Legal

Privacy policy

This English version is provided for your convenience. In case of any discrepancy, the German version is legally binding.

1. General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information on data protection, please see our privacy policy set out below this text.

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and this privacy policy.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains which data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmitted over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

2. Data collection on this website

Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

Your data is collected, firstly, when you provide it to us. This may be, for example, data that you enter in a contact form.

Other data is collected automatically, or after your consent, by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website. When you visit this website, your browsing behaviour may be analysed statistically. This is done primarily using so-called analytics programs.

Some of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour. Where contracts can be concluded or initiated via the website, the data transmitted is also processed for contract offers, orders or other requests for services.

3. What rights do you have regarding your data?

You have the right at any time to receive, free of charge, information about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this and any further questions on the subject of data protection.

4. Hosting

We host the content of our website with the following provider:

Raidboxes

The provider is Raidboxes GmbH, Hafenstr. 32, 48153 Münster (hereinafter Raidboxes). When you visit our website, Raidboxes collects various log files, including your IP addresses.

For details, please see Raidboxes’ privacy policy: https://raidboxes.io/legal/privacy/.

Raidboxes is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable possible presentation of our website. Where a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s end device (e.g. for device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

5. Data processing on behalf of the controller

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

6. Information on the controller

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses or similar).

The controller responsible for data processing on this website is:

Mohammed AlShehab

Innerform GmbH
Caroline-von-Humboldt-Weg 40
10117 Berlin

Telephone: +49 (0)30 68086346
Email: info@innerform.de

7. Storage period

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these reasons no longer apply.

8. General information on the legal bases for data processing on this website

Where you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, where special categories of data under Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing is also based on Art. 49(1)(a) GDPR. Where you have consented to the storage of cookies or to access to information on your end device (e.g. via device fingerprinting), data processing is additionally based on Section 25(1) TDDDG. Consent can be withdrawn at any time. Where your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data where this is necessary to comply with a legal obligation, on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. The legal bases that are relevant in each individual case are set out in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our business activities, we work with various external bodies. In some cases, this also requires the transfer of personal data to these external bodies. We only pass on personal data to external bodies if this is necessary for the performance of a contract, if we are legally obliged to do so (e.g. passing on data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or if another legal basis permits the disclosure of data. When using processors, we only pass on our customers’ personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out up to the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a commonly used, machine-readable format. Where you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, correction and deletion

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to correction or deletion of this data. You can contact us at any time about this and any further questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we will usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
If we no longer need your personal data but you need it for the exercise, defence or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
If you have lodged an objection pursuant to Art. 21(1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may – apart from being stored – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from “http://” to “https://” and by the lock symbol in your browser bar.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to promotional emails

We hereby object to the use of contact details published in accordance with the legal notice requirement for the sending of promotional and information material that has not been expressly requested. The operators of the site expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam emails.

4. Data collection on this website

Cookies

Our websites use so-called “cookies”. Cookies are small data packets and do not cause any damage to your end device. They are stored on your end device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain stored on your end device until you delete them yourself or your web browser deletes them automatically.

Cookies can originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies may be used to analyse user behaviour or for advertising purposes.

Cookies that are required to carry out the electronic communication process, to provide certain functions you have requested (e.g. for the shopping cart function) or to optimise the website (e.g. cookies for measuring web audience) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimised provision of its services. Where consent to the storage of cookies and comparable recognition technologies has been requested, processing takes place exclusively on the basis of this consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); consent can be withdrawn at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies on a case-by-case basis, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when the browser is closed. If cookies are disabled, the functionality of this website may be restricted.

You can find out which cookies and services are used on this website in this privacy policy.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent.

Such processing is carried out on the basis of Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) where this has been requested; consent can be withdrawn at any time.

The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to storage, or the purpose for the data storage no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Use of artificial intelligence (AI) to respond to customer enquiries

We use AI-based software to process and respond to customer enquiries. The AI we use analyses the content of your message in order to generate, autonomously or partly autonomously, a suitable reply or a suggested reply. In this context, our AI processes all content of your message, including names, email addresses, communication content or technical information (e.g. IP addresses, device information).

