Privacy Policy

Controller and contact

The controller for personal data processed through this website is Can Ikram, Clinic 153, c/o Osteopathie und Naturmedizin, Hohenzollernstraße 97, 80796 München, Germany. Contact the practice at info@clinic153.com or +49 (0) 170 7414007. Clinic153 is an independent private practice within the premises of Osteopathie & Naturmedizin Schwabing.

Operating and protecting the website

The website operates through OpenAI’s ChatGPT Sites on Cloudflare infrastructure. Technical connection information, including IP address, time, requested address and browser/device information, is processed to deliver pages and prevent abuse. The basis is Article 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of the website.

The appointment form also uses a time-dependent hash derived from the IP address and hostname to limit repeated requests. This identifier is pseudonymous and is not used as medical information. Expired rate-limit entries are cleaned up during subsequent successful form submissions.

Appointment requests

The form collects your name, email address, optional telephone number, consultation type, format, preferred date and time. It also stores a request reference, submission time, the version and language of the confirmed privacy declarations, and technical information used to prevent duplicates and track handling.

These details are used to handle your request and arrange an appointment under Article 6(1)(b) GDPR. Any health-related information implied by your request is processed with your separate explicit consent under Article 9(2)(a) GDPR. You can withdraw consent at any time with effect for the future by contacting info@clinic153.com. This does not affect the lawfulness of earlier processing.

Requests are stored in the website database. Access to the practice inbox is restricted to the authenticated practice owner. The form has no field for medical histories and no report-upload facility. Please do not use it to send such information. A request is not an appointment confirmation.

Confirmation of patient documents

With a new appointment request, we also save the name entered as your simple electronic signature, the selected document language, the immutable document version including file fingerprints, and the time of confirmation. This records which documents you received, read and accepted before a later appointment is agreed. The basis is Article 6(1)(b) GDPR; necessary evidence may also be retained to protect legitimate legal interests under Article 6(1)(f) GDPR.

Document confirmation is separate from explicit consent to process health-related information in the appointment request. It does not provide identity verification, a qualified electronic signature or blanket consent to treatment. Only authorised practice administration can access the record.

Email, telephone and other consultation channels

When you contact the practice directly, your contact details and messages are processed to respond to your enquiry. Article 6(1)(b) GDPR applies to preparing a consultation; Article 6(1)(f) GDPR may apply to other administrative enquiries, with the legitimate interest of appropriate communication. Making contact does not constitute blanket consent to other processing purposes.

The website does not currently send automatic email notifications of form submissions. The practice reviews requests in its protected inbox. Before a video consultation, the specific service and related privacy information will be communicated. Contacting the practice does not authorise recordings, sharing with professional colleagues or identifiable educational use. These activities require separate assessment and, where required, separate informed consent.

The patient information lists WhatsApp, Signal, Telegram and SMS as possible channels for short messages. Their use is voluntary; email and telephone remain available. Depending on the service, its provider also processes messages and technical connection data. A suitable channel for confidential health information is agreed beforehand.

Treatment documentation and optional transcription

The patient documents describe written treatment records. Health information from the case history, reports and course of treatment is processed for the agreed treatment and its documentation. Before collection, the practice provides the relevant information and obtains separate explicit consent under Article 9(2)(a) GDPR; Article 6(1)(b) GDPR also applies to performing the treatment contract. Consent in the website form does not cover all subsequent treatment information.

If a digital note-taking or transcription service is considered for a consultation, you will first receive information about the particular service, data processed, recipients, any transfers outside the EEA and deletion periods. It is used only with separate, explicit and voluntary consent. Without consent, notes are taken using conventional written methods. Permanent audio or video recording requires a further separate agreement and consent. Consent may be withdrawn at any time with effect for the future.

Cookies, language preference and external links

The application code does not load analytics or advertising trackers. Fonts and images are served through the website. When you choose a language, the “clinic153_language” cookie stores that choice for up to one year. It contains only the language code and supports the language setting you expressly selected, under section 25(2) no. 2 TDDDG. Associated processing is based on Article 6(1)(f) GDPR to provide this function. You can delete the cookie in your browser at any time.

The protected administration area uses ChatGPT sign-in, which may require essential session data. No patient account is created.

Google Maps is not embedded in the page. Opening the directions link takes you to Google Maps, where Google’s privacy terms apply.

Service providers and international processing

OpenAI/ChatGPT Sites and Cloudflare support hosting and technical delivery. Email providers are also involved when you correspond directly by email. Providers may process data outside the European Economic Area, including in the United States. Such transfers are subject to Articles 44 onwards of the GDPR.

The specific contracting entities, data locations, log-retention periods and applicable transfer mechanisms are being clarified against the relevant provider agreements. Information can be requested at info@clinic153.com. Exclusive storage within Europe is not guaranteed.

Storage and treatment records

Website requests are needed only for handling the enquiry, agreed follow-up steps or applicable statutory retention and evidential requirements. The application does not currently delete requests automatically; archiving a request in the inbox does not delete it. Please contact the practice to request an assessment of deletion or restriction.

Treatment records are distinct from general website enquiries. Under section 630f BGB, they generally must be retained for ten years after treatment ends, unless another statutory period applies. A ten-year period is not automatically applied to every website enquiry.

Document confirmations are kept with the relevant request or treatment agreement for as long as necessary for that contract, statutory duties or required legal evidence. The need for further retention depends on the individual matter; general indefinite retention is not intended.

Your rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation and withdraw consent at any time with effect for the future.

You may complain to a data protection supervisory authority. The Bavarian State Office for Data Protection Supervision (BayLDA) supervises private-sector organisations in Bavaria. You may also contact another competent supervisory authority.

Payments and security measures

The website does not currently accept payments. The appointment form does not request payment information.

Forms are transmitted over HTTPS. Server-side validation, rate limits, duplicate prevention and restricted administrative access help protect data. Completely risk-free transmission or absolute data security cannot be guaranteed.