Privacy Policy

1. Who we are

AION is a physician-led preventive health and longevity clinic in Limassol, Cyprus. The clinic and this website are operated by L. A. Business Consultancy Ltd, a company registered in Cyprus under registration number HE 204481. Under data protection law, L. A. Business Consultancy Ltd is the controller of the personal data described in this policy. That means we decide why and how your data is processed, and we are responsible for protecting it.

• Controller: L. A. Business Consultancy Ltd, operating the AION clinic brand
• Address: Kyriakou Matsi 11, 7th Floor, Office 701, 1082 Nicosia, Cyprus
• Email for privacy matters: [email protected]
• Phone: +357 99 842210
• Website: https://www.aion-health.eu

2. What data we collect

This website is informational. It describes our diagnostics, therapies, and programs, and invites you to book a consultation. There are no user accounts, no patient portal, and no online medical records on this site. Some features are provided by trusted third parties: consultation and contact forms are provided by Vibey, our practice management provider; online appointment scheduling is handled by Calendly; and online payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers.

We collect three kinds of data, and only the first depends on you actively giving it to us:

• Data you give us. When you call us, email us, or submit a form on this site, we receive whatever you choose to share: typically your name, contact details, and the reason for your enquiry. If you tell us about your health, for example symptoms or conditions you want to discuss at a consultation, that information becomes part of your enquiry. Health information is special-category data and we treat it with extra care, as explained in section 4.
• Technical data processed automatically. Our hosting provider processes basic technical data, such as your IP address and server logs, to deliver the website and keep it secure. This happens for every visitor and does not depend on cookies or consent.
• Analytics and marketing data, only with your consent. If, and only if, you click Accept on our cookie banner, we use Google Analytics 4, Meta Pixel, and Microsoft Clarity to understand how visitors use the site and to measure our advertising. Nothing from these tools loads before you consent. Details are in our Cookie Policy.

3. Why we process your data, and the legal bases

GDPR requires us to have a legal basis for every use of your data. Here is what we do and why we are allowed to do it:

• Responding to your enquiries and arranging consultations. When you contact us about our services, we process your details to answer you and to take the steps you ask for before entering into an agreement with us. Legal basis: performance of a contract, or steps taken at your request before entering into one, under Article 6(1)(b) GDPR.
• Health information you include in an enquiry. If your enquiry contains health details, we process them to respond to you and, where you go on to become a patient, for the provision of health care. Legal basis: your explicit consent under Article 9(2)(a) GDPR, and/or provision of health care under Article 9(2)(h) GDPR, alongside Article 6(1)(b).
• Analytics and marketing. We measure how the website is used and how our advertising performs, using the consent-gated tools described in the Cookie Policy. Legal basis: your consent under Article 6(1)(a) GDPR. You can withdraw it at any time via the Cookie preferences link in the footer.
• Security and site operation. We and our hosting provider process technical data such as IP addresses and server logs to deliver the website, prevent abuse, and keep the site secure. Legal basis: our legitimate interests in running a secure, functioning website, under Article 6(1)(f) GDPR.
• Taking payments. Where you pay for a service online, we process what is needed to charge you and to keep the accounting records the law requires. Your card details are collected and processed by Stripe, not stored by us. Legal basis: performance of a contract under Article 6(1)(b) GDPR, and our legal obligations under Article 6(1)(c) GDPR.

Two more things the law asks us to state. You are never under any statutory or contractual obligation to give us personal data: contacting us is entirely your choice, and the only consequence of not providing your details is that we cannot respond to an enquiry. And we do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

4. A special note on health data

The website itself does not collect health data. It has no forms, no symptom checkers, and no patient login. But we are a clinic, so people often mention their health when they email or call us. If you do, that information counts as special-category data under Article 9 GDPR, which means the law gives it stronger protection and so do we. We use it only to respond to your enquiry and, if you become a patient, to provide your care. We limit who can see it and we never use it for advertising.

Your clinical records, meaning the medical documentation created when you are examined and treated at the clinic, are governed by the separate patient documentation you receive at the clinic, not by this website policy.

