Privacy policy

1. Controller

Reha-Punkt Findorff — Praxis für Physiotherapie, Inh. Michael Ahrens e.K., Hemmstraße 148, 28215 Bremen, telephone 0421 39 80 140, email praxis@reha-punkt-findorff.de.

We have not appointed a data protection officer: with fewer than twenty people permanently engaged in automated processing, § 38 (1) BDSG does not require one. Questions about data protection go to the address above.

2. What this policy covers

This policy covers the processing of personal data on this website. Data processed inside the practice as part of your treatment — your record, your prescription, your findings — is subject to medical confidentiality and to the separate patient information we hand you at your first appointment.

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, and its European subsidiary. Each request causes the hosting provider to record the requesting IP address, the date and time, the page requested, the referring page, the browser and operating system, and the amount of data transferred. This happens for technical reasons and to defend against attacks.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in operating the site securely and reliably. Log entries are deleted or shortened after seven days at the latest.

Transfers to the USA are covered by the standard contractual clauses of the European Commission and by a data processing agreement under Art. 28 GDPR.

4. Cookies and local storage

This website sets no advertising cookies, no tracking cookies and no analytics. We store one entry in your browser’s local storage recording whether you have allowed the map to load, so that we do not ask you again. That entry contains no identifier and is never sent to us.

Legal basis: § 25 (2) no. 2 TDDDG — the storage is strictly necessary to provide the function you asked for. You can delete it at any time in your browser settings, or with the cookie settings link in the footer.

5. The call-back form

If you use the call-back form we process the name, telephone number and, where given, email address and message that you enter, together with the time of submission. We use them solely to contact you about an appointment.

Legal basis: Art. 6 (1) (a) GDPR, your consent, which you can withdraw at any time with effect for the future; and Art. 6 (1) (b) GDPR where the contact is aimed at concluding a treatment contract.

Please do not describe symptoms, diagnoses or medication in the form. Health data under Art. 9 GDPR needs more protection than a web form can give it — tell us on the phone or at your appointment instead. If you do send health data anyway, we process it on the basis of Art. 9 (2) (h) GDPR for the purposes of health care, and everyone in the practice is bound by medical confidentiality under § 203 StGB.

We erase the data from the form once your enquiry has been dealt with and no statutory retention period applies, at the latest after six months.

6. Google Maps

We would like to show you a map of the practice, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is not loaded until you actively allow it. Until then no request goes to Google and no data leaves your browser.

If you allow it, Google receives your IP address and information about your browser and device, and may transfer that data to Google LLC in the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses. Google may use it for its own purposes; we have no influence over that.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, your consent. You can withdraw it at any time using the cookie settings link in the footer. Google’s own privacy policy is at policies.google.com/privacy.

7. Online appointments (Doctolib)

Our appointment calendar is operated by Doctolib GmbH, Kastanienallee 4, 10435 Berlin. We link to it; the link only opens when you click it. From that point Doctolib is responsible for the processing of your data as an independent controller and its own privacy policy applies. No data is transferred to Doctolib merely by visiting this website.

Where Doctolib processes appointment data on our behalf we have concluded a data processing agreement under Art. 28 GDPR.

8. Patient records

If you become a patient we keep a record of your treatment under § 630 f BGB. It contains, among other things, your master data, your prescription, the findings we take, what we treat and how you respond. Legal basis: Art. 9 (2) (h) GDPR together with § 22 (1) no. 1 (b) BDSG and the treatment contract under Art. 6 (1) (b) GDPR.

Records must be kept for ten years after the treatment is concluded (§ 630 f (3) BGB); longer periods can follow from other rules. We erase them once every applicable period has expired.

We pass data to your statutory health insurer only to the extent that § 302 SGB V requires for billing, and to third parties otherwise only with your consent or where the law obliges us.

9. Your rights

You have the right to access your data (Art. 15 GDPR), to have inaccurate data corrected (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing rests on your consent you can withdraw it at any time with effect for the future.

You also have the right to complain to a supervisory authority. The one responsible for us is: Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen, Arndtstraße 1, 27570 Bremerhaven.

10. Data security

This website is delivered exclusively over TLS-encrypted connections (HTTPS), recognisable by the lock symbol in your browser. Inside the practice, access to patient data is restricted to the people who need it for treatment or billing.

11. Changes

We adjust this policy when the site or the legal position changes. The current version always applies and is dated at the top of this page.