Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

[Dr. med. First name Last name]
Dr. Nüchel Aesthetik
Albertus Zentrum, 5. Etage
Steinmetzstraße 47
41061 Mönchengladbach
Phone: 02161 4624990
Email: aesthetik@drnuechel.de

2. General information and legal bases

We process personal data exclusively within the framework of the statutory provisions, in particular the GDPR (DSGVO) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). Depending on the respective processing operation, the legal bases for processing are Art. 6 Abs. 1 lit. a DSGVO (consent), Art. 6 Abs. 1 lit. b DSGVO (contract or pre-contractual measures), Art. 6 Abs. 1 lit. c DSGVO (legal obligation) as well as Art. 6 Abs. 1 lit. f DSGVO (legitimate interest). Insofar as special categories of personal data – in particular health data – are processed, this is carried out on the basis of your explicit consent pursuant to Art. 9 Abs. 2 lit. a DSGVO.

3. Hosting and server logs

This website is hosted by [Hosting provider, e.g. Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA] . When the website is accessed, the hosting provider automatically processes information in so-called server log files (in particular IP address, date and time of access, page accessed, browser type and operating system). This data is technically necessary for the provision, stability and security of the website. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in secure and reliable operation). A contract for commissioned data processing pursuant to Art. 28 DSGVO exists with the hosting provider: [Enter status of the data processing agreement].

4. Cookies and local storage

This website uses exclusively technically necessary storage operations. Your decision in the consent banner is stored in your browser's localStorage so that the banner does not reappear on every visit. No tracking or analytics services are used. Fonts are embedded locally; no connection is made to the Google Fonts CDN. You can change or withdraw your consent to external content (Google Maps, see section 11) at any time via the cookie settings in the footer of the website.

5. Contact form

If you send us an enquiry via the contact form, we process the data you provide (name, email address, optionally telephone number as well as the content of your message) exclusively to handle your enquiry and for any follow-up questions. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (initiation or performance of a treatment relationship or handling of your request). Your data will be deleted as soon as it is no longer required for processing and no statutory retention obligations stand in the way, at the latest after [Period, e.g. 6 months after final handling].

6. Online appointment booking

Via our online appointment request we process the data you provide: salutation, first and last name, date of birth, email address, telephone number, preferred appointment, the indication of whether you have already been treated by us, optionally your message as well as the requested concern. The date of birth and the information on treatment status serve exclusively to identify you uniquely or for record-keeping within our internal practice administration; this matching is carried out purely internally within the practice and is never made publicly accessible. Please note: providing the desired treatment may allow conclusions to be drawn about your state of health and therefore constitutes health data within the meaning of Art. 9 DSGVO. The processing of this information is carried out on the basis of your explicit consent pursuant to Art. 9 Abs. 2 lit. a in conjunction with Art. 6 Abs. 1 lit. a DSGVO, which you grant in the course of the appointment request and can withdraw at any time with effect for the future.

The request data is stored in the practice's own database. To confirm, change or cancel your appointment, you will receive emails at the address you provided. The data will be deleted as soon as it is no longer required for appointment organisation and no statutory retention obligations exist, at the latest after [Period, e.g. 12 months after the appointment]. The status of your appointment (e.g. attended) is reported back from the practice administration to the booking system in order to control the dispatch of the appointment-related emails mentioned in section 9.

7. Digital medical history form

After booking an appointment, you have the option of voluntarily completing an online medical history form. In doing so, we process the health-related information you provide (in particular pre-existing conditions, medications, allergies and previous treatments). This constitutes health data within the meaning of Art. 9 DSGVO. The processing is carried out exclusively on the basis of your explicit consent pursuant to Art. 9 Abs. 2 lit. a DSGVO, which you grant via the corresponding mandatory checkbox in the medical history form and can withdraw at any time with effect for the future.

Your information is stored AES-256-encrypted in our database and transmitted to our practice administration exclusively via an authenticated, encrypted connection.

