Privacy and data processing policy

Last updated: 26 June 2026.

General provisions

This Privacy Policy (hereinafter referred to as the “Privacy Policy”) sets out how the personal data of persons who visit the website www.formetricsurgery.com (hereinafter referred to as the “Website”) and/or submit their data through the registration form available on the Website are processed.

Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter referred to as the “GDPR”), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other applicable legislation.

By using the Website and/or submitting your personal data, you confirm that you have read and understood this Privacy Policy.

In this Privacy Policy, the term “Patient” means a natural person who applies for plastic and reconstructive surgery services or consultations, and the term “Data Subject” means any natural person whose personal data are processed under this Privacy Policy.

Data controllers

The joint controllers of your personal data (hereinafter jointly referred to as the “Companies” or the “Data Controllers”) are:

Formetric Surgery Cepas, MB, legal entity code 307483597, registered office address Nemunaiciu g. 6-32, LT-46213 Kaunas, e-mail info@formetricsurgery.com, tel. +370 603 53337;

Formetric Surgery Rainys, MB, legal entity code 307484642, registered office address Ausros tak. 4-6, LT-44211 Kaunas, e-mail info@formetricsurgery.com, tel. +370 603 53337.

The Companies are joint controllers within the meaning of Article 26 of the GDPR. The Companies jointly determine the purposes and means of processing the personal data submitted through the Website, since either of the Companies may contact a person who has registered through the Website regarding a consultation and the arrangement of further treatment.

The allocation of responsibilities between the Companies for compliance with the obligations under the GDPR is described in Section 12 of this Privacy Policy. Notwithstanding the arrangement between the Companies, the Data Subject may exercise their rights under the GDPR in respect of each of the Companies.

For any matters relating to the processing of personal data, you may contact us by e-mail at info@formetricsurgery.com. This point of contact applies in respect of both Companies.

The Companies have not appointed a data protection officer, as there is no statutory obligation to do so. All enquiries relating to data processing shall be handled using the contact details specified above.

What personal data we collect

Through the Website registration form, we collect the following personal data provided by you: first name, surname, e-mail address, telephone number; the category of the procedure of interest selected by you (body, breast, face, beauty injections, men, non-aesthetic treatment).

Where, in the course of providing consultation and treatment arrangement services, we subsequently receive additional information (e.g., during correspondence or the provision of a remote consultation), we may also process additional data, including health data, photographs, and other information relating to the proposed treatment. The processing of such data is described in separate agreements and/or consents concluded with the Patient.

When you visit the Website, technical data (IP address, browser type, date and time of visit, browsing information) may be collected automatically, as described in Section 9 of this Privacy Policy (Cookies).

Special categories of personal data (health data)

Please note that by selecting the category of procedure of interest, you may disclose information relating to your health or your intentions regarding healthcare services. Under Article 9 of the GDPR, such information may constitute a special category of personal data.

Please note that by selecting the category of procedure of interest, you may disclose information relating to your health or your intentions regarding healthcare services. Under Article 9 of the GDPR, such information may constitute a special category of personal data.

We ask that you provide only such information in the registration form as is necessary for the initial contact. Please do not provide detailed information about your health condition in the registration form — such information will be collected later, in a secure manner, during the consultation.

Purposes and legal bases of processing

We process your personal data for the following purposes and on the following legal bases:

To contact you and respond to your enquiry. Upon receipt of your registration, we shall contact you within 24 hours regarding a consultation. Legal basis: your consent, expressed by submitting the registration form (Article 6(1)(a) of the GDPR), and the taking of steps at your request prior to entering into a contract (Article 6(1)(b) of the GDPR).

Provision of consultations and arrangement of treatment. To provide remote consultations, prepare a treatment plan, recommend a healthcare institution, and register you for a consultation and surgery. Legal basis: conclusion and performance of a contract (Article 6(1)(b) of the GDPR), and, in respect of health data, the provision of healthcare services (Article 9(2)(h) of the GDPR) and/or your consent (Article 9(2)(a) of the GDPR).

Compliance with legal obligations. To comply with obligations laid down by law, including the retention of medical records. Legal basis: compliance with a legal obligation (Article 6(1)(c) of the GDPR).

Pursuit of legitimate interests. To ensure the security of the Website and data, and to establish, exercise, or defend legal claims. Legal basis: the legitimate interests of the Companies (Article 6(1)(f) of the GDPR).

The provision of personal data is not mandatory; however, if you do not provide the data requested in the registration form, we shall be unable to contact you and provide the requested services.

