Last updated: October 2026
1. Introduction
Dr. Mohannad Almomani respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how personal data is collected, used, disclosed, retained and protected when you visit or use dralmomani.com, contact us through the website, request information or an appointment, or subscribe to our communications.
This Privacy Policy is intended to comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable data protection legislation in Cyprus, including Law 125(I)/2018, as amended.
2. Data Controller
The controller responsible for the processing of your personal data is:
Dr. Mohannad Almomani
Stygos 9
3117 Limassol, Cyprus
Email: info@dralmomani.com
Phone: +357 94 096910
The Data Controller determines the purposes and means of processing your personal data.
3. Personal Data We May Collect
Depending on how you use the website and our services, we may process the following categories of personal data.
Contact Information
- First name
- Last name
- Email address
- Telephone number, where provided
- Information contained in your message
Appointment and Communication Information
- Information you provide when requesting an appointment
- Information necessary to respond to your enquiry or request
- Records of communications with you where reasonably necessary
Newsletter Information
- Email address
- Subscription and consent information
- Subscription preferences
Technical and Security Information
- IP address
- Browser and device information
- Operating system
- Website usage and security information
- Technical logs generated by website, hosting or security systems
We seek to collect only personal data that is adequate, relevant and reasonably necessary for the purposes for which it is processed.
4. Health Information
Health information is a special category of personal data under Article 9 of the GDPR and receives enhanced protection.
Please do not submit detailed medical records, diagnoses, test results, medication information or other sensitive health information through a general website contact form unless specifically requested by the practice.
Where health information is processed for the purposes of healthcare, medical diagnosis, treatment or the management of healthcare services, it will be processed only where an applicable legal basis under Article 6 GDPR and an applicable condition under Article 9 GDPR are satisfied.
Where applicable, this may include the processing condition in Article 9(2)(h) GDPR for medical diagnosis, the provision of healthcare or treatment, or the management of healthcare systems and services, subject to the conditions and safeguards required by applicable law, including professional secrecy requirements.
5. How We Use Personal Data
We may process personal data for the following purposes:
- To respond to enquiries and requests submitted through the website.
- To communicate with you regarding appointments and requested services.
- To provide healthcare-related services where applicable.
- To manage communications with patients and website users.
- To send newsletters or other marketing communications where the required consent has been obtained.
- To maintain website security, prevent abuse and troubleshoot technical problems.
- To comply with legal, regulatory and professional obligations.
- To establish, exercise or defend legal claims where necessary.
We do not use personal data for purposes that are incompatible with the purposes for which the data was collected, except where otherwise permitted or required by applicable law.
6. Legal Bases for Processing
Depending on the particular processing activity, we rely on one or more of the following legal bases under Article 6 GDPR.
Enquiries, appointment requests and service-related communications
Where processing is necessary to take steps at your request before entering into an arrangement with you, or to perform a contract with you, we may rely on Article 6(1)(b) GDPR.
Where processing is not necessary for such contractual steps, we may rely on Article 6(1)(f) GDPR where appropriate, including for the efficient management of enquiries and communications.
Consent
Where you have freely given consent for a specific purpose, we rely on Article 6(1)(a) GDPR. This includes newsletter and other marketing communications where consent is required.
You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Legal obligation
Where processing is necessary for compliance with a legal obligation to which we are subject, we rely on Article 6(1)(c) GDPR.
Legitimate interests
Where processing is necessary for our legitimate interests, we may rely on Article 6(1)(f) GDPR, provided that those interests are not overridden by your interests or fundamental rights and freedoms.
Our legitimate interests may include website and information security, prevention of misuse or abuse, management of enquiries and communications, and the establishment, exercise or defence of legal claims.
Healthcare-related processing
Where special category health data is processed in connection with healthcare, diagnosis or treatment, an applicable Article 9 condition will also be required in addition to an Article 6 legal basis.
7. Contact Forms and Email
When you submit information through a contact form on this website, the information you provide is used to respond to your enquiry or request and to take any necessary follow-up action.
Website contact messages may be transmitted to the practice's official email system using Google Workspace.
Website, hosting and security systems may generate temporary technical logs or security records as part of operating, securing and protecting the website.
You should not use a general contact form to send detailed medical records or other sensitive health information unless the practice specifically asks you to do so.
8. Newsletter and Mailchimp
If you subscribe to our newsletter, your email address and relevant subscription information may be processed through Mailchimp.
Newsletter subscriptions are based on consent. Where used by the website, a double opt-in process may require you to confirm your subscription before newsletters are sent.
You may unsubscribe at any time by using the unsubscribe mechanism included in our emails or by contacting us.
Mailchimp and its relevant service providers may process personal data outside the European Economic Area (EEA). Where such transfers occur, we use a lawful transfer mechanism and appropriate safeguards as required by applicable data protection law.
