Privacy notice

1. Controller and contact details

Email

info@praxisweidl.com

Phone

+49 160 9805 2882

You can also use these contact details for questions about data protection and to exercise your rights. Further information about the practice is available in the legal notice.

2. Website and hosting

Website delivery and security

We use Cloudflare to deliver this website. When you access it, the service processes technical request data: your IP address, the web address requested, the time of access, and information about your browser and device. This processing enables content delivery and supports availability and protection against abusive access.

Recipient: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the reliable and secure operation of the website.

Cloudflare processes data across its worldwide network, including outside the European Economic Area. The Cloudflare Data Processing Addendum provides for EU standard contractual clauses and supplementary safeguards for the relevant transfers; their contents are available there.

Technical access and security data are retained to the extent and for as long as they are necessary to provide and secure the service, investigate specific security incidents or comply with legal obligations. Further information is available in the Cloudflare Privacy Policy, particularly the section on data retention.

3. Contact and appointment management

If you contact us by email, phone, post or an agreed communication service, we process your contact details, the content of your message and the information needed to handle it. For appointments, this includes in particular your name, contact details and appointment information.

We handle enquiries about treatment, training or another contract on the basis of Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR; our legitimate interest is appropriate communication with the person making the enquiry. Health information is also subject to the requirements described in the section on treatment and health data.

The information required to handle your enquiry depends on its nature. Without a means of contacting you, we cannot reply; without the necessary appointment information, we cannot arrange an appointment.

Email via Raidboxes

We use Raidboxes for the practice's email mailbox. Email addresses, message contents, attachments and technical connection data are processed for this purpose. The recipient is Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany. The purpose and legal bases are those described above for contacting us; the retention periods and criteria below apply. Further information is available in the Raidboxes Privacy Policy.

Doctolib

We use Doctolib for online appointment scheduling and appointment management. The contact and appointment data provided are used to arrange and organise your treatment. The recipient is Doctolib GmbH, Friedrichstraße 111, 10117 Berlin, Germany. Appointments are managed on the basis of Article 6(1)(b) GDPR. Information about processing by the provider is available in the Doctolib privacy information.

Google Calendar

When you book through the linked Google Calendar in Google Workspace Individual, we receive the contact and appointment information you provide. We process this to organise the agreed appointment on the basis of Article 6(1)(b) GDPR. The provider and information about processing by Google are listed in the section on services used to organise the practice.

4. Treatment, training and business relationships

Treatment and health data

In providing therapeutic services, we process basic personal and contact details, information about the agreed treatment, payment and billing data, and the health data required for taking a medical history, treatment and documentation. The nature, scope and necessity of this processing depend on the individual treatment relationship.

Performance of the treatment contract is based on Article 6(1)(b) GDPR; statutory documentation and retention obligations are based on Article 6(1)(c) GDPR. Processing health data additionally requires permission under Article 9 GDPR. Where we process these data on the basis of your explicit consent, Article 9(2)(a) GDPR applies. The specific processing and any consent required for it are explained in connection with the treatment.

The transfer of treatment data to medical institutions, laboratories, billing services or authorities depends on the purpose of the treatment, your consent or a legal obligation. You will receive information about the recipients involved in your individual case in connection with the relevant processing.

Education and training services

For education and further training, we process the basic personal, contact, contractual and payment data needed for registration, delivery and billing, as well as information about participation and performance assessment. The legal basis is Article 6(1)(b) GDPR. Statutory retention obligations are based on Article 6(1)(c) GDPR. If a training service involves health data, the requirements of Article 9 GDPR also apply; any necessary explicit consent is obtained separately.

Contract performance and administration

We process contractual, contact and payment data to provide our services, issue invoices and fulfil legal obligations. We tell you which information is required before or when it is collected. Without the necessary contractual information, the requested service cannot be provided.

We process the data needed to establish and defend legal claims and to organise our business properly on the basis of Article 6(1)(f) GDPR. Our legitimate interest is to protect our rights and ensure that our business relationships are managed in a traceable manner.

5. Services used to organise the practice

Google Workspace Individual

We use Google Workspace Individual to manage appointments. The contact and appointment data needed for booking and organisation are processed for this purpose. The purpose and legal bases are described in the section on contact and appointment management. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.

Under the Google Workspace Individual Additional Terms, professional use is subject to the Data Processing Addendum for Products Where Google is a Data Processor. Information about Google's own processing is available in the Google Privacy Policy.

Google also processes data outside the European Economic Area. For transfers to Google LLC in the United States, Google relies on the EU-US Data Privacy Framework; for other transfers, the Data Processing Addendum provides in particular for standard contractual clauses. The applicable legal bases and safeguards are available in the information on international data transfers and the linked Data Processing Addendum, including its standard contractual clauses.