One important note: this website and our phone line are not for emergencies. In a medical emergency, call 112.

5. Who we share your data with

We do not sell your personal data. We do not share it with advertisers, data brokers, or anyone else for their own purposes. The only third parties that handle website data are our processors, meaning companies that process data on our behalf, under contract, and only on our instructions:

• Vercel Inc. hosts the website and processes server logs, including IP addresses, to deliver the site and keep it secure.
• Google (Google Ireland Ltd / Google LLC) provides Google Analytics 4, which runs only after you consent via the cookie banner.
• Meta (Meta Platforms Ireland Ltd) provides the Meta Pixel, which runs only after you consent.
• Microsoft (Microsoft Ireland Operations Ltd / Microsoft Corp) provides Microsoft Clarity, which runs only after you consent.
• Vibey (vibey.im) provides the consultation and contact forms and the practice management system that receives your enquiries, including any health details you choose to include in them.
• Calendly LLC provides online appointment scheduling when you book a time slot through the site.
• Stripe (Stripe Payments Europe Ltd and Stripe Inc.) processes online payments. Stripe receives your card details directly, and also acts as an independent controller for its own legal duties such as fraud prevention.

6. International transfers

Some of our providers, including Vercel, Google, Meta, Microsoft, Calendly, and Stripe, may process data in the United States. Where that happens, the transfer is protected by an EU adequacy decision under the EU-US Data Privacy Framework for companies certified under it, and by the European Commission's Standard Contractual Clauses where applicable. These mechanisms are designed to give your data the same level of protection it has in the EU. You can contact us at [email protected] to obtain more information about these safeguards, including a copy of the Standard Contractual Clauses where they apply.

7. How long we keep your data

Our principle is simple: we do not keep personal data longer than we need it.

Enquiries by phone or email are kept only as long as needed to handle them and to meet any legal obligations that apply to us, for example accounting or record-keeping duties under Cyprus law. When an enquiry leads to treatment, the retention of your clinical records is governed by the patient documentation provided at the clinic.

Analytics and marketing data is retained according to the retention settings of the tools described in the Cookie Policy, and only if you consented to those tools in the first place. Server logs are kept by our hosting provider for the short periods needed for security and troubleshooting.

8. Your rights

Under the GDPR and Cyprus Law 125(I)/2018, you have the following rights over your personal data. To exercise any of them, email us at [email protected]. We will respond within the timeframes the law sets, normally one month.

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your data, where the law allows.
• Restriction: ask us to limit how we use your data in certain situations.
• Portability: receive the data you gave us in a structured, machine-readable format.
• Objection: object to processing based on our legitimate interests.
• Withdrawal of consent: withdraw any consent you have given, at any time. Withdrawal does not affect the lawfulness of processing that happened before it. For cookies, use the Cookie preferences link in the footer.
• Complaint: lodge a complaint with the supervisory authority. In Cyprus, that is the Office of the Commissioner for Personal Data Protection, www.dataprotection.gov.cy. You can also complain to the authority in the EU country where you live or work. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.

9. Cookies

The only thing this website stores on your device without asking is your cookie choice itself, saved in your browser's localStorage. Everything else, meaning Google Analytics 4, Meta Pixel, and Microsoft Clarity, loads only after you click Accept on the cookie banner, and you can change your choice at any time via the Cookie preferences link in the footer. Full details, including what each tool does, are in our Cookie Policy.

10. Children

Our services are for adults aged 18 and over, and this website is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us at [email protected] and we will delete it.

11. Changes to this policy

We may update this policy from time to time, for example when we add features to the website, change providers, or when the law changes. When we do, we will publish the new version on this page and update the date at the top. If a change is significant, for example adding a consultation form that collects new data, we will make the change visible on the site before it takes effect. We encourage you to check this page occasionally.

12. Contact us

For any question about this policy, or to exercise your rights, contact us:

• Email: [email protected]
• Post: L. A. Business Consultancy Ltd, Kyriakou Matsi 11, 7th Floor, Office 701, 1082 Nicosia, Cyprus
• Phone: +357 99 842210