Data Privacy Statement

This is an English translation of our German privacy policy (Datenschutzerklärung). In case of any discrepancy, the German version shall prevail.

1. An overview of data protection

General information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data with which you can be personally identified. Detailed information on the subject of data protection can be found in our privacy policy below.

Data collection on our website

Who is responsible for the data collection on this website?

The data on this website is processed by the website operator, Philipp Heiler. His contact details can be found below in the section “Information about the controller” and in the imprint of this website.

How do we collect your data?

On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter in our contact form.

Other data is collected automatically by the IT systems of our hosting provider when you visit the website. This is mainly technical data (e.g. web browser, operating system or time of the page request). This data is collected automatically as soon as you enter our website.

What do we use your data for?

Part of the data is collected to ensure that the website is provided without errors and to answer your enquiries. Other data is used to analyse your user behaviour – but only if you have given your consent in the cookie banner.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction, restriction of processing or erasure of this data. If you have given your consent, you can withdraw it at any time with effect for the future. You can contact us at any time about this and any other questions on the subject of data protection. You also have the right to lodge a complaint with the competent supervisory authority.

Analytics and third-party tools

When you visit our website, your surfing behaviour may be statistically analysed with Google Analytics – but only if you have agreed to this via our cookie banner. Without your consent, Google Analytics is not loaded. You can withdraw your consent at any time via the “Cookie settings” link at the bottom of every page. Detailed information can be found in the following privacy policy.

4. Data collection on our website

Hosting and server log files

Our website is hosted on Microsoft Azure (service “Azure Static Web Apps”). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). The website is set up in the Azure region “West Europe”. To make the pages load quickly, the website files may also be delivered from a server near you via Microsoft’s network.

When you visit our website, Microsoft automatically collects information that your browser transmits (so-called server log files), in particular your IP address, date and time of the request, the page requested, the referrer URL, and the browser type and operating system. This data is technically necessary to display the website to you and to ensure its security and stability. This data is not merged with other data sources.

The processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in providing our website securely, without technical errors and quickly.

We have concluded a data processing agreement (Data Protection Addendum) with Microsoft. Insofar as data is transferred to the USA, this is based on Microsoft’s certification under the EU-US Data Privacy Framework (DPF) and on the standard contractual clauses of the EU Commission. Details can be found in Microsoft’s privacy statement: https://www.microsoft.com/en-us/privacy/privacystatement.

Cookies and local storage

Cookies are small text files that are stored on your device by your browser. Cookies do not cause any damage to your device and do not contain viruses.

Our website itself does not set any cookies. However, cookies may be set by third-party providers – by Google Analytics only if you have consented to this via our cookie banner. YouTube or Vimeo may also store cookies or similar technologies on your device once you start a video by clicking play. Details can be found in the respective sections of this privacy policy.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser.

Consent via our cookie banner

When you first visit our website, we show you a cookie banner. There you can decide whether you agree to the use of Google Analytics (“Accept”) or not (“Decline”). Google Analytics is only loaded after you have clicked “Accept”.

Your choice is saved in the local storage (localStorage) of your browser so that the banner does not appear again on every page view. This information remains on your device, is not transmitted to us and remains stored until you change or delete it. Storing your choice is strictly necessary in order to respect your decision (Section 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). We use the cookie banner to obtain the legally required consent for Google Analytics; the legal basis for this is Art. 6(1)(c) GDPR.

You can withdraw your consent at any time with effect for the future: the “Cookie settings” link at the bottom of every page opens the cookie banner again, where you can change your choice (“Decline”). Alternatively, you can delete the stored choice by deleting the cookies and site data for our website in your browser settings; the cookie banner will then appear again on your next visit.

Contact form

If you send us an enquiry via the contact form, we process the data you enter – name, email address, telephone number (optional) and your message – for the purpose of handling your enquiry and in case of follow-up questions. We do not pass on this data without your consent.

Technically, when you submit the form, your details are transmitted in encrypted form to a server function (Azure Function) of our hosting provider Microsoft (see “Hosting and server log files”) and from there sent as an email to our practice mailbox using Microsoft’s “Azure Communication Services”. The form data is not stored on the website itself. To protect against spam, the form contains a field that is invisible to humans; we do not use any third-party services for this (e.g. no reCAPTCHA).

The processing is based on Art. 6(1)(b) GDPR if your enquiry is related to a treatment or to the implementation of pre-contractual measures (e.g. an appointment request). In all other cases, the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6(1)(f) GDPR).