The AI software is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the most efficient possible customer communication using modern technical solutions.

We use the following AI applications:

Superchart

We use Superchart for our customer communication. The provider is SuperX GmbH, Local Court (Amtsgericht) Charlottenburg HRB 218902 B, VAT identification number: DE333726959, Prenzlauer Allee 242-247, 10405 Berlin, Haus 7. When you contact us, your enquiries, including metadata, may therefore be transmitted to this provider’s servers and processed there in order to generate a suitable reply.

Data processing on behalf of the controller

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry, including all personal data arising from it (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

The data you send to us via contact enquiries remains with us until you ask us to delete it, withdraw your consent to storage, or the purpose for the data storage no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Communication via WhatsApp

For communication with our customers and other third parties, we use, among other things, the instant messaging service WhatsApp. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Communication takes place via end-to-end encryption (peer-to-peer), which prevents WhatsApp or other third parties from gaining access to the content of the communication. However, WhatsApp gains access to metadata generated in the course of the communication process (e.g. sender, recipient and time). We also point out that, according to its own statements, WhatsApp shares personal data of its users with its parent company Meta, which is based in the USA. You can find further details on data processing in WhatsApp’s privacy policy at: https://www.whatsapp.com/legal/#privacy-policy.

WhatsApp is used on the basis of our legitimate interest in the fastest and most effective possible communication with customers, prospective customers and other business and contractual partners (Art. 6(1)(f) GDPR). Where a corresponding consent has been requested, data processing takes place exclusively on the basis of that consent; it can be withdrawn at any time with effect for the future.

The communication content exchanged between you and us on WhatsApp remains with us until you ask us to delete it, withdraw your consent to storage, or the purpose for the data storage no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information from the provider at the following link: https://www.dataprivacyframework.gov/participant/7735.

We use WhatsApp in the “WhatsApp Business” variant.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://www.whatsapp.com/legal/business-data-transfer-addendum.

Doctolib

On our website, you have the option of arranging appointments with us. We use Doctolib for booking appointments. The provider is Doctolib GmbH, Mehringdamm 51, 10961 Berlin (hereinafter “Doctolib”).

For the purpose of booking an appointment, you enter the requested data and your preferred appointment in the form provided for this purpose on our website or on our presence at Doctolib. The data entered is used for planning, carrying out and, where applicable, following up the appointment. The appointment data is stored for us on Doctolib’s servers; you can view Doctolib’s privacy policy here: https://media.doctolib.com/image/upload/v1682432985/legal/B2C-PrivacyPolicy-Apr-23-DE.pdf.

The data you enter remains with us until you ask us to delete it, withdraw your consent to storage, or the purpose for the data storage no longer applies. Mandatory statutory provisions – in particular retention periods – remain unaffected.

The legal basis for the data processing is Art. 6(1)(f) GDPR. The website operator has a legitimate interest in making appointments with prospective and existing patients as straightforward as possible. Where a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR / Art. 9(2)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

Data processing on behalf of the controller

Facebook

Elements of the social network Facebook are integrated into this website. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. According to Facebook, however, the data collected is also transferred to the USA and to other third countries.

You can find an overview of the Facebook social media elements here: https://developers.facebook.com/docs/plugins/?locale=de_DE.

When the social media element is active, a direct connection is established between your end device and the Facebook server. As a result, Facebook receives the information that you have visited this website with your IP address. If you click the Facebook “Like button” while logged in to your Facebook account, you can link the content of this website to your Facebook profile. This allows Facebook to associate the visit to this website with your user account. Please note that, as the provider of the pages, we have no knowledge of the content of the data transmitted or of its use by Facebook. You can find further information in Facebook’s privacy policy at: https://de-de.facebook.com/privacy/explanation.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.