Data retention periods

We retain your personal data for no longer than is necessary to achieve the purposes of processing or as required by applicable legislation:

registration form data, where no service agreement is concluded, shall be retained for no longer than six (6) months from the last contact with you;

where a service agreement is concluded, treatment-related data (including health data and medical records) shall be retained for fifteen (15) years from the Patient’s last visit, in accordance with the legislation governing the retention of medical records;

data processed on the basis of consent shall be retained until consent is withdrawn, but no longer than the periods specified above;

technical (cookie) data shall be retained for the periods specified in Section 9 of this Privacy Policy.

Upon expiry of the retention period, personal data shall be securely destroyed or anonymised.

Data recipients

We may transfer your personal data to the following recipients:

the healthcare institution in Lithuania where the in-person consultations and surgery will take place, for the purposes of your registration and treatment;

data processors providing services to the Companies (providers of information technology, Website hosting, e-mail, communication tools, and accounting services), processing data in accordance with the instructions of the Companies and the data processing agreements concluded with them;

public authorities and other persons, where required in the cases provided for by law.

The Companies do not sell or otherwise transfer your personal data to third parties for commercial purposes.

Transfers of data outside the European Economic Area

As a rule, we process your personal data within the territory of the European Union and the European Economic Area (hereinafter referred to as the “EU/EEA”).

Should personal data be transferred outside the EU/EEA (e.g., using certain IT or communication tools), such transfer shall take place only where appropriate safeguards provided for in Chapter V of the GDPR are ensured — namely, transfers to countries in respect of which the European Commission has adopted an adequacy decision, or by applying standard contractual clauses or other lawful safeguards.

Cookies

Cookies are small text files that are stored on your device when you visit the Website. They help ensure the functioning of the Website, remember your preferences, and improve the user experience.

At present, the Website uses only strictly necessary and functional cookies, for which your consent is not required. The Website does not use analytical or marketing cookies and does not profile users. The following cookies are used:

Strictly necessary cookies are required for the technical functioning of the Website and to remember your preferences, and are therefore used on the basis of legitimate interest and do not require separate consent. Functional cookies ensure a more convenient use of the Website.

Should analytical or marketing cookies be introduced on the Website in the future, they would be installed only upon obtaining your prior consent through the cookie consent management tool (CookieYes) operating on the Website.

You may review and change your cookie preferences at any time using the cookie management tool available on the Website. You may also manage or delete cookies by changing your internet browser settings. Please note that disabling strictly necessary cookies may cause certain functions of the Website to malfunction.

Your rights (as a data subject)

Under the GDPR, you have the following rights: the right to access the personal data being processed about you; the right to request the rectification of inaccurate or incomplete data; the right to request the erasure of data (the right to be forgotten), where this does not conflict with legal requirements; the right to restrict processing; the right to data portability; the right to object to processing where it is based on legitimate interest; the right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.

To exercise your rights, please contact us by e-mail at info@formetricsurgery.com. We shall provide a response no later than one (1) month from receipt of the request. This period may be extended in the cases provided for by law.

In order to ensure security, we may ask you to confirm your identity before acting on your request.

Data security

The Companies apply appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, destruction, alteration, or other unlawful processing.

Access to personal data is granted only to those employees of the Companies and data processors who require it for the performance of their duties, and they are bound by an obligation of confidentiality.

Allocation of responsibilities between joint controllers

The Companies, as joint controllers, have entered into an arrangement on the allocation of responsibilities pursuant to Article 26 of the GDPR. The main principles of this arrangement are as follows:

both Companies ensure that personal data are processed lawfully, transparently, and securely;

the Company that first contacts the Patient and begins providing consultations to that Patient shall be responsible for the further processing of that Patient’s data and for informing the Patient;

the Companies are jointly responsible for the content of this Privacy Policy and for ensuring that Data Subjects are provided with the information referred to in Articles 13 and 14 of the GDPR;

requests concerning the exercise of data subject rights shall be handled by the Company that received the request, cooperating with the other Company where necessary.

Notwithstanding the arrangement between the Companies, you have the right to exercise your rights under the GDPR in respect of each Company and to contact either of them.

Complaints

If you believe that your personal data are being processed in breach of the legal requirements, you have the right to contact the Companies by e-mail at info@formetricsurgery.com so that the matter may be resolved.

You also have the right to lodge a complaint with the supervisory authority — the State Data Protection Inspectorate of the Republic of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, e-mail ada@ada.lt, website vdai.lrv.lt) — or with the supervisory authority of the EU Member State of your habitual residence.

Amendments to the privacy policy

The Companies have the right to amend this Privacy Policy unilaterally at any time. The updated version of the Privacy Policy shall be published on the Website, indicating the date of the last update.

In the event of material changes, we may inform you additionally (e.g., by publishing a notice on the Website).

Contacts

For any matters relating to this Privacy Policy or the processing of your personal data, you may contact us:

E-mail: info@formetricsurgery.com

Telephone: +370 603 53337

Website: www.formetricsurgery.com