1. Who We Are

This Privacy Policy explains how ECAMS Innovation Ltd (“we”, “us”, “our”), the company behind the GAAPS directory (Global Alliance For Aesthetic Patient Safety) at gaaps.org (the “Site”), collects, uses, and protects personal data. ECAMS Innovation Ltd is a company registered in Dublin, Ireland, and acts as the data controller for personal data collected through the Site.

This policy applies to visitors searching the directory (“patients” or “users”) and, separately, to doctors whose training records are listed on the Site. Where the two groups are treated differently, this is noted below.

2. Personal Data We Collect

From patients and general Site visitors:

• Technical data collected automatically when you browse the Site: IP address, browser type, device information, pages viewed, and referral source, typically via cookies or similar technologies (see Section 6).
• Any information you voluntarily submit, for example through a contact or enquiry form — such as your name, email address, country, and the content of your message.
• If you ask us for a legal referral (see our Terms and Conditions), the country and details of your enquiry needed to identify an appropriate contact.

From doctors listed on the directory:

• Professional information submitted for the purpose of creating and verifying a directory profile: name, professional photograph, medical qualifications, training history, certifications, clinic or practice details, and professional contact information.

We do not knowingly collect sensitive personal data (such as a patient’s own health information) through the Site. Please do not submit details of your own medical history or condition through any contact form on the Site.

3. How We Use Your Data

We use personal data for the following purposes:

• To operate, maintain, and improve the directory and Site functionality.
• To respond to enquiries submitted through contact forms or to info@gaaps.org.
• To verify, publish, and keep up to date the training records of listed doctors.
• To provide a legal referral contact where requested, as described in our Terms and Conditions.
• To monitor Site usage and security, including detecting misuse or fraudulent activity.
• To comply with our legal obligations.

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Legitimate interests — to operate and secure the Site, respond to enquiries, and maintain the accuracy of the directory, balanced against your rights and interests.
• Consent — where you actively submit information through a form, or where non-essential cookies require your opt-in (see Section 6).
• Contract or pre-contractual steps — where a doctor submits information for the purpose of being listed on the directory.
• Legal obligation — where processing is required to comply with applicable law.

5. Who We Share Data With

We do not sell personal data. We may share personal data with:

• Service providers who support the operation of the Site (for example, website hosting, email delivery, and analytics providers), under contractual obligations to protect your data.
• ECAMS (European College of Aesthetic Medicine and Surgery), our affiliate, where relevant to verifying a doctor’s training history.
• An independent lawyer, only where you have specifically requested a legal referral, and only the information necessary to make that introduction.
• Regulatory or law enforcement authorities, where we are legally required to do so.

6. Cookies

The Site uses cookies and similar technologies to operate correctly, remember preferences, and understand how visitors use the Site. This may include essential cookies (required for the Site to function) and, where used, analytics cookies (to help us understand traffic and usage patterns).

Where analytics or non-essential cookies are used, we will ask for your consent via a cookie banner before they are set, and you can withdraw consent at any time through your browser settings or the cookie preference tool on the Site.

7. International Data Transfers

As GAAPS serves an international audience of patients and doctors, personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including where our service providers are located. Where this occurs, we take steps required under GDPR to ensure an adequate level of protection, such as reliance on the European Commission’s Standard Contractual Clauses or an applicable adequacy decision.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law. Enquiry and contact form data is retained until you unsubscribe from the date you contact us, unless a longer period is required to resolve an ongoing matter. Doctor training and verification records are retained for as long as the doctor remains listed on the directory, and for a further period afterward as required for record-keeping.

9. Your Rights Under GDPR

If you are located in the EEA, UK, or another jurisdiction with equivalent protections, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data, in certain circumstances.
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with a supervisory authority — in Ireland, the Data Protection Commission (www.dataprotection.ie).

To exercise any of these rights, contact us at info@gaaps.org. We will respond within the timeframes required by GDPR.

10. Doctor Profile Data Specifically

Because the purpose of GAAPS is to publish verified training information for public reference, doctor profile data (name, photograph, training and certification history) is displayed publicly on the Site as part of the directory’s core function. Doctors listed on the directory can request correction of inaccurate information or removal from the directory by contacting info@gaaps.org, subject to our legitimate interest in maintaining an accurate historical record of verification.

11. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children’s Data

The Site is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can remove it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised. Material changes will be reflected on this page.

14. Contact Us

ECAMS Innovation Ltd (trading as GAAPS)
Dublin, Ireland
Email: info@gaaps.org