Pri­va­cy Pol­i­cy

Sta­tus: Octo­ber 2026

The pro­tec­tion of your per­son­al data is impor­tant to us. Below, we inform you about how we process per­son­al data.

This Pri­va­cy Pol­i­cy cov­ers both the use of our web­site and the pro­cess­ing of per­son­al data with­in the scope of med­ical treat­ment in our prac­tice, as well as in con­nec­tion with appli­ca­tions.

1. Con­troller

The con­troller with­in the mean­ing of the Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) is:

Dr. med. Corin­na Mann
Own­er of the Med­ical Prac­tice
Prac­tice Name: Pri­vate Cen­ter ‘Die Kinder­wun­schärzt­in’
Her­zogspi­tal­straße 5
80331 München

Phone: (089) 123 595 65
E‑mail: hallo@kinderwunschaerztin.de

For gen­er­al data pro­tec­tion inquiries, you can also con­tact datenschutz@kinderwunschaerztin.de.

2. Data Pro­tec­tion Offi­cer

We have appoint­ed an exter­nal data pro­tec­tion offi­cer:

krauss­fir­men­gruppe GmbH & Co. KG
Halden­loh E 10
86465 Welden
Phone: +49 8293 950 80–0
E‑mail: info@kraussakademie.de

I. Data Pro­tec­tion when using our Web­site

3. Gen­er­al Data Pro­cess­ing when vis­it­ing our Web­site

When you vis­it our web­site, tech­ni­cal­ly nec­es­sary infor­ma­tion is processed. This may include, in par­tic­u­lar, your IP address, time and dura­tion of the page view, pages or files accessed, brows­er type and brows­er ver­sion, oper­at­ing sys­tem, refer­rer URL, and oth­er tech­ni­cal infor­ma­tion.

Pro­cess­ing is car­ried out, inso­far as it is nec­es­sary for the oper­a­tion and secure pro­vi­sion of our web­site, on the basis of Art. 6 para. 1 lit. f GDPR. Our legit­i­mate inter­est lies in the secure, sta­ble, and tech­ni­cal­ly error-free oper­a­tion of our online offer­ing.

4. Host­ing

Our web­site is host­ed by an exter­nal host­ing ser­vice provider: Host­Press GmbH, Bahn­hof­s­traße 34, 66571 Eppel­born. The servers are locat­ed in a data cen­ter in Ger­many. In par­tic­u­lar, serv­er log data and oth­er tech­ni­cal­ly nec­es­sary data may be processed.

Where nec­es­sary, an agree­ment on com­mis­sioned pro­cess­ing exists with the host­ing provider in accor­dance with Art. 28 GDPR.

5. SSL or TLS Encryp­tion

Our web­site uses SSL or TLS encryp­tion. This means that data trans­mit­ted between your brows­er and our web­site is encrypt­ed.

6. Cook­ies and Con­sent Man­age­ment

Our web­site uses cook­ies and sim­i­lar tech­nolo­gies.

Tech­ni­cal­ly nec­es­sary cook­ies and tech­nolo­gies are used inso­far as this is required for the secure and func­tion­al pro­vi­sion of our web­site, e.g., for stor­ing your cook­ie set­tings and your lan­guage set­ting. The legal basis for this is Art. 6 para. 1 lit. f GDPR in con­junc­tion with Sec­tion 25 para. 2 no. 2 TDDDG.

Non-essen­tial tech­nolo­gies, par­tic­u­lar­ly for sta­tis­tics, analy­sis, or mar­ket­ing, are only used after your pri­or con­sent. The legal basis for this is Art. 6 para. 1 lit. a GDPR in con­junc­tion with Sec­tion 25 para. 1 TDDDG.

To man­age and doc­u­ment your con­sents, we use the Bor­labs Cook­ie con­sent man­age­ment sys­tem from Bor­labs GmbH, Rübenkamp 32, 22305 Ham­burg. Your con­sent deci­sion is stored in a cook­ie in your brows­er and not passed on to Bor­labs. You can change or revoke a giv­en con­sent at any time with effect for the future via the set­tings offered there. The legal basis for the use of the con­sent man­age­ment sys­tem is Art. 6 para. 1 lit. c GDPR.

7. Con­tact via Email or Phone

If you con­tact us by email or phone, we process the infor­ma­tion you pro­vide to han­dle your request.