Insofar as personal data is collected on our website by means of the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). Joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook. The processing carried out by Facebook after the data has been forwarded is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the text of the agreement at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when the Facebook tool is used and for the implementation of the tool on our website in a manner that is secure under data protection law. Facebook is responsible for the data security of Facebook products. You can assert data subject rights (e.g. requests for information) regarding data processed by Facebook directly with Facebook. If you assert data subject rights with us, we are obliged to forward them to Facebook.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php.

Instagram

Functions of the Instagram service are integrated into this website. These functions are offered by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

When the social media element is active, a direct connection is established between your end device and the Instagram server. As a result, Instagram receives information about your visit to this website.

If you are logged in to your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button. This allows Instagram to associate the visit to this website with your user account. Please note that, as the provider of the pages, we have no knowledge of the content of the data transmitted or of its use by Instagram.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.

Insofar as personal data is collected on our website by means of the tool described here and forwarded to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). Joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook or Instagram. The processing carried out by Facebook or Instagram after the data has been forwarded is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the text of the agreement at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when the Facebook or Instagram tool is used and for the implementation of the tool on our website in a manner that is secure under data protection law. Facebook is responsible for the data security of Facebook or Instagram products. You can assert data subject rights (e.g. requests for information) regarding data processed by Facebook or Instagram directly with Facebook. If you assert data subject rights with us, we are obliged to forward them to Facebook.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://privacycenter.instagram.com/policy/ and https://de-de.facebook.com/help/566994660333381.

You can find further information in Instagram’s privacy policy: https://privacycenter.instagram.com/policy/.

This website uses elements of the LinkedIn network. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Each time a page of this website containing LinkedIn elements is accessed, a connection to LinkedIn’s servers is established. LinkedIn is informed that you have visited this website with your IP address. If you click LinkedIn’s “Recommend button” and are logged in to your LinkedIn account, LinkedIn is able to associate your visit to this website with you and your user account. Please note that, as the provider of the pages, we have no knowledge of the content of the data transmitted or of its use by LinkedIn.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://www.linkedin.com/help/linkedin/answer/a1343190/datenubertragung-aus-der-eu-dem-ewr-und-der-schweiz?lang=de

You can find further information in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy.

6. Analytics tools and advertising

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any independent analyses. It merely serves to manage and deliver the tools integrated through it. However, Google Tag Manager does collect your IP address, which may also be transferred to Google’s parent company in the United States.

Google Tag Manager is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the quick and uncomplicated integration and management of various tools on its website. Where a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, length of stay, operating systems used and the origin of the user. This data is combined in a user ID and assigned to the respective end device of the website visitor.

Furthermore, with Google Analytics we can, among other things, record your mouse and scroll movements and clicks. In addition, Google Analytics uses various modelling approaches to supplement the data sets collected and uses machine learning technologies in data analysis.

Google Analytics uses technologies that make it possible to recognise the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transferred to a Google server in the USA and stored there.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://privacy.google.com/businesses/controllerterms/mccs/.

IP anonymisation

Google Analytics IP anonymisation is activated. As a result, your IP address is shortened by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area before being transferred to the USA. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide further services to the website operator relating to website and internet use. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

Browser plugin

You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

You can find more information on how Google Analytics handles user data in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Data processing on behalf of the controller

We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising programme of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). In addition, targeted advertisements can be displayed on the basis of the user data held by Google (e.g. location data and interests) (audience targeting). As the website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to our advertisements being displayed and how many advertisements led to corresponding clicks.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.

Google Ads Remarketing

This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads Remarketing, we can assign people who interact with our online offering to certain target groups, in order to subsequently show them interest-based advertising in the Google advertising network (remarketing or retargeting).

Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google’s cross-device functions. In this way, interest-based, personalised advertising messages that have been tailored to you depending on your previous usage and browsing behaviour on one end device (e.g. mobile phone) can also be displayed on another of your end devices (e.g. tablet or PC).

If you have a Google account, you can object to personalised advertising at the following link: https://adssettings.google.com/anonymous?hl=de.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.

You can find further information and the data protection provisions in Google’s privacy policy at: https://policies.google.com/technologies/ads?hl=de.