6. Communication via messaging services

When communicating via messaging services, we process the identifier or phone number you use, your messages and attachments, and the communication data needed to handle your enquiry. The purpose of the processing is to respond to your concerns. Article 6(1)(b) GDPR applies to communication relating to a contract; Article 6(1)(f) GDPR applies to other enquiries, with the legitimate interest of handling your message. Where use is based on consent given separately, Article 6(1)(a) GDPR applies.

Depending on the service, providers also process account, device and connection data. The following information concerns the respective channels used to communicate with you:

• Telegram Broadcasts: Telegram Messenger Inc. Telegram stores messages from cloud chats on its servers. Posts in public channels are publicly accessible. Telegram Privacy Policy.
• WhatsApp: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The WhatsApp Privacy Policy also describes international data processing and the safeguards provided for it.

You can withdraw your consent to communication at any time with effect for the future, or choose another contact method. Phone and email are also available. Retention depends on the content of the communication and the periods stated below.

7. Public profiles and reviews

Jameda

There is a public profile of our practice on Jameda. Where we handle feedback about this profile, we process the relevant publicly available profile and review information and any information provided to us in that connection. Our legitimate interest under Article 6(1)(f) GDPR is to present the practice and handle feedback. The provider is Jameda GmbH, Brienner Straße 45 a-d, 80333 Munich, Germany. Further information is available in the Privacy Policy for Jameda users.

Reviews on this website

We publish selected reviews on this website that are already publicly accessible. In doing so, we process the published name, review text, star rating and source attribution. The sources are the respective public review profiles. The purpose is to provide information about experiences with the practice; the legal basis for general review information is Article 6(1)(f) GDPR. Our legitimate interest is to present publicly shared experiences. Special categories of personal data are additionally subject to the requirements of Article 9 GDPR.

8. Recipients and international processing

Recipients of personal data include the services named in the respective sections and, where necessary for a particular activity, banks, tax and legal advisers, IT service providers, medical institutions, billing services and competent authorities. Disclosure depends on the relevant purpose, your consent or legal obligations. Where data are processed on our behalf, the requirements of Article 28 GDPR apply.

Processing outside the European Economic Area is additionally subject to the requirements of Articles 44 et seq. GDPR. These include adequacy decisions by the European Commission or appropriate safeguards, in particular standard contractual clauses. Information about the safeguards provided for the named services and where to obtain them is available in the linked provider information. You can obtain further information about a specific transfer using the contact details above.

9. Retention and erasure

We retain personal data for as long as they are required for the relevant purpose. In particular, the following periods and criteria apply:

• Contact enquiries: until the enquiry has been fully dealt with and there is no longer any need to refer back to the correspondence; statutory retention obligations remain unaffected.
• Treatment records: ten years after completion of treatment under section 630f(3) of the German Civil Code (BGB), unless other provisions specify a different period.
• Tax-related documents: in particular, ten years for accounting books and annual financial statements, eight years for accounting vouchers and, as a general rule, six years for business correspondence and other tax-related documents under section 147 of the German Fiscal Code (AO). The period begins at the end of the calendar year in which the document was created or the last entry was made; statutory extensions remain unaffected.
• Contract documents and legal claims: until the matter has been concluded and for as long as the documents are needed to establish or defend claims.
• Published reviews and posts: for as long as they are required for the relevant publication and its purpose; valid requests for erasure or objections are taken into account.

Where statutory retention obligations or other continuing legal bases apply, the data are retained for those purposes. Any consent given may be withdrawn at any time with effect for the future.

10. Your rights

Subject to the statutory requirements, you have the following rights:

• Access to your personal data and a copy of those data (Article 15 GDPR).
• Rectification of inaccurate data or completion of incomplete data (Article 16 GDPR).
• Erasure or restriction of processing (Articles 17 and 18 GDPR).
• Receipt of data you have provided in a structured, commonly used, machine-readable format, or their transmission to another controller (Article 20 GDPR).
• Withdrawal of consent with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).

Right to complain to a supervisory authority

You may lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the alleged infringement (Article 77 GDPR).

The authority responsible for the practice is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach. Postal address: Postfach 1349, 91504 Ansbach. Contact and complaint options at BayLDA.

11. Protected website preview

This section concerns the restricted-access preview for authorised people. Access is protected by Cloudflare Access. When you sign in using an email code, your email address, technical connection data and the result of the access check are processed to verify your authorisation and prevent unauthorised access.

Cloudflare Access sets the CF_Authorization cookie for this purpose. It confirms a successful sign-in; the configured session is valid for 24 hours. Processing is based on Article 6(1)(f) GDPR, with our legitimate interest in protecting unpublished versions of the website. The cookie required for the requested protected access is stored in accordance with section 25(2), point 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The provider and information about international processing are listed in the section on website and hosting.