Privacy notice

The German version is authoritative.

Here you can find out which personal data we process when you visit this website, send us a request online or call us – and what rights you have. This notice applies to patients and to all visitors to the website. There is a separate notice for job applications.

Controller

Data protection officer

Viktor Cernovski
Praxis Gundheim, Greifenklaustraße 31, 67599 Gundheim
Email: info@praxisgundheim.de (please add ‘z. Hd. Datenschutzbeauftragter’, meaning ‘for the attention of the data protection officer’)

Visiting this website

Our own server in the practice

This website runs on our own server in our practice in Germany. It does not load any content from other providers: no external fonts, no embedded maps or videos, no statistics or advertising services and no social media buttons.

Our server does not keep an access log with IP addresses. It only stores technical messages for troubleshooting, for example the type and size of a form received – without the IP address and without the content.

Cloudflare (transmission and protection against attacks)

So that our server cannot be reached directly from the internet, the connection runs via the Cloudflare service. Your browser sets up an encrypted connection (HTTPS) to Cloudflare. For technical reasons, Cloudflare decrypts this connection, checks it for attacks and forwards it to our server via a separate encrypted connection (‘tunnel’).

In doing so, Cloudflare processes the data that every browser sends when it opens a page: your IP address, the date and time, the address opened, information about your browser and operating system, and the address of the page you visited before, if your browser sends it.

The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare works for us as a processor on the basis of a data processing agreement (Art. 28 GDPR), which obliges it to keep the data confidential. For the transfer to the USA, please read the section ‘Transfers to countries outside the EU’.

The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). More on this: Cloudflare privacy policy (in English)

Cookies

We do not set any cookies when you read this website. Only when you open a form does your browser store a security cookie. It prevents other websites from sending forms in your name.

• Name: __Host-csrftoken
• Content: a random string of characters, no information about you
• Storage period: up to one year. You can delete it in your browser at any time.

This cookie is strictly necessary for sending the form securely. No consent is needed for this (§ 25(2) no. 2 TDDDG, the German Telecommunications and Digital Services Data Protection Act). That is why we do not show a cookie banner. Choosing a language works via simple links, without a cookie.

Online requests (repeat prescription, follow-up referral, message)

What we use your information for

With our online forms, you can order a repeat prescription (Dauerrezept), request a follow-up referral (Folgeüberweisung) or send us a message or callback request. We only use your information to deal with your request as part of your treatment.

For this, we process the information from the form: name, date of birth, phone number, type of insurance if applicable, preferred doctor and the content of your request – such as medicines, the specialty and reason for a referral, or your message. Some of this is health data.

Legal basis

The processing is necessary for your treatment (treatment contract, Art. 6(1)(b) GDPR). We process health data for the purpose of health care by persons who are bound by medical confidentiality (Art. 9(2)(h) and (3) GDPR in conjunction with § 22(1) no. 1(b) BDSG, the German Federal Data Protection Act). No consent is needed for this. We are legally obliged to document this in your patient record (Art. 6(1)(c) GDPR in conjunction with § 630f BGB, the German Civil Code, and § 10 of the professional code of conduct for doctors, Berufsordnung).

You do not have to use the forms. However, we cannot process an online request without the required information. You can also deal with any matter by phone or at the practice.

Encryption (‘letterbox principle’)

If JavaScript is switched on in your browser, your information is encrypted in your browser before it is sent. Neither Cloudflare nor the publicly accessible part of our website can read it. Only the practice’s internal system decrypts it, and it then stores it in encrypted form again. Only the staff and doctors of our practice who deal with your request have access to it.

If JavaScript is switched off, the form still works. Your information is then transmitted via HTTPS and encrypted immediately on our server. In this case, for technical reasons, Cloudflare may process it unencrypted during transmission. We therefore recommend leaving JavaScript switched on.

Protection against misuse

We do not store an IP address with your request. To prevent anyone from misusing the forms on a large scale, we only keep a check value (hash) of your IP address, which we create with a secret key. We do not store the IP address itself. We only use the check value for 24 hours. After that, our system deletes it automatically, at the latest after 48 hours. The legal basis is our legitimate interest in protecting the forms (Art. 6(1)(f) GDPR). A hidden field and a time check also help against automated submissions. We do not use a picture puzzle (CAPTCHA).

Our reply

We do not reply by email and do not send confirmations by email. If we have questions, we will call you on the phone number you gave us. You can redeem an e-prescription at the pharmacy with your health insurance card; paper prescriptions and referrals will be ready for you at the reception desk.

Phone and email

Telephone assistant ARON

When you call us, our digital telephone assistant ARON may answer first. ARON is a computer program that uses artificial intelligence (AI).

What we use ARON for

On the phone, ARON takes appointment requests and other enquiries. ARON passes your information on to our practice team. We do not use ARON for medical decisions. These decisions are made by our doctors.

What data is processed

• Your phone number, if your phone transmits it
• Date and time of the call
• Your voice and what you say during the call
• Information that you give, for example your name, date of birth and your concern. This may also include information about your health.
• A text that ARON creates from the call

So that ARON can understand you, a computer analyses your speech and converts it into text.

Who receives your data

Our practice team receives your information. We need it to deal with your concern.

A service provider for computer technology (IT service provider) runs ARON for us. It may only process your data on our behalf and only according to our instructions (Art. 29 GDPR). It must keep your data secret. This is required by the German Criminal Code (§ 203 StGB). This also applies to companies that it uses for this, for example data centres.

