an admission, sending only the identifier, the outcome and the date. We do this to measure and improve our advertising. We never send your name, contact details or any health information to Google. We only keep and send the identifier if you have accepted advertising cookies.

When you send us a form through a Facebook, Instagram or TikTok advert, or message us on Facebook, Instagram or WhatsApp, we use your details on the same bases as a website enquiry: you have asked us to contact you, and it is in our legitimate interest, and yours, that we reply. If you share health information in a message, we rely on your explicit consent, as described above; please share only what you are comfortable sharing, and our team will ask for anything else we need by phone or email. If you have accepted advertising cookies, the Meta Pixel tells Meta that a form was sent from our website, but never what you wrote in it. We do not send Meta anything else about your enquiry, including whether it led to a clinical assessment or an admission. If you have accepted advertising cookies and send a form from our home, How it works, About us, Facilities or Contact page, the TikTok Pixel tells TikTok that a form was sent, but never what you wrote in it. We do not send TikTok anything else about your enquiry, including whether it led to a clinical assessment or an admission. Meta's own use of information about how you use its services, including that you saw or responded to one of our adverts, is governed by Meta's Privacy Policy, and TikTok's own use is governed by TikTok's Privacy Policy.

We do not sell, rent or trade your information. We do not share your information with third parties for their own marketing. We do not make any decision about you by automated means alone.

4. Who has access to your information

Within Evexia Plus, your information is seen only by the people who need it: our team, who are your first point of contact; the Physical Medicine and Rehabilitation Physician and clinical team who assess suitability; and the administrative staff who support your enquiry.

We use a small number of carefully chosen service providers ("processors") who handle data on our behalf and under contract. They may only use your data on our instructions:

• Webflow, Inc. hosts the website and processes form submissions, which are stored in Webflow and emailed to our team.
• Cloudflare, Inc. provides content delivery and security for the website.
• Our business email provider delivers and stores the email correspondence between us.
• CookieYes Limited records your cookie consent choices.
• Google (Google Ireland Limited / Google LLC) provides Google Analytics and Google Ads, used only if you accept analytics or advertising cookies.
• Microsoft Corporation provides Microsoft Clarity analytics, used only if you accept analytics cookies.
• Meta Platforms Ireland Limited provides the forms in our Facebook and Instagram adverts and passes us the details you send through them.
• Meta Platforms Ireland Limited also provides the Meta Pixel, used on our website only if you accept advertising cookies. It tells Meta which of our pages you visit, and when you send us a form or tap to call, email or message us, so we can measure our Facebook and Instagram adverts and show them to people who have visited our website. It never receives what you type into our forms.

If you message us on Facebook, Instagram or WhatsApp, your messages are carried by Meta Platforms Ireland Limited or WhatsApp Ireland Limited under their own terms and privacy policies, which you agreed to when you joined those services. Only the members of our team who reply to enquiries read these messages, and we copy into our enquiry records only what we need to help you.

The forms in our TikTok adverts are provided by TikTok Technology Limited, which passes us the details you send through them. TikTok also keeps those details and may use them for its own purposes under TikTok's Privacy Policy, for example to fill in forms for you in future.

TikTok Technology Limited also provides the TikTok Pixel, used only on our home, How it works, About us, Facilities and Contact pages, and only if you accept advertising cookies. It tells TikTok when you visit one of those pages, and when you send us a form or tap to call, email or message us from them, so we can measure our TikTok adverts and show them to people who have visited our website. It is never used on our pages about conditions or treatments, and it never receives what you type into our forms.

We may also disclose information where we are legally required to do so, for example to comply with a court order or a lawful request from an authority.

5. International transfers

We operate in Greece and reply to Irish families from Ireland, both within the European Economic Area (EEA). Some of our service providers are based in the United States. Where your information is transferred outside the EEA, that transfer is protected by an appropriate safeguard under Chapter V of the GDPR, namely the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses under Article 46. You can ask us for more detail about these safeguards at any time.

6. How long we keep your information

We keep your information only for as long as we need it.

• Enquiries that do not lead to admission, including those sent through a Facebook, Instagram or TikTok advert form or by message: we keep your enquiry and correspondence for up to 24 months, so we can follow up helpfully if you contact us again, and then delete it.
• Patients who are admitted: clinical records are kept by the hospital in line with Greek medical-record law, which sets minimum retention periods (generally at least ten years, and longer for the records of children).

When information is no longer needed, we securely delete or anonymise it.

7. Your rights

Under the GDPR you have the right to be informed, to access your information, to rectify inaccurate or incomplete information, to erase your information where there is no overriding reason to keep it, to restrict or object to our use of it, to data portability, and to withdraw consent at any time where we rely on your consent, including your consent to us using health information. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

To exercise any right, contact info@evexia.ie or our Data Protection Officer at dpo@evexia.com. We will respond within one month. There is normally no charge.

If you are unhappy with how we have handled your information, you have the right to complain to a data protection supervisory authority. As our operations are based in Greece, our lead authority is the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, Greece; www.dpa.gr). If you are resident in Ireland, you may also complain to the Data Protection Commission (21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland; www.dataprotection.ie). We would, however, appreciate the chance to resolve your concern first.

8. Children's information

We do not knowingly collect personal information directly from children. In Ireland the digital age of consent is 16. Where an enquiry concerns a child, we expect it to be made by a parent or guardian. If you believe a child has given us information without the consent of a parent or guardian, contact us at info@evexia.ie and we will delete it.

9. How we keep your information secure

We use appropriate technical and organisational measures to protect your information, including encryption of the website in transit (HTTPS), access controls that limit who can see your data, and confidentiality obligations on our staff and processors. No method of transmission or storage is completely secure, but we take these obligations seriously. If you become aware of a security concern, please tell us at info@evexia.ie.

10. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top, and, where the change is significant, we will take reasonable steps to bring it to your attention.

11. How to contact us

For any question about this policy or your personal information:

Data Protection Officer: dpo@evexia.com
Enquiries: info@evexia.ie · 01 263 3051
Post: International Centre for Recovery and Rehabilitation S.A., 35th km Thessaloniki - Nea Moudania, 63080 Chalkidiki, Greece.