Privacy Policy
Last updated: September 2026
Thank you for visiting Tsintavis Functional Medicine.
This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when you visit tsintavismed.com, contact us, purchase educational or digital products, subscribe to communications, or receive professional services from either of the independent healthcare practitioners presented through this website.
Tsintavis Functional Medicine is a shared professional brand and website through which two independent healthcare practitioners present their work:
Panagiotis Tsintavis, MSc, RD, FMCP — Dietitian–Nutritionist, independent dietetic practice.
Dr. Varvara Zisimidou, MD — Specialist in Internal Medicine, independent medical practice.
The appropriate data controller depends on the purpose for which your personal data is processed, as explained below.
This Privacy Policy applies when you:
- visit tsintavismed.com;
- contact us through the website, email, booking links, forms, or social media;
- enquire about or book a consultation or professional service;
- purchase a digital product, programme, guide, or other educational material;
- subscribe to a newsletter or marketing communication;
- interact with website analytics, advertising, or tracking technologies;
- use third-party platforms connected with a relevant service, such as Practice Better or Stripe.
This Privacy Policy does not replace any specific consent form, intake form, professional-service privacy information, informed consent, patient portal notice, or other document that may apply to a particular professional service.
For general privacy enquiries, you may contact:
Tsintavis Functional Medicine
Rodou 10, Marousi, 151 22, Athens, Greece
Email: info@tsintavismed.com
1. Who is responsible for your personal data?
The data controller depends on the activity concerned.
A. Website, marketing, digital products, and Panagiotis Tsintavis’s services
For personal data processed in connection with:
- operation and administration of tsintavismed.com;
- general website enquiries;
- newsletter and marketing communications;
- website analytics and advertising;
- digital products, guides, educational programmes, and other commercial materials sold by Panagiotis Tsintavis;
- enquiries, bookings, communications, and professional services relating to the independent dietetic practice of Panagiotis Tsintavis;
the data controller is:
Panagiotis Tsintavis
Dietitian–Nutritionist
Rodou 10, Marousi, 151 22, Athens, Greece
Email: info@tsintavismed.com
B. Medical services provided by Dr. Varvara Zisimidou
Where personal data is processed in connection with:
- an enquiry specifically concerning medical care from Dr. Varvara Zisimidou;
- a medical consultation booked with Dr. Varvara Zisimidou;
- medical assessment, diagnosis, treatment, prescribing, laboratory evaluation, follow-up, medical records, or other medical services provided through her independent medical practice;
the data controller for that processing is:
Dr. Varvara Zisimidou, MD
Specialist in Internal Medicine
Independent medical practice
Rodou 10, Marousi, 151 22, Athens, Greece
Privacy enquiries may be directed to: info@tsintavismed.com
C. Shared platform access and collaborative processing
Both practitioners may use the same Practice Better practice-management environment. Depending on the platform configuration, each practitioner may technically be capable of accessing records associated with the shared environment.
Access to personal and health information is intended to be limited to information that is necessary for the relevant professional service, legitimate administrative purpose, or agreed collaborative care.
Where a patient receives services from only one practitioner, that practitioner remains responsible for the professional record created and used for their own independent practice. The other practitioner should not access or use that patient’s health information unless there is an appropriate professional, administrative, legal, or collaborative-care reason to do so.
Where a patient receives care from both practitioners and information is intentionally shared as part of that collaboration, each practitioner remains responsible for their own professional services and records.
For any specific processing activity for which both practitioners jointly determine the purposes and essential means of processing, they may act as joint controllers in accordance with Article 26 GDPR.
The allocation of data-protection roles therefore depends on the specific processing activity and the actual use of the information, rather than solely on the technical structure of the shared platform.
D. Third-party service providers
Platforms and providers such as Practice Better, Stripe, Google, Meta, CookieYes, hosting companies, and email providers may process personal data on behalf of one or both controllers, or in some circumstances as independent controllers for their own processing purposes.
Their role depends on the relevant service and processing activity.
2. What personal data do we collect?
The personal data collected depends on how you interact with the website and which practitioner or service you engage with.
