01 · Data Controller

I am responsible for the processing of personal data in connection with this website and the organisation of my practice. If you have any questions concerning data protection, you may contact me using the email address provided above.

02 · Website Access, Hosting and Server Logs

When you access my website, technically necessary information is processed. This may include your IP address, the date and time of access, the pages requested, browser and device information and, where applicable, the referring website address. This processing is necessary to provide the website, diagnose technical errors and protect against misuse.

The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR), based on my legitimate interest in operating a secure and reliable website. I use the website builder and hosting services provided by united-domains GmbH. Where a service provider processes personal data on my behalf, the requirements of Article 28 GDPR apply.

Server logs are retained only for as long as necessary for technical operations and security purposes. The specific retention period depends on the actual settings of the hosting provider.

03 · Contact Form, Email and Telephone

If you contact me through the website contact form, by telephone or by email, I process your contact details, the content of your enquiry and the associated communication data in order to handle and respond to your request. Depending on the nature of your enquiry, the legal basis is Article 6(1)(b) GDPR (pre-contractual measures or performance of a contract) or Article 6(1)(f) GDPR (legitimate interest in responding to other enquiries).

Please avoid sending detailed medical reports or other particularly sensitive information through the general website contact form. Where health data is necessary for arranging or providing treatment, its processing is additionally governed by Article 9(2)(h) GDPR in conjunction with the applicable professional and data protection laws. Otherwise, a separate appropriate legal basis is required.

04 · Online Appointment Booking with eTermin

My website includes an online appointment booking service provided by eTermin. When you use this service, the data necessary for registration, account activation, appointment management and communication is processed. This may include your name, contact details, login credentials or technical identifiers, preferred appointment times and any additional information you provide.

Processing is carried out to organise and provide treatment and is generally based on Article 6(1)(b) GDPR. Where necessary health data is processed, Article 9(2)(h) GDPR, together with applicable law, may also apply. Further information about eTermin's handling of personal data is available in the privacy notices provided during the booking process.

When the booking service is embedded, technically necessary connection data may also be transmitted directly to eTermin. An existing data processing agreement and the technical settings of the integration form part of my data protection arrangements.

05 · Digital Patient Onboarding and Treatment Documentation

During the digital patient registration process, personal details, information relevant to appointment and treatment preparation, and acknowledgement of privacy, fee and communication information may be collected. Where applicable, I also document which versions of the information were presented to you and when acknowledgement or any necessary consent was provided.

Processing is carried out to establish and perform the treatment relationship, to fulfil statutory documentation obligations and, where health data is concerned, on the applicable special legal bases. These include Articles 6(1)(b) and 6(1)(c) GDPR and Article 9(2)(h) GDPR, where applicable. Relevant records may be stored in the practice management system or in the organisational email archive.

06 · Voluntary Communication via WhatsApp and KIME

My website provides a link to contact my digital practice assistant, KIME, via WhatsApp. Use of this communication channel is voluntary. Alternatively, you may contact my practice by email or telephone.

When using WhatsApp, data such as your telephone number, message content, timestamps, technical communication data and appointment-related information may be processed. WhatsApp also involves data processing by Meta/WhatsApp services under their own terms and privacy policies. This may include transfers of data to recipients outside the European Economic Area.

Please do not send medical reports, diagnoses or particularly sensitive health information via WhatsApp. Where consent is required for a communication channel or processing activity, it is provided voluntarily and may be withdrawn at any time with effect for the future. Depending on the processing activity, appointment-related communication may rely on Article 6(1)(b) GDPR or, where consent is used, Article 6(1)(a) GDPR.

The KIME functions actually available may depend on the technical approval and activation status of the service.

07 · Technical Automation and AI-Assisted Processing

To organise enquiries and appointment workflows, I may use technical automation services, in particular n8n Cloud. Where AI-assisted functions are enabled, enquiry content and the data necessary for the relevant task may be processed by connected technical service providers. This may include identifying the purpose of an appointment enquiry or generating a suggested response.

Processing is limited to the data necessary for the relevant task. Decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals within the meaning of Article 22 GDPR are not intended. Where health data is to be included, appropriate additional safeguards and a corresponding legal basis are required.

The specific connected AI providers, storage locations, international transfers and contractual arrangements must be verified against the actual technical configuration before production activation or publication of this section.

08 · Publicly Displayed Google Reviews

My website displays selected Google reviews that have already been published publicly. These may include the reviewer's public display name, star rating and, where applicable, an abbreviated version of the review text. Under the current technical configuration, this information is stored locally within the website code and does not require a live request to Google to retrieve the reviews.

The legal basis is Article 6(1)(f) GDPR, based on my legitimate interest in informing visitors about publicly available feedback and presenting my practice. This is subject to any overriding interests of the individuals concerned. The display will be reviewed in the event of justified objections. Individual reviews and the overall rating are identified as representing a historical snapshot.

09 · Cookies, Embedded Content and External Links

Cookies or comparable storage and access technologies may be necessary for technically essential functions of the website or booking portal. Where non-essential technologies are used, any consent required under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6 GDPR must be obtained before those technologies are used.

My website includes links to external services, particularly WhatsApp and, where applicable, social media platforms. When you click such a link, you leave my website and the privacy policies of the respective providers also apply. Where third-party content is embedded directly, connection data may already be transmitted when that content loads. This must be considered separately in the technical configuration.

10 · Data Recipients and Possible International Transfers

Personal data is disclosed only where necessary to provide the services described, maintain technical operations or comply with legal obligations. Categories of recipients may include hosting providers, email service providers, appointment booking providers, IT and automation service providers and, where voluntarily used, communication platforms.

Where personal data is transferred to providers outside the European Economic Area, an appropriate legal basis and, where required, a transfer mechanism under Chapter V GDPR must be in place. Such mechanisms may include an adequacy decision or appropriate Standard Contractual Clauses, together with any additional safeguards that may be necessary. The specific recipients and safeguards depend on the services actually used and activated.

11 · Data Retention

Contact enquiries are deleted once the purpose of their processing no longer applies, provided that no legal retention obligations prevent deletion. Appointment and administrative data are retained in accordance with the applicable retention periods. As a general rule, patient treatment records must be retained for ten years after completion of treatment under Section 630f(3) of the German Civil Code (Bürgerliches Gesetzbuch – BGB), unless different statutory retention periods apply. Documents relevant to taxation and billing may be subject to other statutory retention periods.

12 · Your Data Protection Rights

Subject to the applicable legal requirements, you have the right to access your personal data (Article 15 GDPR), request rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and object to processing (Article 21). You may withdraw consent previously given at any time with effect for the future under Article 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information.

Data Security and Updates

I use appropriate technical and organisational measures to protect personal data. This Privacy Policy will be updated when relevant changes occur to the website, the service providers used or my practice procedures.