Audience building with customer match

For audience building, we use, among other things, the customer match function of Google Ads Remarketing. In doing so, we transfer certain customer data (e.g. email addresses) from our customer lists to Google. If the customers concerned are Google users and are logged in to their Google account, they are shown suitable advertising messages within the Google network (e.g. on YouTube, Gmail or in the search engine).

Google conversion tracking

This website uses Google conversion tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can recognise whether the user has carried out certain actions. For example, we can evaluate which buttons on our website were clicked and how often, and which products were viewed or purchased particularly often. This information is used to create conversion statistics. We learn the total number of users who clicked on our advertisements and which actions they carried out. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.

You can find more information on Google conversion tracking in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Meta Pixel (formerly Facebook Pixel)

This website uses Meta’s visitor action pixel for conversion measurement. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Meta, however, the data collected is also transferred to the USA and to other third countries.

This makes it possible to track the behaviour of site visitors after they have been redirected to the provider’s website by clicking on a Meta advertisement. This allows the effectiveness of Meta advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimised.

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of users. However, the data is stored and processed by Meta, so that a connection to the respective user profile on Facebook or Instagram is possible and Meta can use the data for its own advertising purposes, in accordance with Meta’s data use policy (https://de-de.facebook.com/about/privacy/). This enables Meta to display advertisements on Facebook or Instagram pages and in other advertising channels. We, as the site operator, cannot influence this use of the data.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.

We use the advanced matching function within the Meta Pixel.

Advanced matching enables us to transmit various types of data (e.g. place of residence, federal state, postcode, hashed email addresses, names, gender, date of birth or telephone number) of our customers and prospective customers that we collect via our website to Meta. This allows us to tailor our advertising campaigns on Facebook and Instagram even more precisely to people who are interested in our offerings. In addition, advanced matching improves the attribution of website conversions and expands custom audiences.

Insofar as personal data is collected on our website by means of the tool described here and forwarded to Meta, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). Joint responsibility is limited exclusively to the collection of the data and its transfer to Meta. The processing carried out by Meta after the data has been forwarded is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the text of the agreement at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when the Meta tool is used and for the implementation of the tool on our website in a manner that is secure under data protection law. Meta is responsible for the data security of Meta products. You can assert data subject rights (e.g. requests for information) regarding data processed on Facebook or Instagram directly with Meta. If you assert data subject rights with us, we are obliged to forward them to Meta.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

You can find further information on protecting your privacy in Meta’s privacy notices: https://de-de.facebook.com/about/privacy/.

You can also deactivate the “Custom Audiences” remarketing function in the ad settings area at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do so, you must be logged in to Facebook.

If you do not have a Facebook or Instagram account, you can deactivate usage-based advertising from Meta on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/.

Newsletter data

If you would like to receive the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. Further data is not collected, or is collected only on a voluntary basis. We use newsletter service providers, described below, to send the newsletter.

Mailchimp with performance tracking deactivated

This website uses the services of Mailchimp to send newsletters. The provider is Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

Mailchimp is a service that can be used, among other things, to organise the sending of newsletters. If you enter data for the purpose of receiving the newsletter (e.g. email address), it is stored on Mailchimp’s servers in the USA. We have deactivated performance tracking at Mailchimp, so that Mailchimp will not evaluate your behaviour when you open our newsletters.

If you do not want your data to be transferred to Mailchimp, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message.

Data processing is based on your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by unsubscribing from the newsletter. The lawfulness of the data processing operations that have already taken place remains unaffected by the withdrawal.

We store the data you have provided to us for the purpose of receiving the newsletter until you unsubscribe from the newsletter, either with us or with the newsletter service provider, and delete it from the newsletter distribution list after you unsubscribe. Data stored by us for other purposes remains unaffected.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://mailchimp.com/eu-us-data-transfer-statement/ and https://mailchimp.com/legal/data-processing-addendum/#Annex_C_-_Standard_Contractual_Clauses.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or by the newsletter service provider in a blacklist, where this is necessary to prevent future mailings. The data in the blacklist is used only for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the statutory requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage in the blacklist is not limited in time. You can object to the storage if your interests override our legitimate interest.