A. Information you provide directly
This may include information provided when you:
- contact the website or either practitioner;
- send an email;
- complete a contact, booking, intake, or health-related form;
- book a consultation or other professional service;
- purchase a programme, guide, digital product, or educational resource;
- subscribe to a newsletter;
- respond to surveys or feedback requests;
- provide a testimonial or review;
- communicate through Practice Better or another designated professional communication channel.
Depending on the context, this may include:
- name;
- email address;
- telephone number;
- country or location;
- billing information;
- appointment information;
- communication preferences;
- information contained in messages or enquiries;
- health, nutrition, lifestyle, laboratory, medication, or medical information where relevant to the service requested;
- any other information you choose to provide.
B. Health-related information
Health data is a special category of personal data under the GDPR.
Depending on the professional service involved, health-related information may include:
- symptoms;
- medical history;
- diagnoses;
- medications;
- supplements;
- nutrition and lifestyle information;
- laboratory results;
- family history;
- menstrual or hormonal information;
- digestive, metabolic, immune, neurological, cardiovascular, or other health information;
- health goals;
- clinical history;
- consultation notes and professional communications.
Health-related information is processed only where there is an appropriate lawful basis under the GDPR and an applicable condition for processing special-category data.
Where health data relates to the professional services of Panagiotis Tsintavis, it is processed in connection with his independent dietetic practice.
Where health data relates to medical services provided by Dr. Varvara Zisimidou, it is processed in connection with her independent medical practice.
Detailed professional records, health histories, laboratory information, consultation records, and relevant communications may be collected and stored through Practice Better or another approved professional platform.
Because both practitioners may technically have access within the same Practice Better environment, access to identifiable health information should be limited in practice to what is necessary for the relevant professional service, legitimate administration, or collaborative care.
We do not intentionally use identifiable health information for advertising targeting, retargeting, or marketing profiling.
C. Payment and transaction information
If you purchase a professional service, programme, digital product, or other paid resource, payment may be processed by Stripe or another payment provider.
Full payment-card information is not stored directly on the website.
Depending on the transaction, the relevant controller may receive:
- name;
- email address;
- billing information;
- amount paid;
- payment status;
- invoice or receipt information;
- transaction reference;
- product or professional service purchased.
Payment and accounting records may be retained where required for legal, accounting, tax, fraud-prevention, or regulatory purposes.
D. Information collected automatically
When you visit the website, technical information may be collected through cookies, pixels, analytics tools, server logs, and similar technologies.
This may include:
- IP address;
- browser type;
- device type;
- operating system;
- referring website;
- pages visited;
- date and time of visit;
- approximate location derived from IP address;
- interaction with pages, buttons, forms, videos, or links;
- purchase or conversion events;
- cookie or advertising identifiers, where applicable.
E. Cookies, analytics, and advertising information
The website may use:
- essential cookies;
- functional cookies;
- analytics tools such as Google Analytics or Google Site Kit;
- advertising or measurement tools such as Meta Pixel;
- conversion tracking;
- tags, pixels, scripts, or similar technologies.
Non-essential technologies are used only where legally permitted and, where consent is required, after the relevant consent has been provided.
Cookie preferences can be managed through the website’s cookie settings tool.
Please see the Cookie Policy for further information.
3. How do we collect personal data?
Personal data may be collected:
A. Directly from you
For example, when you contact us, submit a form, book an appointment, purchase a product, complete an intake form, or communicate through Practice Better.
B. Automatically through the website
For example, through cookies, analytics tools, pixels, tags, server logs, and similar technologies.
C. Through third-party providers
Depending on the relevant processing activity, information may be received from:
- Practice Better;
- Stripe;
- Google;
- Meta;
- email marketing platforms;
- booking or scheduling tools;
- website hosting and security providers;
- accounting, legal, insurance, or administrative providers.
4. Why is personal data used?
Personal data is processed only for purposes relevant to the controller concerned.
A. Responding to enquiries
Contact details and message content may be used to respond to enquiries, provide requested information, or direct an enquiry to the relevant practitioner or service.
B. Providing professional services
Where you engage Panagiotis Tsintavis, personal data may be processed to arrange, provide, document, and manage services within his independent dietetic practice.
Where you engage Dr. Varvara Zisimidou, personal data may be processed to arrange, provide, document, and manage medical services within her independent medical practice.