Health data: Please note that information about your health (e.g. symptoms or diagnoses) belongs to the special categories of personal data under Art. 9 GDPR. We do not need such information for an enquiry. If you voluntarily provide health data in your message, we process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give by sending the message, and – insofar as it concerns your treatment – on the basis of Art. 9(2)(h) GDPR; we treat it confidentially and in compliance with medical confidentiality. You can withdraw your consent at any time with effect for the future. If you would like to give detailed information about your health, you are welcome to discuss it with us by telephone or in person.

The data you enter in the contact form will remain with us until you ask us to delete it, withdraw your consent to its storage or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions – in particular retention periods, e.g. if your enquiry becomes part of the medical records – remain unaffected.

Enquiries by email or telephone

If you contact us by email or telephone, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. The legal bases and storage period correspond to the information on the contact form; the information on health data applies accordingly.

6. Plugins and tools

Fonts (hosted locally)

The fonts and icons used on this website are loaded from our own web server. No connection to Google servers (Google Fonts) or other third-party providers is established for this purpose.

YouTube with enhanced privacy mode

On some pages of our website we show videos from the YouTube platform. The operator is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you open such a page, no connection to YouTube is established yet: instead of the video, you first only see a preview picture stored on our own web server, with a play button and the note “Playing loads YouTube”. As long as you do not click play, no data is transmitted to YouTube or Google.

Only when you click play does your browser load the YouTube video player in enhanced privacy mode (via www.youtube-nocookie.com) and the video starts. A connection to YouTube’s servers is then established and, in particular, your IP address, the address of our website and technical information about your browser and device are transmitted to YouTube. If you are logged in to your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account. The enhanced privacy mode does not necessarily exclude the transfer of data to YouTube partners; for example, once the player has loaded, YouTube may establish a connection to the Google DoubleClick network.

Furthermore, after a video has been started, YouTube may store various cookies or similar technologies on your device. With their help, YouTube can obtain information about visitors to our website, among other things to collect video statistics, improve user-friendliness and prevent fraud. After starting a YouTube video, further data processing operations may be triggered over which we have no control. This may also involve a transfer of data to the USA; Google bases such transfers on the EU-US Data Privacy Framework.

The legal basis is the consent you give by clicking play (Art. 6(1)(a) GDPR and Section 25 (1) TDDDG). The consent only applies to the video you clicked; the next time you open the page, you will see the preview picture first again. You can withdraw it at any time with effect for the future by not playing any further videos and deleting cookies set by YouTube via your browser settings.

Further information on data protection at YouTube can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=en.

Vimeo

On some pages of our website we show videos from the video portal Vimeo. The provider is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA.

When you open such a page, no connection to Vimeo is established yet: instead of the video, you first only see a preview picture stored on our own web server, with a play button and the note “Playing loads Vimeo”. As long as you do not click play, no data is transmitted to Vimeo.

Only when you click play does your browser load the Vimeo player and the video starts. A connection to Vimeo’s servers is then established and, in particular, your IP address, the address of our website and technical information about your browser and device are transmitted to Vimeo, even if you are not logged in to Vimeo or do not have a Vimeo account. We embed Vimeo with the “Do Not Track” setting; according to Vimeo, it then does not use tracking cookies. If you are logged in to your Vimeo account, you enable Vimeo to assign your surfing behaviour directly to your personal profile.

The legal basis is the consent you give by clicking play (Art. 6(1)(a) GDPR and Section 25 (1) TDDDG). The consent only applies to the video you clicked; the next time you open the page, you will see the preview picture first again. You can withdraw it at any time with effect for the future by not playing any further videos and deleting cookies set by Vimeo via your browser settings. According to Vimeo, transfers of data to the USA are based on the EU-US Data Privacy Framework.

Further information on the handling of user data can be found in Vimeo’s privacy policy: https://vimeo.com/privacy.

Map picture and link to Google Maps

On our contact page we show a map picture with the location of our practice. This picture is stored on our own web server and is based on map data from OpenStreetMap (© OpenStreetMap contributors). No connection to third-party servers is established when the picture is displayed. No map from a map service (e.g. Google Maps) is embedded on our website.

The map picture is a link: if you click on it, the Google Maps service opens with our address in a new browser tab. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Only then is data (e.g. your IP address) transmitted to Google; Google processes it under its own responsibility. Google’s privacy policy applies: https://policies.google.com/privacy?hl=en.

jameda and other external links

Our website contains links to our profile on jameda (reviews and online appointment booking). The provider is jameda GmbH, St.-Cajetan-Straße 41, 81669 München, Germany. No jameda widget or seal is embedded: as long as you do not click on a link, no data is transmitted to jameda. Only when you click on a jameda link are you taken to the jameda website, where jameda’s privacy policy applies: https://www.jameda.de/datenschutz.

The same applies to other links to external websites, e.g. to podcast episodes on Spotify: we do not use embedded content from these providers; data is only transmitted when you click on the link.