Privacy Policy
How USS handles personal data
Version 1.0 · effective 13 October 2026
GEMI 147696207001
reply within one month
Western Europe region
www.dpa.gr
1. Who we are
The data controller is UNIFIED SURGICAL SOLUTIONS HELLAS, GEMI 147696207001, VAT EL996973799, 89 El. Venizelou Street, 153 41 Agia Paraskevi, Greece; offices 7 Sevastoupoleos Street, 115 26 Athens; e-mail gr@ussmed.com. We process personal data under the GDPR and Greek Law 4624/2019.
2. What we process and why
| Who / what | Data | Purpose | Legal basis |
|---|---|---|---|
| Hospital staff, surgeons and other customer contacts | Name, role, institution, business contact details, order and contract history | Orders, deliveries, tenders, invoicing, customer service | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| Patients (indirectly) | Pseudonymised or limited identifiers on usage reports, implant records and incident reports (e.g. hospital record number, date of surgery, device UDI) | Device traceability, billing of consignment use, vigilance, field safety actions and recalls | Legal obligation under the MDR (6(1)(c)); Art. 9(2)(i) GDPR (high standards of quality and safety of medical devices) |
| Healthcare professionals in compliance records | Identity, institution, educational support or hospitality provided | MedTech Europe Code and EOF transparency obligations | Legal obligation (6(1)(c)); legitimate interest (6(1)(f)) |
| Suppliers and manufacturers' staff | Business contact details | Purchasing, regulatory correspondence | Contract; legitimate interest |
| Job applicants | CV, qualifications, interview notes | Recruitment | Steps before a contract (6(1)(b)); consent for keeping a CV for future roles |
| Website visitors and account holders | IP address, browser data, login, necessary cookies | Operating and securing the website and customer accounts | Legitimate interest (6(1)(f)) |
3. Patient data
We do not need patients' names. We ask hospitals to send only the minimum information required for traceability and vigilance. Our staff who attend procedures are bound by confidentiality and do not record patient data beyond what the hospital provides for these purposes.
4. Recipients
Device manufacturers (for traceability, complaints and vigilance), EOF and other competent authorities where required, our group companies for internal administration, carriers, our IT providers acting as processors (Microsoft (Microsoft Azure, which hosts our business platform and website, with data located in the Western Europe region; and Microsoft 365 for e-mail and documents)), accountants, auditors, banks and tax authorities (AADE/myDATA). Manufacturers outside the EEA receive data only with appropriate safeguards (adequacy decision or Standard Contractual Clauses).
5. Retention
Traceability records of implantable devices: 15 years after supply, as required for implantable devices under the MDR; other device traceability records: 10 years. Accounting records: as required by Greek tax law (generally 5 years from year-end). Customer contact data: for the duration of the business relationship and 5 years after. Unsuccessful job applications: 6 months unless the applicant consents to longer.
6. Your rights
You may request access, rectification, erasure, restriction, objection and portability under Articles 15–22 GDPR by writing to gr@ussmed.com; we reply within one month. Rights may be limited where we must keep records by law (e.g. MDR traceability). You may complain to the Hellenic Data Protection Authority, 1–3 Kifissias Avenue, 115 23 Athens, www.dpa.gr.
7. Cookies
We use only cookies strictly necessary for the website and customer accounts. We do not use analytics, advertising or tracking cookies. The website does not take online payments.