CLINIC153 · YOUR PERSONAL DATA

Data protection.

The privacy of patients is of utmost importance to Can Ikram and Clinic153. This page sets out the practice’s data-handling information and explains how online consultation requests are handled.

Responsible for data processing

Questions about personal data and requests to exercise your rights can be sent directly to Can Ikram at the contact details above.

What data is collected, and why?

The practice processes personal and health information to fulfil the treatment agreement and associated obligations. This includes contact details, medical history, diagnoses, treatment suggestions and findings recorded by Can Ikram or supplied by other healthcare professionals. Information necessary for treatment must be provided before appropriate consultations can take place.

The practice policy identifies Article 9(2)(h) GDPR in conjunction with Section 22(1) No. 1(b) BDSG, and Article 6 GDPR where applicable, as the legal basis for treatment-related processing.

Appointments and consultations

When arranging an appointment by phone or email, the practice collects your name, telephone number and email address. Additional information is voluntary. During the anamnesis, health information is documented in writing. The practice policy also provides for video documentation in certain cases; please refer to the patient agreement for the recording provisions and discuss any questions before your consultation.

Online consultation requests

When you submit the consultation form, Clinic153 saves your name, email address, optional phone number, consultation type, preferred date and time, and appointment format, together with a request reference, submission time, and your acknowledgement of the privacy notice. These details are used to respond to your enquiry and arrange an appointment. The form does not confirm an appointment or take a payment.

Submissions are stored in the website’s database and can be reviewed only through the practice owner’s signed-in inbox. Email notifications are addressed to can@clinic153.com. When the email service is activated, notifications contain the submitted contact details and appointment preferences and are sent through Resend. A request remains saved if email delivery is unavailable.

Please keep medical histories, diagnoses and reports for your consultation. Do not enter sensitive medical details into the form’s contact fields. Short-lived, hashed network identifiers are used to limit automated or repeated submissions. Subscription checkout remains a preview and does not create an account, charge a payment method or activate a plan.

Website access, cookies and payment processing

The website is hosted through ChatGPT Sites, with the application running on Cloudflare infrastructure. The hosting platform may process access and security information and uses access controls for this private preview. This application does not include Google Analytics, advertising trackers or marketing cookies. Fonts and the illustrative interior image are served with the site.

Online payments are not active. The prepared payment flow uses Stripe-hosted checkout and a billing portal when configured. Card numbers would be entered with the payment provider, rather than stored by this website. The practice’s final provider information and processing arrangements need to be reflected here before live enrolment.

The former policy refers to TTDSG; the current statutory name is Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG).

When is information shared?

The practice policy provides for sharing only where legally permitted or with consent. For referrals or professional case discussions, only the information necessary for the purpose is shared. For medical billing, the minimum necessary information may be provided to a billing service, such as a name, address, treatment dates and service codes. The supplied policy states that consent to these arrangements may be withdrawn.

Teaching, articles and recordings

The practice policy permits anonymised excerpts from written anamneses or recordings to be used in training, articles or presentations. Where a face is visible, the policy requires explicit consent. The patient agreement also describes anonymised educational or research use and withdrawal of that consent.

How long is data retained?

According to the practice policy, treatment records are retained for at least 10 years after treatment ends, with longer periods where other applicable obligations require them. Website appointment requests are stored separately so the practice can follow up. They remain in the practice inbox, including when marked archived, until removed by the practice. Please contact can@clinic153.com about access, correction or deletion of a request. Copies received by email are managed separately in the practice mailbox.

Security and assessment

The practice policy describes technical and organisational measures to protect data against loss, destruction and unauthorised access, with measures updated as appropriate. It also provides for a data protection impact assessment where processing presents a high risk to patients’ rights and freedoms.

Your rights

You can request access to information held about you, correction of inaccuracies, deletion or restriction where legally permissible, and portability of information you have provided. You can also withdraw consent where processing relies on it. Please contact info@clinic153.com to discuss a request.

Practice information is based on the supplied Clinic153 data protection policy, dated October 2024. The website section was updated on 9 October 2026 to describe saved consultation requests.