C. Managing bookings and appointments
Data may be used to:
- schedule appointments;
- send confirmations and reminders;
- manage changes or cancellations;
- provide access to the relevant professional platform or portal.
D. Practice Better and professional records
Both practitioners may use Practice Better within a shared practice-management environment.
The platform may technically permit access by both practitioners to records held within that environment. However, access to identifiable health information should be limited to what is necessary for the relevant professional service, legitimate administration, or collaborative care.
Where you work with only one practitioner, your professional record is used primarily for the services of that practitioner.
Where you work with both practitioners, relevant information may be shared between them where necessary for coordinated care and in accordance with applicable data-protection and professional-confidentiality requirements.
Practice Better may be used to manage:
- intake forms;
- health questionnaires;
- appointments;
- messages;
- documents;
- laboratory information;
- recommendations;
- professional or clinical records.
E. Payments and purchases
Data may be processed to:
- process payments;
- issue invoices or receipts;
- administer orders;
- provide access to purchased materials;
- meet accounting and tax obligations.
The controller for a transaction is ordinarily the practitioner or business that supplies and invoices the relevant service or product.
F. Administrative communications
This may include:
- appointment reminders;
- payment confirmations;
- portal invitations;
- policy updates;
- service notices;
- other non-marketing communications.
G. Newsletter and marketing communications
Where you have subscribed or another lawful basis applies, Panagiotis Tsintavis, as website operator, may process contact information for newsletter and marketing communications relating to the website, educational content, programmes, products, or services presented through the website.
You may unsubscribe at any time.
H. Improving the website
Website analytics and feedback may be used to understand website performance, improve usability, identify technical problems, and improve general content.
I. Advertising and conversion measurement
Where legally required consent has been provided, advertising and analytics tools may be used to measure campaign performance and conversions.
These may record events such as:
- page views;
- purchases;
- bookings;
- form submissions.
Identifiable health data is not intentionally used for advertising targeting.
J. Testimonials
Identifying testimonials, reviews, names, photographs, or health experiences are published only with appropriate permission.
K. Security and fraud prevention
Personal data may be processed where necessary to protect systems, investigate misuse, prevent fraud, and maintain website and account security.
L. Legal and professional obligations
Data may be processed where necessary for:
- tax and accounting;
- professional obligations;
- healthcare obligations;
- regulatory compliance;
- insurance;
- disputes or legal claims;
- other requirements imposed by law.
5. What legal bases are relied on?
The relevant controller relies on one or more lawful bases under the GDPR depending on the processing activity.
These may include:
A. Consent
For example:
- newsletter subscriptions;
- optional cookies;
- advertising or analytics technologies;
- testimonials;
- certain communications;
- processing for which explicit consent is required.
Consent may be withdrawn at any time where processing is based on consent.
B. Performance of a contract or steps requested before entering into a contract
This may apply where processing is necessary to:
- arrange or provide a requested professional service;
- process a purchase;
- supply a digital product or programme;
- administer a booking.
C. Legitimate interests
Where appropriate, personal data may be processed for legitimate interests such as:
- responding to general enquiries;
- maintaining website security;
- preventing fraud;
- managing website operations;
- improving website functionality;
- maintaining appropriate administrative records.
Legitimate interests are relied upon only where those interests are not overridden by the rights and freedoms of the individual.
D. Legal obligation
Data may be processed where required by tax, accounting, professional, healthcare, regulatory, or other legal obligations.
E. Special-category and health data
Health data is processed only where both an Article 6 lawful basis and an applicable Article 9 condition are satisfied.
Depending on the circumstances, the Article 9 condition may include:
- processing necessary for healthcare or professional health-related purposes by or under the responsibility of a professional subject to applicable confidentiality obligations;
- explicit consent;
- establishment, exercise, or defence of legal claims;
- processing required or permitted under applicable law.
The applicable basis depends on the practitioner, service, and particular processing activity.
6. Marketing and advertising
A. Email marketing
If you subscribe to a newsletter or otherwise lawfully receive marketing communications, you may receive:
- educational content;
- programme information;
- service updates;
- offers;
- events;
- announcements.
You can unsubscribe at any time through the unsubscribe link or by contacting info@tsintavismed.com.