If your inquiry relates to the ini­ti­a­tion or exe­cu­tion of a treat­ment rela­tion­ship, pro­cess­ing is gen­er­al­ly based on Art. 6 para. 1 lit. b GDPR. Inso­far as health data is con­cerned, pro­cess­ing is car­ried out in par­tic­u­lar on the basis of Art. 9 para. 2 lit. h GDPR in con­junc­tion with Sec­tion 22 para. 1 no. 1 lit. b BDSG.

In oth­er cas­es, pro­cess­ing may be based in par­tic­u­lar on our legit­i­mate inter­est in the prop­er han­dling of your inquiry in accor­dance with Art. 6 para. 1 lit. f GDPR.

8. Exter­nal Appoint­ment Book­ing via arzt-direkt

On our web­site, we pro­vide links for online appoint­ment book­ing and online forms via arzt-direkt, a ser­vice of zoll­soft GmbH, Ernst-Haeck­el-Platz 5/6, 07745 Jena.

arzt-direkt is not direct­ly embed­ded in our web­site. Only when you click the cor­re­spond­ing link do you leave our web­site and access the arzt-direkt ser­vice.

For data pro­cess­ing tak­ing place there, the data pro­tec­tion infor­ma­tion of the respec­tive provider addi­tion­al­ly applies.

Regard­less, we also use arzt-direkt for our patient com­mu­ni­ca­tion and oth­er treat­ment process­es. We will inform you about this in more detail in the sec­tion “Data Pro­tec­tion Infor­ma­tion for Patients.”

9. Exter­nal Pay­ment Page by Stripe

For cer­tain ser­vices, par­tic­u­lar­ly the at-home fer­til­i­ty test, we link to an exter­nal pay­ment page of the pay­ment ser­vice provider Stripe (Stripe Pay­ments Europe, Ltd., 1 Grand Canal Street Low­er, Grand Canal Dock, Dublin, Ire­land).

Stripe is not embed­ded as a pay­ment mod­ule on our web­site. Only when you click the cor­re­spond­ing link do you leave our web­site and pro­ceed to Stripe’s check­out.

The pro­cess­ing of per­son­al data and pay­ment infor­ma­tion there is car­ried out in accor­dance with the pay­ment ser­vice provider’s data pro­tec­tion infor­ma­tion.

10. Analy­sis and Online Mar­ket­ing

We use the ser­vices list­ed below for sta­tis­ti­cal analy­sis and for mea­sur­ing and opti­miz­ing our online adver­tis­ing. These ser­vices are only acti­vat­ed after your pri­or con­sent.

Google Tag Man­ag­er

The provider is Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land.

The Google Tag Man­ag­er serves for the tech­ni­cal admin­is­tra­tion and deliv­ery of oth­er web­site ser­vices. It is only loaded on our web­site after your con­sent.

Use is exclu­sive­ly based on pri­or con­sent in accor­dance with Art. 6 para. 1 lit. a GDPR and Sec­tion 25 para. 1 TDDDG.

Google Ana­lyt­ics

The provider is Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land.

Google Ana­lyt­ics is used for the sta­tis­ti­cal analy­sis of our web­site’s usage.

This may involve pro­cess­ing infor­ma­tion about page views, dura­tion of use, devices and browsers used, approx­i­mate geo­graph­i­cal ori­gin, and inter­ac­tions with our web­site.

Use is exclu­sive­ly based on pri­or con­sent in accor­dance with Art. 6 para. 1 lit. a GDPR and Sec­tion 25 para. 1 TDDDG.

Google Ads and Con­ver­sion Track­ing

The provider is Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land.

We use Google Ads and cor­re­spond­ing con­ver­sion tech­nolo­gies to mea­sure the effec­tive­ness of our online adver­tis­ing and opti­mize adver­tis­ing mea­sures.

Use is exclu­sive­ly based on pri­or con­sent in accor­dance with Art. 6 para. 1 lit. a GDPR and Sec­tion 25 para. 1 TDDDG.

Meta Pix­el

The provider is Meta Plat­forms Ire­land Lim­it­ed, 4 Grand Canal Square, Dublin 2, Ire­land.

We use the Meta Pix­el to mea­sure the effec­tive­ness of adver­tis­ing mea­sures on Meta plat­forms.

This allows us to track, in par­tic­u­lar, whether users have per­formed cer­tain actions on our web­site after inter­act­ing with an adver­tise­ment.

Inso­far as per­son­al data is col­lect­ed on our web­site and for­ward­ed to Meta, we and Meta Plat­forms Ire­land Lim­it­ed are joint­ly respon­si­ble for the col­lec­tion and trans­mis­sion (Art. 26 GDPR). Fur­ther infor­ma­tion can be found at https://www.facebook.com/legal/controller_addendum.