The online medical history form is automatically deleted 60 days after your appointment; in the case of cancelled appointments, deletion takes place after 30 days. The treatment documentation kept in the practice is, independently of this, subject to the medical retention obligations: [10 years, § 630f BGB].

8. Transfer to the practice administration (commissioned internal processing)

Your appointment data and – provided you have completed it – your medical history form are automatically transferred to our internal practice administration software. This is operated on a server in our practice; an external service provider is not involved. The data is retrieved exclusively by the practice from the inside out. The legal basis is Art. 6 Abs. 1 lit. b DSGVO or, for health data, Art. 9 Abs. 2 lit. a and lit. h DSGVO.

Also for appointments arranged directly in the practice – by telephone or in person – your name, your email address and the type of treatment may be processed via the website infrastructure and the email dispatch service when the practice triggers appointment information, reminder or review emails. The recipients of this data in this case are the hosting provider and the email provider as processors pursuant to Art. 28 DSGVO: [Enter hosting and email provider]. Patients are also informed about this processing in the practice: [Data protection notice of the practice].

9. Appointment-related emails

In connection with your appointment, we send confirmation emails as well as a reminder 24 hours before the appointment. The legal basis for this is Art. 6 Abs. 1 lit. b DSGVO (performance of the treatment or appointment relationship).

In addition, as an existing patient you may, after an attended appointment, receive notes on a refreshment of the treatment you received (recall) as well as a request for a review. For similar services of our own, dispatch is carried out on the basis of § 7 Abs. 3 UWG in conjunction with Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in informing and retaining existing patients). Each of these emails contains a notice that you can object to receiving them at any time; following an objection, no further dispatch will take place.

We send refreshment reminders (recall) exclusively after appointments that were actually attended. If you object to receiving recall or review emails, we store your email address in an internal suppression list so that your objection is permanently observed and no further dispatch is made to you. The legal basis for this storage is Art. 6 Abs. 1 lit. c DSGVO (legal obligation to observe your objection) or Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in the permanent and demonstrable implementation of the objection).

10. Email dispatch (SMTP)

For the dispatch of confirmation and notification emails (contact form, appointment requests) we use [SMTP/email provider, name and address]. In doing so, the data required for dispatch (email address, name, content of the message) is transmitted to the provider. The legal basis is Art. 6 Abs. 1 lit. b DSGVO; a contract for commissioned data processing pursuant to Art. 28 DSGVO exists with the provider: [Enter status of the data processing agreement].

11. Google Maps

On our contact page we embed a map from the Google Maps service (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded after you have explicitly given your consent (two-click solution). The legal basis is your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO. When the map is loaded, personal data (in particular your IP address) is transmitted to Google; a transmission to servers in third countries, in particular the USA, cannot be ruled out in this respect. You can withdraw your consent at any time with effect for the future via the cookie settings in the footer of the website. Further information can be found in Google's privacy policy: policies.google.com/privacy.

12. Your rights as a data subject

With regard to the personal data concerning you, you are entitled to the following rights:

• right of access (Art. 15 DSGVO),
• right to rectification (Art. 16 DSGVO),
• right to erasure (Art. 17 DSGVO),
• right to restriction of processing (Art. 18 DSGVO),
• right to data portability (Art. 20 DSGVO),
• right to object to processing carried out on the basis of Art. 6 Abs. 1 lit. e or f DSGVO (Art. 21 DSGVO),
• right to withdraw consent given at any time with effect for the future (Art. 7 Abs. 3 DSGVO); the lawfulness of the processing carried out up to the withdrawal remains unaffected.

To exercise your rights, an informal notification to the contact details stated above is sufficient.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
www.ldi.nrw.de

14. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar begins with „https://“ and by the lock symbol in your browser bar. When encryption is activated, the data you transmit to us generally cannot be read by third parties.

15. Currency of this privacy policy

This privacy policy is dated [Insert date]. Due to the further development of our website or as a result of changed statutory requirements, an adjustment may become necessary; the version published here applies in each case.