Data protection

Privacy Policy

Datenschutzerklärung · Version: 2026 · This policy is provided in English for our international patients. The German version prevails in case of doubt.

This is a carefully prepared template covering the data processing that takes place on this website. It should be reviewed and, where necessary, completed by your data protection officer or a lawyer before launch — in particular the sections on the contact form handler, hosting contract, and the third-party services actually activated.

1. Controller (Verantwortlicher)

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

If your practice has appointed a data protection officer (Datenschutzbeauftragter), their contact details should be added here.

2. General notes and scope

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (GDPR, the German Federal Data Protection Act / BDSG) and this privacy policy. This policy explains what data we collect when you visit this website and use its features, and for what purpose.

Personal data is any data with which you can be personally identified. Please note that data transmitted over the internet (e.g. by email) can have security gaps; complete protection against access by third parties is not possible.

3. Your rights

You have the following rights regarding your personal data:

• Right to information (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow.

To exercise any of these rights, contact us using the details in section 1.

4. Health data — a special note (Art. 9 GDPR)

Health data are a special category of personal data under Art. 9 GDPR and enjoy particular protection. We only process such data on the basis of your explicit consent (Art. 9 (2) (a) GDPR) or where processing is necessary for medical diagnosis, the provision of treatment, or the management of health-care systems and services (Art. 9 (2) (h) GDPR in conjunction with § 22 BDSG), and always within the framework of medical confidentiality (§ 203 StGB).

5. Accessing our website — server log files

When you visit this website, our hosting provider automatically collects and stores information in server log files that your browser transmits to us. These are:

• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing computer / abbreviated IP address
• Time of the server request

This data is not merged with other data sources. Processing is based on Art. 6 (1) (f) GDPR, which permits the processing of data to ensure a technically error-free presentation and the security of our website. This data is generally deleted after a short period unless needed as evidence in the event of a security incident.

Hosting (united-domains)

This website is hosted by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. united-domains processes the data described above on our behalf. The servers are located within the European Union. Where personal data is processed on our behalf, a data processing agreement (Auftragsverarbeitungsvertrag) in accordance with Art. 28 GDPR is concluded with the provider. Legal basis: Art. 6 (1) (f) GDPR (interest in a reliable, secure presentation of our website).

Please confirm the final hosting product and that the data processing agreement with united-domains is in place; adjust the provider details above if you host elsewhere.

6. Contact form and contact by phone / email

If you send us an enquiry via the contact form, by email, by telephone or via WhatsApp, we will process the data you provide (such as your name, contact details and the content of your message) in order to deal with your request and any follow-up questions. We do not pass this data on without your consent.

Legal basis for this processing is Art. 6 (1) (b) GDPR where your request relates to a (pre-)contractual measure, and otherwise Art. 6 (1) (f) GDPR (our legitimate interest in responding to enquiries) and, where you give it, Art. 6 (1) (a) GDPR (consent). The data you enter remains with us until you ask us to delete it, withdraw your consent, or the purpose for storing it no longer applies; mandatory statutory retention periods remain unaffected.

Note: the contact form must be connected to a GDPR-compliant handler (e.g. server-side email delivery, or a form/CRM provider with a data processing agreement). The provider and legal basis should be named here once chosen.

7. Our Canadian point of contact

To assist patients based in Canada, first enquiries may be handled by our contact in Calgary, Alberta, who coordinates with the medical team in Germany. Where your data is processed by or transferred to this contact outside the European Economic Area, we ensure an appropriate level of protection through suitable safeguards (Art. 44 ff. GDPR). Only the minimum data needed to respond to your enquiry and organise your care is processed for this purpose.

8. WhatsApp (first contact only)

We offer a WhatsApp chat as a low-threshold way to make first contact with our Canadian coordinator. If you choose to contact us via WhatsApp, your message content and the metadata associated with the message (such as your phone number and the time of contact) are processed. WhatsApp is operated by WhatsApp Ireland Ltd. / Meta Platforms; using it may involve the transfer of data to servers outside the EU, including the USA.

Legal basis for processing via WhatsApp is your consent, given by voluntarily starting the chat (Art. 6 (1) (a) GDPR). You can withdraw this at any time by discontinuing the chat and asking us to delete the conversation. For details of WhatsApp’s own data processing, please see WhatsApp’s privacy policy.

Note: for a medical practice, use of WhatsApp should be reviewed and, ideally, implemented via a business solution with a data processing agreement and an EU-based processor. This section should be confirmed by your data protection officer.

9. Google Reviews and WhatsApp widget (Elfsight)

We use the service Elfsight to display our Google reviews and to provide the WhatsApp chat button. Elfsight is provided by Elfsight LLC. When these elements load, your browser connects to Elfsight’s servers (and, for reviews, to Google) and transmits technical data such as your IP address. This allows the content to be displayed correctly.

Where this involves cookies or comparable technologies that are not strictly necessary, we load these components only on the basis of your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG); otherwise the legal basis is Art. 6 (1) (f) GDPR (our interest in presenting reviews and an easy contact option). Reviews shown are provided live by the source platform; we do not edit or select them.

10. Fonts (self-hosted)

This website uses the typefaces Archivo, Source Serif 4 and IBM Plex Mono for a consistent presentation. These fonts are hosted directly on our own server (self-hosted) and are not loaded from Google servers. No connection to Google is established for the fonts, and no data (in particular, no IP address) is transmitted to Google for this purpose.

11. Embedded video content

This website contains video files that are served directly from our own website; no external video platform (such as YouTube or Vimeo) is embedded for these. No additional data is therefore transmitted to third parties when these videos play.

12. Cookies and consent

Our own website functions do not require non-essential cookies. Where third-party components (see sections 8–9) set cookies or similar technologies that are not strictly necessary, these are only loaded with your consent, which you can give, refuse and withdraw at any time.

To obtain and manage this consent, we use a consent banner provided by Elfsight. When you first visit the site, you can decide whether to allow the embedded third-party content (our Google reviews and the WhatsApp chat). Until you agree, these services are not loaded. You can change your decision at any time via the cookie settings on the site. Legal basis for storing your consent decision is Art. 6 (1) (c) and (f) GDPR; the underlying services load only on the basis of your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

13. Data security

This site uses TLS/SSL encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the “https://” prefix and the padlock symbol in your browser’s address bar.

14. Changes to this privacy policy

We may update this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The current version applies to your next visit.

This template was prepared to reflect the actual features of this website. It does not replace individual legal advice. Please have it reviewed and finalised by your data protection officer or lawyer before the site goes live.