Use is exclu­sive­ly based on pri­or con­sent in accor­dance with Art. 6 para. 1 lit. a GDPR and Sec­tion 25 para. 1 TDDDG.

11. Review Dis­play via Trustin­dex

On our web­site, we inte­grate reviews via the Trustin­dex ser­vice. The provider is Trustin­dex Ltd., Nyári Pál utca 15, 2724 Újlengyel, Hun­gary.

When access­ing cor­re­spond­ing con­tent, a con­nec­tion is estab­lished with Trustin­dex servers. In par­tic­u­lar, the IP address and tech­ni­cal infor­ma­tion about the device used may be processed.

The inte­gra­tion is based on Art. 6 para. 1 lit. f GDPR. Our legit­i­mate inter­est lies in an appeal­ing pre­sen­ta­tion of tes­ti­mo­ni­als from our patients.

12. Google Maps

On indi­vid­ual pages of our web­site, we inte­grate maps from Google Maps. The provider is Google Ire­land Lim­it­ed, Gor­don House, Bar­row Street, Dublin 4, Ire­land. The maps are only loaded after your cor­re­spond­ing con­sent.

When load­ing Google Maps, your IP address and oth­er tech­ni­cal infor­ma­tion may be trans­mit­ted to Google.

The legal basis for acti­va­tion in this case is Art. 6 para. 1 lit. a GDPR in con­junc­tion with Sec­tion 25 para. 1 TDDDG.

13. Fonts and Icons

The fonts (Google Fonts) and icons (Font Awe­some) used on our web­site are pro­vid­ed local­ly on our own web serv­er. No con­nec­tion to the servers of the respec­tive exter­nal providers is estab­lished sole­ly for retriev­ing these resources.

14. Trans­fer to Third Coun­tries in con­nec­tion with Web­site Ser­vices

For some of the ser­vice providers we use, par­tic­u­lar­ly Google and Meta, per­son­al data may be processed out­side the Euro­pean Union or the Euro­pean Eco­nom­ic Area, espe­cial­ly in the USA.

Inso­far as data is trans­ferred to a coun­try for which an ade­qua­cy deci­sion by the Euro­pean Com­mis­sion exists, the trans­fer can be based on this. For the USA, this applies to com­pa­nies cer­ti­fied under the EU-US Data Pri­va­cy Frame­work; this is the case for Google and Meta.

Oth­er­wise, where nec­es­sary, appro­pri­ate safe­guards are used, in par­tic­u­lar the stan­dard con­trac­tu­al claus­es of the Euro­pean Com­mis­sion.

II. Data Pro­tec­tion Infor­ma­tion for Patients

15. What Data We Process in con­nec­tion with Treat­ment

In con­nec­tion with your con­tact, con­sul­ta­tion, diag­nos­tics, and treat­ment, we process the per­son­al data required for this pur­pose.

This includes, in par­tic­u­lar:

• Name, date of birth, address, and oth­er mas­ter data
• Phone num­ber and email address
• Insur­ance and billing infor­ma­tion
• Med­ical his­to­ry
• Diag­noses and find­ings
• Lab­o­ra­to­ry val­ues
• Med­ica­tion data
• Infor­ma­tion on pre-exist­ing con­di­tions and pre­vi­ous treat­ments
• Infor­ma­tion on repro­duc­tive health and, where rel­e­vant to treat­ment, sex­u­al and fam­i­ly his­to­ry
• Genet­ic data, inso­far as cor­re­spond­ing exam­i­na­tions are car­ried out
• Treat­ment and progress data
• Appoint­ment and com­mu­ni­ca­tion data.

Depend­ing on the treat­ment, we also process med­ical image and lab­o­ra­to­ry data, in par­tic­u­lar ultra­sound images and, where applic­a­ble in the respec­tive treat­ment pro­ce­dure, micro­scop­ic, embryo- and lab­o­ra­to­ry-relat­ed image data and doc­u­men­ta­tion.

16. Pur­pos­es and Legal Bases of Pro­cess­ing

We process your per­son­al data in par­tic­u­lar:

• for the ini­ti­a­tion and exe­cu­tion of the treat­ment rela­tion­ship
• for med­ical diag­nos­tics and ther­a­py
• for the per­for­mance of repro­duc­tive med­ical and lab­o­ra­to­ry med­ical mea­sures
• for doc­u­ment­ing your treat­ment
• for appoint­ment and treat­ment orga­ni­za­tion
• for com­mu­ni­ca­tion with you
• for billing
• for qual­i­ty assur­ance
• for ful­fill­ing legal doc­u­men­ta­tion, report­ing, and reten­tion oblig­a­tions
• for assert­ing, exer­cis­ing, or defend­ing legal claims.