You can find further details in Mailchimp’s privacy provisions at: https://mailchimp.com/legal/terms/.

Data processing on behalf of the controller

Brevo

This website uses Brevo to send newsletters. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo is a service that can be used, among other things, to organise and analyse the sending of newsletters. The data you enter for the purpose of receiving the newsletter is stored on the servers of Sendinblue GmbH in Germany.

Data analysis by Brevo

With the help of Brevo, we are able to analyse our newsletter campaigns. For example, we can see whether a newsletter message has been opened and which links, if any, have been clicked. In this way, we can determine, among other things, which links were clicked particularly often.

We can also see whether certain predefined actions were carried out after opening or clicking (conversion rate). For example, we can see whether you made a purchase after clicking on the newsletter.

Brevo also allows us to divide (“cluster”) newsletter recipients according to various categories. Newsletter recipients can be divided, for example, by age, gender or place of residence. In this way, the newsletters can be better tailored to the respective target groups.

If you do not want any analysis by Brevo, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message.

For detailed information on the functions of Brevo, please follow this link: https://www.brevo.com/de/newsletter-software/.

Legal basis

Data processing is based on your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time. The lawfulness of the data processing operations that have already taken place remains unaffected by the withdrawal.

Storage period

You can find further details in Brevo’s privacy provisions at: https://www.brevo.com/de/datenschutz-uebersicht/ and https://www.brevo.com/de/legal/privacypolicy/.

Data processing on behalf of the controller

8. Plugins and tools

Google Fonts (local hosting)

For the uniform display of fonts, this site uses so-called Google Fonts, which are provided by Google. The Google Fonts are installed locally. No connection to Google servers is established in the process.

You can find further information on Google Fonts at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Google Maps

This site uses the map service Google Maps. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. With the help of this service, we can integrate map material into our website.

To use the functions of Google Maps, it is necessary to store your IP address. This information is generally transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. When Google Maps is activated, Google may use Google Fonts for the purpose of uniform font display. When Google Maps is accessed, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

Google Maps is used in the interest of an appealing presentation of our online offerings and to make the locations stated on our website easy to find. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Where a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

The transfer of data to the USA is based on the EU Commission’s standard contractual clauses. You can find details here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

You can find more information on the handling of user data in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

9. eCommerce and payment providers

Processing of customer and contract data

We collect, process and use personal customer and contract data for the establishment, content design and amendment of our contractual relationships. We collect, process and use personal data on the use of this website (usage data) only insofar as this is necessary to enable the user to use the service or to bill for it. The legal basis for this is Art. 6(1)(b) GDPR.

The customer data collected is deleted after the order has been completed or the business relationship has ended and any statutory retention periods have expired. Statutory retention periods remain unaffected.

Supplementary information on the new website (draft, as of 1 October 2026)

The following sections supplement the above privacy policy with the services that are actually used on the new website. Sections on services of the previous website that are no longer used (for example Raidboxes, Mailchimp, Brevo, Google Maps) are to be deleted or adapted following review by [Innerform / legal counsel].

Hosting with Vercel

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, Vercel automatically collects server log data: IP address, date and time of access, page requested, amount of data transferred, browser type and version, operating system and the previously visited page (referrer). This data is used for technical delivery, security and error analysis and is not merged with other data sources. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in a secure and stable provision of the website). The server logs are deleted after [storage period according to the Vercel contract, e.g. 30 days]. A data processing agreement pursuant to Art. 28 GDPR exists with Vercel; the transfer to the USA is based on the EU standard contractual clauses and Vercel’s certification under the EU-US Data Privacy Framework [check current status].

Content management system and image delivery (Sanity)

The content of this website (texts, images, videos) is managed with the content management system Sanity of Sanity AS, Kongens gate 6, 0153 Oslo, Norway (EEA), and delivered via its content delivery network (cdn.sanity.io). When images and videos are loaded, your IP address is transmitted to Sanity as technically necessary. Personal data is not stored beyond delivery. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a fast and reliable presentation of the content). A data processing agreement pursuant to Art. 28 GDPR exists with Sanity.