Legal basis

We process your data to deal with your appointment request or your concern. This serves your treatment or prepares for it. The legal bases are Art. 6(1)(b) GDPR and, for information about your health, Art. 9(2)(h) and (3) GDPR in conjunction with § 22(1) no. 1(b) BDSG.

Are you not calling about your own treatment, for example on behalf of a relative, a care home or a pharmacy? Then the legal basis is our legitimate interest in answering calls and passing them on to our practice team (Art. 6(1)(f) GDPR).

How long your data is stored

Your data may only remain stored with the service provider for as long as is necessary to deal with your concern. Anything that is part of your treatment is added to your patient record. We keep the patient record for 10 years after the end of the treatment (see ‘How long we store data’).

You have a choice

You do not have to use ARON. You can also tell us about your concern in person at the practice. If you do not give ARON any information, ARON cannot take down your concern.

Find out more

We will be happy to tell you the name of the service provider on request. Your rights, for example to access and erasure, also apply here. You can find them under ‘Your rights’.

Email

If you send us an email, we process your address and the content in order to deal with your concern. Our mailboxes are hosted by STRATO GmbH in Berlin (processor). Normal emails are not encrypted all the way on their journey. Please therefore do not send us any health data by email. Likewise, we do not answer questions about your health by email.

Links to other providers

This website contains links, for example to OpenStreetMap for directions, or to professional chambers and authorities. We do not transmit any data through these links. Only when you click on a link does your browser connect to the other provider. That provider’s privacy policy then applies.

Job applications

A separate notice applies to job applications: Privacy notice for job applicants.

Recipients

In the practice, your data is only seen by the people who need it for your treatment or for organisational purposes. All of them are bound to confidentiality.

Outside the practice, data is received by:

• Cloudflare, Inc. (USA) for transmitting and protecting the website, see above;
• STRATO GmbH (Berlin), if you send us an email;
• the IT service provider for our digital telephone assistant ARON, if you call us (see ‘Telephone assistant ARON’);
• currently Google (Google Drive storage service) for our encrypted backups, see ‘Transfers to countries outside the EU’;
• as part of your treatment – as with every visit to the practice – pharmacies (e-prescription), other doctors involved in your treatment, your health insurer and the Kassenärztliche Vereinigung (Association of Statutory Health Insurance Physicians), as far as this is necessary for treatment and billing or required by law.

If external IT service providers maintain our systems, this is only done on the basis of a data processing agreement and with an obligation of confidentiality (§ 203 StGB). We do not sell any data and do not pass it on for advertising.

Transfers to countries outside the EU

Cloudflare is based in the USA and operates data centres worldwide. Your connection data may therefore also be processed in the USA. For the USA, there is an adequacy decision of the European Commission (EU-US Data Privacy Framework); Cloudflare is certified under it. If this decision no longer applies, the European Commission’s standard contractual clauses apply, which are part of our contract with Cloudflare (Art. 46(2)(c) GDPR).

Our backups are currently also stored with Google in the Google Drive storage service. They are encrypted at the practice beforehand. Only the practice has the key. Google therefore cannot read the content. Google may also store the encrypted files in data centres outside the EU, for example in the USA. For the USA, there is an adequacy decision of the European Commission (EU-US Data Privacy Framework); the US company Google LLC is certified under it. Soon we will only make backups on our own storage device in the practice. Google will then no longer receive any backups.

For the telephone assistant ARON: if the IT service provider processes your data outside the EU, it may only do so under the special conditions that the GDPR sets for such transfers (Art. 44 to 49 GDPR).

How long we store data

• Check value of your IP address (protection against misuse): we use it for 24 hours and delete it after 48 hours at the latest.
• Security cookie: up to one year in your browser; you can delete it at any time.
• Encrypted online request on the website server: only until the internal practice system collects it. If this does not work because of a fault, we delete it there no later than 90 days after receipt. Submissions that cannot be transferred, for example because they arrive damaged, are deleted after 7 days. If, because of a technical error, our system cannot yet open a submission with our key, we keep it in encrypted form for up to 90 days. This way, it can still reach us after the error has been fixed.
• Online request in the internal practice system: 30 days after it has been dealt with. Requests that have not been completed are deleted no later than 90 days after receipt.
• Anything that is important for your treatment (for example a prescription that has been issued) is transferred to your patient record. We keep the record for 10 years after the end of the treatment, and longer only if other regulations require this (§ 630f(3) BGB, § 10(3) of the professional code of conduct for doctors).
• Calls to the telephone assistant ARON: see ‘Telephone assistant ARON’.
• Backups: encrypted. At the practice, we delete them after 30 days. At Google, we delete them after 90 days. After that, they remain in the recycle bin there for up to 30 more days. Then Google deletes them permanently.

Your rights

You have the right to:

• obtain information about your data (Art. 15 GDPR) – you can also inspect your patient record under § 630g BGB,
• have incorrect data corrected (Art. 16 GDPR),
• have data erased (Art. 17 GDPR), unless we are obliged to keep it,
• have the processing restricted (Art. 18 GDPR),
• receive your data in a portable format (data portability, Art. 20 GDPR),
• object to processing that is based on our legitimate interest (Art. 21 GDPR),
• withdraw your consent with effect for the future (Art. 7(3) GDPR).

The easiest way is to speak to us at the practice or on the phone. You can also contact us or our data protection officer in writing.

Complaint to the supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)
Hintere Bleiche 34, 55116 Mainz
Phone: 06131 8920-0
www.datenschutz.rlp.de

No automated decisions

Decisions about your treatment are always made by our doctors. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Last updated: November 2026