Privacy Policy

1. Controller

We’re not currently required to appoint a data protection officer (Art. 37 GDPR). For anything privacy-related, reach us at the contact details above.

2. How we handle data

We treat your personal data as confidential and follow the General Data Protection Regulation (GDPR), the Bundesdatenschutzgesetz (BDSG – German Federal Data Protection Act), the TDDDG (German Telecommunications-Digital-Services Data Protection Act) and medical confidentiality (§ 203 StGB – German Criminal Code). We only process data when we need it to run the website, schedule appointments, treat you or handle your requests.

When service providers process data for us, they do so under data processing agreements (Art. 28 GDPR). For providers outside the EU/EEA, transfers rely on an EU adequacy decision (notably the EU-US Data Privacy Framework) or EU Standard Contractual Clauses (Art. 46 GDPR).

Unless this policy says otherwise, we keep personal data only as long as we need it for the purpose at hand, then delete it – except where the law requires us to keep it longer (in particular § 630f BGB – German Civil Code, professional rules and tax law).

3. Hosting and server log files

When you visit this site, the hosting provider automatically records server log data: your IP address, date and time, the page you opened, browser type and operating system, and the referring URL.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in running a secure, stable website. Log files are deleted within 14 days unless we need to keep them for security reasons. We have a data processing agreement (Art. 28 GDPR) with the hosting provider.

Technically, this site is served by Cloudflare: it’s published as a set of static files on the Cloudflare network and delivered straight to your browser. There’s no separate web server behind it.

Cloudflare is also used as a content delivery network and to protect against overload and attack attempts (Cloudflare Germany GmbH, Rosental 7, 80331 München, Germany; parent company: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). All traffic to this site passes through Cloudflare servers, which involves processing IP addresses and may involve transfers to the US. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure, fast website. A data processing agreement (Art. 28 GDPR) covers this too.

4. Cookies

We don’t use tracking or marketing cookies. The only things used are strictly necessary functions that don’t need consent (§ 25(2) TDDDG). When you use online booking (section 7), that provider may set the technical cookies the booking tool needs to work.

5. Analytics and performance measurement

To see which content people look for and read, we measure visits with Plausible Analytics. All processing happens on servers in the European Union.

Plausible sets no cookies and stores nothing on your device. It builds no cross-device profiles, sells no data and merges no user accounts. Your IP address is not stored – it’s only used briefly to build a hash value that rotates daily and can’t be traced back to you. What’s collected: the page viewed, the referring page, country, device type, browser and operating system – all in coarse form.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in building a site that works for its visitors. No consent is needed because nothing is stored on or read from your device (§ 25(1) TDDDG).

Cloudflare Web Analytics / Real User Monitoring

In addition, we use Cloudflare Web Analytics to measure technical performance and traffic. Cloudflare may insert the JavaScript beacon for this automatically when it delivers the page. The script loads from static.cloudflareinsights.com/beacon.min.js; on pages served via Cloudflare, the measurement data goes to the path /cdn-cgi/rum.

It collects page views and visits plus technical timing data for load performance and Core Web Vitals. Analysis may include the URL path, browser, operating system, country and the page element involved. Cloudflare sets no cookies for this and uses no local storage or other client-side identifiers. According to Cloudflare, individual visitors aren’t tracked across websites or recognized by IP address, user agent or other data. The source IP address from the HTTP request is discarded at the nearest Cloudflare data center and never stored in the RUM service’s central databases or logs.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in checking and improving the site’s load performance, stability and usability. The provider and possible US transfers are described in section 3. More technical detail: Data collection by Cloudflare Web Analytics and RUM beacon.

6. Contact form, email and phone

If you reach out via the contact form, email or phone, we process the details you give us (name, email, phone number if provided, subject and message) to handle your request.

Legal basis: Art. 6(1)(b) GDPR (setting up or carrying out the treatment contract) and – if you choose to share health information – your consent under Art. 9(2)(a) GDPR. Please avoid sending sensitive medical results by unencrypted email where you can. We don’t record phone calls.

We delete request data as soon as we no longer need it and no legal retention period applies.

7. Online appointment booking (Cal.com / Cal.eu)

Online booking runs on Cal.com (Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA). We use its European offering, Cal.eu, so your data is stored in the European Union.