B. Advertising and retargeting
Where legally permitted and consent has been provided where required, advertising technologies such as Meta and Google tools may process online identifiers and website-interaction data.
This may include:
- IP address;
- cookie identifiers;
- device information;
- browser information;
- page views;
- conversion events.
Health records, diagnoses, clinical notes, laboratory data, and other identifiable special-category health data are not intentionally uploaded for advertising targeting.
7. Who is personal data shared with?
Personal data is not sold for money.
Depending on the relevant controller and processing activity, personal data may be shared with service providers necessary for website operation or the relevant professional service.
These may include:
A. Practice Better
Practice Better may be used in connection with professional records, appointments, forms, communications, and relevant health information.
Both practitioners may technically have access to records within the shared Practice Better environment.
Such access should be used only where necessary for the relevant professional service, legitimate administration, or collaborative care.
Where one practitioner provides the service independently, the other practitioner should not access or use the corresponding health record without an appropriate professional, administrative, legal, or collaborative-care reason.
B. Payment processors
Stripe or another payment provider may process payment information.
C. Website hosting, security, and technical providers
Technical data may be processed by providers necessary to operate, maintain, secure, or support the website.
D. Cookie-consent providers
CookieYes or another consent-management provider may process information necessary to record and manage cookie preferences.
E. Analytics and advertising providers
Subject to applicable consent requirements, these may include:
- Google;
- Meta;
- analytics providers;
- advertising platforms;
- conversion-measurement tools.
F. Email and communication providers
Email platforms and newsletter providers may process contact and communication information.
G. Booking providers
Booking or scheduling tools may process information necessary to arrange appointments.
H. Embedded content and media providers
Third-party tools may process technical information when embedded content is loaded, subject to applicable cookie and consent settings.
I. Professional advisers
Data may be shared where necessary with:
- accountants;
- lawyers;
- insurers;
- professional advisers.
J. Public, regulatory, or judicial authorities
Data may be disclosed where required by:
- law;
- court order;
- professional duty;
- regulatory requirement;
- lawful authority request.
Service providers are required to protect personal data in accordance with their applicable legal and contractual obligations.
8. International data transfers
Some providers may process personal data outside Greece or the European Economic Area.
Where required, appropriate transfer safeguards are used, which may include:
- adequacy decisions;
- Standard Contractual Clauses;
- applicable data-processing agreements;
- other lawful transfer mechanisms.
Providers whose services may involve international processing include, depending on use:
- Practice Better;
- Stripe;
- Google;
- Meta;
- CookieYes;
- email marketing providers;
- hosting providers;
- other digital-service providers.
9. How long is personal data retained?
Personal data is retained only for as long as necessary for the relevant purpose or as required or permitted by law.
The retention period depends on the controller, the type of information, and the purpose of processing.
A. General website enquiries
General enquiry and contact data may be retained for as long as reasonably necessary to respond and administer the enquiry, unless earlier deletion is appropriate.
B. Dietetic records
Records relating to professional services provided by Panagiotis Tsintavis are retained by him in accordance with applicable professional, legal, insurance, and regulatory requirements.
C. Medical records
Medical records and health data relating to services provided by Dr. Varvara Zisimidou are retained by her in accordance with the retention requirements and professional obligations applicable to her independent medical practice.
D. Payment and accounting data
Payment, invoice, and transaction information is retained for periods required under applicable tax, accounting, and legal obligations.
E. Marketing data
Marketing information may be retained until you unsubscribe, withdraw consent, or object, subject to retention of limited suppression information where necessary to ensure that your preference is respected.
F. Cookies and analytics
Retention periods vary according to the relevant technology and configuration. See the Cookie Policy for more information.
When personal data is no longer required, it will be deleted, anonymised, or otherwise securely disposed of where appropriate.
10. How is personal data protected?
Appropriate technical and organisational measures are used to protect personal data against unauthorised access, accidental loss, misuse, alteration, or disclosure.
Depending on the processing activity, measures may include:
- secure professional platforms;
- access controls;
- password-protected systems;
- restricted access;
- secure payment processing;
- professional practice-management tools;
- organisational and administrative safeguards.
Within a shared Practice Better environment, access to identifiable health information should be limited in practice to what is necessary for the relevant professional role or collaborative-care purpose.
No method of electronic transmission or storage can be guaranteed to be completely secure.