Contact form (sent via Resend)

If you send us an enquiry via the contact form, we process the data entered there (name, email address, optionally telephone number, your message) in order to handle your enquiry and for follow-up questions. The message is delivered as an email to our clinic mailbox via the sending service Resend (Resend, Inc., [add address], USA); the form data is not stored permanently on the website itself. The legal basis is Art. 6(1)(b) GDPR (initiating or performing a treatment contract) and, insofar as your enquiry contains health data, Art. 9(2)(h) GDPR in conjunction with Section 22(1) no. 1(b) BDSG. The data remains with us until your enquiry has been conclusively handled and no statutory retention obligations prevent deletion [add deletion period for contact enquiries]. A data processing agreement pursuant to Art. 28 GDPR exists with Resend; the transfer to the USA is based on the EU standard contractual clauses [check current status].

Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking

Only if you have consented via Cookiebot do we load Google Tag Manager and, through it, Google Analytics 4 and Google Ads conversion tracking of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without consent, no cookies from these services are set and no personal data is transmitted to Google (Google Consent Mode v2 with consent denied by default). After consent, Google Analytics 4 collects your shortened IP address, device and browser information, pages viewed, length of stay and interactions in order to evaluate the use of the website statistically. Google Ads conversion tracking attributes appointment requests and contacts to a previously clicked advertisement. The legal basis in each case is Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time with effect for the future. The retention period for user and event data in Google Analytics is [14 months]. Google also processes data in the USA; the basis is the EU standard contractual clauses and Google’s certification under the EU-US Data Privacy Framework. [Further services integrated via Tag Manager, such as Meta Pixel or TikTok Pixel, are to be added here as soon as they are used.]

Videos (Reels)

The short videos embedded on this website are hosted by us and delivered via Sanity. Instagram or other platforms are not integrated; no data is transmitted to Meta Platforms when the videos are played.

Fonts

The fonts used are provided locally from our server. No connection to Google servers (Google Fonts) or other font providers is established when the page is loaded.

Error monitoring (Sentry)

[Only if active:] To ensure the stability of the website, we use the error reporting service Sentry of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. In the event of technical errors, the error message, browser and device information and the page accessed are transmitted; personal content, form entries and full IP addresses are not transmitted. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in an error-free website). A data processing agreement exists with Sentry; data processing takes place in [EU region / USA under standard contractual clauses].

Privacy policy

1. General information

2. Data collection on this website

3. What rights do you have regarding your data?

4. Hosting

Raidboxes

5. Data processing on behalf of the controller

6. Information on the controller

7. Storage period

8. General information on the legal bases for data processing on this website

Recipients of personal data

Withdrawal of your consent to data processing

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

Right to restriction of processing

SSL or TLS encryption

Objection to promotional emails

4. Data collection on this website

Cookies

Contact form

Use of artificial intelligence (AI) to respond to customer enquiries

Superchart

Enquiries by email, telephone or fax

Communication via WhatsApp

Doctolib

Data processing on behalf of the controller

5. Social media

Facebook

Instagram

LinkedIn

6. Analytics tools and advertising

Google Tag Manager

Google Analytics

IP anonymisation

Browser plugin

Data processing on behalf of the controller

Google Ads

Google Ads Remarketing

Audience building with customer match

Google conversion tracking

Meta Pixel (formerly Facebook Pixel)

7. Newsletter

Newsletter data

Mailchimp with performance tracking deactivated

Data processing on behalf of the controller

Brevo

Data analysis by Brevo

Legal basis

Storage period

Data processing on behalf of the controller

8. Plugins and tools

Google Fonts (local hosting)

Google Maps

9. eCommerce and payment providers

Processing of customer and contract data

Supplementary information on the new website (draft, as of 1 October 2026)

Hosting with Vercel

Content management system and image delivery (Sanity)

Contact form (sent via Resend)

Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking

Videos (Reels)

Fonts

Error monitoring (Sentry)