9. Third-Party Service Providers
We may use trusted third-party service providers where necessary to operate the website, communicate with users, manage consent, maintain security or provide related services.
Depending on the services actually used by the website, these providers may include:
- Website hosting and infrastructure providers.
- Email and business communication services, including Google Workspace.
- Newsletter and email marketing services, including Mailchimp.
- Cookie consent and consent-management services, including CookieYes.
- Website functionality, security, analytics or embedded third-party content providers, where used.
Where a third party processes personal data on our behalf as a processor, we seek to ensure that appropriate contractual, technical and organisational safeguards are in place as required by applicable data protection law.
10. International Data Transfers
Some service providers may process personal data outside the EEA, including in the United States.
Where personal data is transferred outside the EEA, we rely on a lawful transfer mechanism under applicable data protection law.
Depending on the recipient and circumstances, this may include:
- An adequacy decision adopted by the European Commission, where applicable; or
- Appropriate safeguards such as Standard Contractual Clauses (SCCs); or
- Another lawful transfer mechanism permitted under applicable data protection law.
Where applicable, transfers to participating organisations in the United States may rely on the EU-U.S. Data Privacy Framework.
Further information about relevant safeguards may also be available from the applicable service provider.
11. Cookies and Similar Technologies
This website uses cookies and similar technologies for essential website functionality, security, consent management and, where applicable, analytics or third-party services.
Strictly necessary cookies and technologies may be used where permitted by applicable law.
Non-essential cookies and similar technologies will only be used after the required consent has been obtained.
Our cookie consent system allows you to accept or reject non-essential cookies and to manage your preferences.
Further information about the cookies and similar technologies used on this website is provided in our Cookie Policy.
Where consent is required, you may withdraw or change your cookie preferences at any time through the cookie consent settings.
12. How Long We Keep Personal Data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account applicable legal, regulatory, professional, accounting, security and dispute-resolution requirements.
In particular:
Website Enquiries
Enquiry data is retained for as long as reasonably necessary to respond to and manage the enquiry and any necessary follow-up.
Newsletter Data
Newsletter data is retained until you unsubscribe, withdraw your consent or the subscription is otherwise removed, subject to any lawful requirement to retain evidence of consent or suppression.
Healthcare and Patient Information
Where personal data, including health information, is processed as part of healthcare services, it is retained in accordance with applicable healthcare, professional and legal requirements.
Technical and Security Logs
Technical and security information may be retained for a limited period appropriate to the relevant security, operational or legal purpose.
When personal data is no longer required, it will be securely deleted or anonymised where appropriate.
13. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
Depending on the nature and risks of the processing, these measures may include access controls, secure authentication, encryption where appropriate, secure email transmission, software updates, security monitoring and other appropriate safeguards.
No method of transmission or storage can be guaranteed to be completely secure.
14. Your Data Protection Rights
Subject to the conditions and limitations provided by applicable law, you may have the right to:
- Obtain information about the processing of your personal data.
- Request access to your personal data.
- Request correction of inaccurate or incomplete personal data.
- Request erasure of your personal data.
- Request restriction of processing.
- Object to certain processing.
- Request data portability where applicable.
- Withdraw consent where processing is based on consent.
- Object at any time to processing of personal data for direct marketing purposes.
- Lodge a complaint with a competent supervisory authority.
These rights are not absolute and may be subject to legal exceptions or limitations, including where data must be retained to comply with legal or professional obligations.
15. How to Exercise Your Rights
To exercise your data protection rights or ask questions about this Privacy Policy, please contact:
Email: info@dralmomani.com
Phone: +357 94 096910
Address: Stygos 9, 3117 Limassol, Cyprus
We may need to take reasonable steps to verify your identity before responding to certain requests.
We will respond to valid data protection requests without undue delay and, in accordance with the GDPR, normally within one month of receiving the request. Where permitted by law, this period may be extended by up to a further two months where necessary because of the complexity or number of requests.
16. Right to Complain
You have the right to lodge a complaint with the supervisory authority responsible for data protection in Cyprus:
Commissioner for Personal Data Protection
15 Kypranoros Street
1061 Nicosia, Cyprus
P.O. Box 23378
1682 Nicosia, Cyprus
Email: commissioner@dataprotection.gov.cy
Tel: +357 22 818 456
The Commissioner for Personal Data Protection is the competent supervisory authority in Cyprus for matters concerning the application of data protection law.
17. Children
This website is primarily intended for adults seeking information about ENT healthcare services.
Where personal data relating to a child is processed, it will be handled in accordance with applicable data protection, healthcare and professional requirements.
Where parental or guardian involvement is required by applicable law, appropriate steps will be taken in relation to the processing of the child's personal data.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, technology or our data processing practices.
The latest version will be published on this page together with the date of the most recent update.
Last updated: October 2026
Contact: info@dralmomani.com · +357 94 096910