When you book, we process:

• First and last name (required)
• Email address (required)
• Mobile number (required, e.g. for appointment confirmations and reminders)
• the service you picked, the date and time, and your time zone
• your acceptance of the Terms & Conditions / Privacy Policy and the self-pay notice (as proof of consent)
• technical booking data (time of submission, IP address)
• anything you choose to add in the message field

Legal basis: Art. 6(1)(b) GDPR (scheduling an appointment to set up or carry out the treatment contract). If you add health information during booking, we process it based on your consent (Art. 9(2)(a) GDPR). Keep the booking form to the essentials where you can – we’ll go through the details at your appointment.

We have a data processing agreement (Art. 28 GDPR) with the provider. Data is stored in the EU via Cal.eu; if a transfer to the US ever occurs in an individual case, it relies on the EU-US Data Privacy Framework or EU Standard Contractual Clauses (Art. 46 GDPR). The required fields are necessary for online booking – without them you can’t book online, but you can always book by phone instead. We delete booking data once we no longer need it to manage appointments and no retention period applies. More: cal.com/privacy

8. Video visits (Whereby)

Video visits run on Whereby (Video Communication Services AS, Gate 1 No. 101, 6700 Måløy, Norway). Norway is part of the European Economic Area, so the GDPR applies directly.

During a video visit we process your IP address, device and browser details, the time you joined, and the audio and video stream itself. Everything is encrypted in transit. Video consultations are not recorded. You don’t need an account – you join through a link we send you.

Legal basis: Art. 6(1)(b) GDPR (carrying out the treatment contract) and, for health data discussed during the visit, Art. 9(2)(h) GDPR together with § 22 BDSG (treatment purposes, medical confidentiality). We have a data processing agreement (Art. 28 GDPR) with the provider. More: whereby.com – Privacy Policy

9. Contact via WhatsApp

You can reach us on WhatsApp if you like (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland). It’s always your move: we only use this channel once you message us via the link or our number. By reaching out, you consent to communicating this way (Art. 6(1)(a) GDPR); handling your request is then based on Art. 6(1)(b) GDPR. You can withdraw that consent at any time going forward – a short message is enough – and we’ll switch to another channel.

WhatsApp Business Platform (API) via hellomateo

We don’t use the regular WhatsApp app. We use the official WhatsApp Business Platform (API), connected through the German provider hellomateo (MATEO Estate GmbH, Am Kanal 16–18, 14467 Potsdam). We have a data processing agreement (Art. 28 GDPR) with them; hellomateo processes message data on servers in the European Union.

For you, this setup has real advantages over the regular app: there is no access to a device address book – your number isn’t synced with other contacts or passed to anyone from an address book. Messages go through the practice’s central, access-controlled platform, not through anyone’s personal phone.

What we process and why

We process your mobile number, your WhatsApp profile name and the messages we exchange. If you contact us about a specific treatment or appointment, the legal basis is Art. 6(1)(b) GDPR (setting up or carrying out the treatment contract). For general questions – say, about our services or availability – it’s Art. 6(1)(f) GDPR (our legitimate interest in answering you quickly and efficiently).

If health data comes up on this channel – for example because you send us documents or ask us to send documents via WhatsApp – we process it based on your consent (Art. 9(2)(a) GDPR) or for treatment purposes under Art. 9(2)(h) GDPR with § 22 BDSG, always under medical confidentiality (§ 203 StGB). You can withdraw consent at any time going forward, and we’ll continue on another channel. Your data is used only to handle your request and never shared with third parties.

Meta/WhatsApp receives communication metadata (including phone numbers and timestamps), and transfers to third countries – especially the US – are possible. For US transfers, the provider is certified under the EU-US Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection; EU Standard Contractual Clauses (Art. 46 GDPR) apply on top.

WhatsApp is completely optional. You decide what you share there, and phone, email, video visits and in-person appointments are always available instead – choosing another channel never puts you at a disadvantage. We delete WhatsApp conversations once the matter is closed and no retention period applies; anything relevant to your treatment goes into your patient record first. For what WhatsApp itself collects, and your rights and settings there, see WhatsApp’s privacy notice: whatsapp.com/legal

10. Health data and patient record

As part of your treatment, we process health data under Art. 9(2)(h) GDPR with § 22 BDSG (preventive care and treatment). Medical confidentiality applies, along with the documentation and retention duties under § 630f BGB and the professional code (generally 10 years, longer in special cases).