Users are responsible for keeping their own login details, email accounts, and portal credentials secure.
11. Your privacy rights
Subject to the GDPR and any applicable limitations, you may have the right to:
- access your personal data;
- correct inaccurate or incomplete information;
- request deletion;
- request restriction of processing;
- object to processing based on legitimate interests;
- object to direct marketing;
- request portability;
- withdraw consent where processing relies on consent;
- lodge a complaint with a supervisory authority.
A privacy request should be directed to the controller responsible for the relevant processing.
As a practical first point of contact, requests may be sent to:
The request will be directed to the appropriate controller where necessary.
Identity verification may be required before a request is fulfilled.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority — Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα.
Website: www.dpa.gr
12. Withdrawing consent
Where processing is based on consent, consent may be withdrawn at any time.
For example:
- newsletter communications can be stopped through the unsubscribe link;
- cookie preferences can be changed through the website’s cookie settings;
- other consent-related requests may be sent to info@tsintavismed.com.
Withdrawal of consent does not affect processing lawfully carried out before withdrawal.
13. Cookies and tracking choices
Most browsers allow users to refuse, block, or delete cookies.
Cookie and tracking preferences can also be managed through the website’s cookie banner or cookie settings.
Essential cookies may be necessary for the website to function.
Optional functional, analytics, advertising, and marketing cookies are used only where legally permitted and, where required, with consent.
For further details, please see the Cookie Policy.
14. Do Not Track signals
Some browsers provide a “Do Not Track” signal.
There is currently no uniform legal or technical standard requiring websites to respond to all such signals.
Cookie and tracking preferences can instead be managed through browser settings and the website’s cookie-consent tools.
15. Children and minors
The website is not intended to collect personal data directly from children without appropriate parental or guardian involvement.
Where professional services are requested for a child or minor, the relevant information should be provided by or with the involvement of a parent or legal guardian, as required.
If you believe that a child has provided personal data without appropriate permission, please contact info@tsintavismed.com.
16. Third-party links and platforms
The website may link to external websites, platforms, tools, or services, including:
- Practice Better;
- Stripe;
- CookieYes;
- social-media platforms;
- booking tools;
- video platforms;
- embedded content;
- external educational resources;
- media or podcast platforms.
These third parties may process personal data under their own privacy policies.
You should review the relevant third party’s privacy information before providing personal data through its service.
17. Testimonials and reviews
Testimonials, reviews, or feedback may be displayed on the website or in related communications.
Identifying testimonials, names, photographs, health experiences, or other personal information will be published only with appropriate permission.
If you wish to request the removal or amendment of a testimonial, contact:
18. Additional notice for California residents
We do not sell personal data for money.
Some use of analytics or advertising technologies may qualify as “sharing” of personal information under applicable California privacy law.
This may involve:
- cookie identifiers;
- IP addresses;
- device information;
- browser information;
- website activity.
Where available, non-essential advertising technologies may be disabled through the website’s cookie settings.
California residents may have additional rights under applicable law, including rights relating to access, correction, deletion, portability, or opting out of certain sharing.
Requests may be sent to:
Identity verification may be required.
19. Changes to this Privacy Policy
This Privacy Policy may be updated from time to time.
When changes are made, the “Last updated” date will be revised.
Where a change is material, additional notice may be provided where appropriate.
20. Contact and controller information
For general questions about this Privacy Policy:
Tsintavis Functional Medicine
Rodou 10, Marousi, 151 22, Athens, Greece
Email: info@tsintavismed.com
For website operation, general website enquiries, marketing, digital products, and services of Panagiotis Tsintavis:
Data Controller: Panagiotis Tsintavis
Dietitian–Nutritionist
Rodou 10, Marousi, 151 22, Athens, Greece
Email: info@tsintavismed.com
For medical services provided through the independent medical practice of Dr. Varvara Zisimidou:
Data Controller: Dr. Varvara Zisimidou, MD
Specialist in Internal Medicine
Rodou 10, Marousi, 151 22, Athens, Greece
Privacy enquiries may be sent to: info@tsintavismed.com
Where both practitioners jointly determine the purposes and essential means of a particular processing activity, their respective responsibilities will be determined in accordance with Article 26 GDPR.