For billing under the GOÄ (German physicians’ fee schedule) we process the data that requires (Art. 6(1)(b) and (c) GDPR) and keep billing records as long as tax and professional law demand.

11. Google Maps

This site embeds Google Maps (API) from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). It’s an interactive map that shows where we are and helps you find your way to the practice.

As soon as you open a page with the embedded map, information about your visit (such as your IP address) is sent to Google’s servers and stored there – possibly including servers of Google LLC in the US. This happens whether or not you have a Google account or are signed in. If you’re signed in, Google links the data directly to your account; if you don’t want that, sign out before opening the map. Google stores and analyzes this data as usage profiles, even for users who aren’t signed in.

Google bases this on Art. 6(1)(f) GDPR – its legitimate interest in personalized advertising, market research and tailoring its own websites. You can object to these user profiles; to do so, you need to contact Google. If you don’t want any data going to Google through the map, you can disable JavaScript in your browser – the map on this site will then no longer work.

Where the law requires it, we ask for your consent to this processing (Art. 6(1)(a) GDPR). You can withdraw it at any time going forward.

For US transfers, Google is certified under the EU-US Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection. More on Google’s privacy practices: business.safety.google/intl/de/privacy

12. Fonts and embedded images

This site uses the typefaces “Inter” and “Schibsted Grotesk” so text looks the same everywhere. Both are delivered by this website itself and load with the page. For these fonts, no connection is made to Google Fonts or any other third party, and your IP address isn’t sent anywhere for this. The fonts are licensed under the SIL Open Font License 1.1.

One exception: the Google Maps window on the Contact page (section 11) loads its own fonts from fonts.googleapis.com. That request comes from the map service, can’t be turned off inside the embedded window, and only happens on the Contact page. The related data transfer to Google is covered in section 11.

Some photos aren’t served from this site but are loaded from the image service Unsplash via images.unsplash.com when the page opens. That sends your IP address and technical browser details to the provider, possibly including a transfer to the US. This affects several pages but not the contact section. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a well-illustrated, fast-loading site.

13. Linked social media profiles

We link to our Instagram and TikTok profiles. Nothing is sent to these platforms just by using our site – data flows only once you click a link and leave, and then their privacy policies apply.

14. Your rights

When it comes to your personal data, you have the right to:

• Access it (Art. 15 GDPR)
• Have it corrected (Art. 16 GDPR)
• Have it deleted (Art. 17 GDPR)
• Restrict how it’s processed (Art. 18 GDPR)
• Receive it in a portable format (Art. 20 GDPR)
• Withdraw any consent you’ve given, going forward (Art. 7(3) GDPR)

You can also file a complaint with a data protection authority. The one responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

15. How long we keep your data

How long we keep personal data depends on the legal basis, the purpose, and – where they apply – statutory retention periods (for example medical documentation duties under § 630f BGB and the professional code, or commercial and tax law).

Data we process based on your consent (Art. 6(1)(a) or Art. 9(2)(a) GDPR) is kept until you withdraw that consent, unless the law requires us to keep it longer.

Data we process to set up or carry out a contract (Art. 6(1)(b) GDPR) is routinely deleted once the statutory retention period ends, as long as we no longer need it for the contract and have no legitimate interest in keeping it.

Data we process based on legitimate interest (Art. 6(1)(f) GDPR) is kept until you object under Art. 21(1) GDPR – unless we can show compelling grounds that outweigh your interests, rights and freedoms, or we need it for legal claims.

In every other case, unless this policy says otherwise, we delete personal data once it’s no longer needed for the purpose we collected it for.

16. No automated decision-making

We don’t use automated decision-making or profiling as defined in Art. 22 GDPR. Decisions about treatment and appointments are always made by people.

17. Data security

This site is SSL/TLS encrypted. On top of that, we use technical and organizational safeguards to protect your data from loss, destruction and unauthorized access, and we keep those safeguards current.

18. Changes to this policy

We update this policy whenever the services we use or the law change. The version published on this page is the one that applies.