The pro­cess­ing of per­son­al data required for the exe­cu­tion of the treat­ment con­tract is car­ried out in par­tic­u­lar on the basis of Art. 6 para. 1 lit. b GDPR.

We process health data and oth­er spe­cial cat­e­gories of per­son­al data in par­tic­u­lar on the basis of Art. 9 para. 2 lit. h GDPR in con­junc­tion with Sec­tion 22 para. 1 no. 1 lit. b BDSG.

Inso­far as we are legal­ly oblig­ed to process data, pro­cess­ing is car­ried out on the basis of Art. 6 para. 1 lit. c GDPR in con­junc­tion with the respec­tive applic­a­ble legal pro­vi­sions.

Inso­far as pro­cess­ing is not already per­mis­si­ble on the basis of the treat­ment rela­tion­ship or a legal basis, we will obtain con­sent in accor­dance with Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, if nec­es­sary.

A giv­en con­sent can be revoked at any time with effect for the future.

17. Ori­gin of Data

Most per­son­al data is received direct­ly from you.

Inso­far as this is nec­es­sary for your treat­ment and legal­ly per­mis­si­ble, we may also receive data from refer­ring or co-treat­ing physi­cians, med­ical facil­i­ties, lab­o­ra­to­ries, or oth­er ser­vice providers.

18. Elec­tron­ic Patient File and Prac­tice and Lab­o­ra­to­ry Sys­tems

We doc­u­ment treat­ment in an elec­tron­ic patient file and pri­mar­i­ly use the tome­do® prac­tice man­age­ment sys­tem from zoll­soft GmbH for this pur­pose.

In addi­tion, we use spe­cial­ized elec­tron­ic prac­tice, lab­o­ra­to­ry, doc­u­men­ta­tion, iden­ti­fi­ca­tion, and qual­i­ty assur­ance sys­tems.

These include, among oth­ers, local­ly oper­at­ed sys­tems for the IVF lab­o­ra­to­ry and elec­tron­ic iden­ti­ty and process con­trol.

A com­plete list of all inter­nal­ly used soft­ware prod­ucts is not pro­vid­ed in this Pri­va­cy Pol­i­cy.

Inso­far as man­u­fac­tur­ers, IT ser­vice providers, or sup­port com­pa­nies can access sys­tems con­tain­ing per­son­al data for main­te­nance, remote main­te­nance, or sup­port, this is done exclu­sive­ly to the extent required for this pur­pose and in com­pli­ance with applic­a­ble data pro­tec­tion require­ments.

19. Com­mu­ni­ca­tion with Patients

Email and Google Work­space

We use Google Work­space for our busi­ness email com­mu­ni­ca­tion and some oth­er orga­ni­za­tion­al appli­ca­tions.

This may involve pro­cess­ing con­tact, appoint­ment, and com­mu­ni­ca­tion data, as well as health and treat­ment data depend­ing on the con­tent of the com­mu­ni­ca­tion.

Inso­far as we send con­fi­den­tial doc­u­ments by email, these can be addi­tion­al­ly pro­tect­ed, for exam­ple, by pass­word-pro­tect­ed attach­ments.

Unit­ed Domains

For indi­vid­ual email inbox­es and tech­ni­cal com­mu­ni­ca­tion chan­nels, through which fax and tele­phone mail­box mes­sages can be received, among oth­er things, we use ser­vices from Unit­ed Domains.

Since such mes­sages may orig­i­nate from patients, per­son­al data and, depend­ing on the con­tent of the mes­sage, health data may be processed.

Tele­pho­ny via STARFACE

We use a cloud tele­phone sys­tem from STARFACE for our tele­phone com­mu­ni­ca­tion.

This involves pro­cess­ing tele­phone num­bers, con­nec­tion, and com­mu­ni­ca­tion data in par­tic­u­lar.

When using our mail­box, voice record­ings left by callers may also be stored and processed.

Nor­mal phone calls with our prac­tice are not record­ed.

Com­mu­ni­ca­tion via arzt-direkt

We use ser­vices from arzt-direkt / zoll­soft GmbH for online appoint­ment book­ing, patient forms, anam­ne­ses, video con­sul­ta­tions, and elec­tron­ic com­mu­ni­ca­tion func­tions, among oth­er things.

Depend­ing on the respec­tive func­tion, mas­ter and con­tact data, appoint­ment data, com­mu­ni­ca­tion data, as well as health and treat­ment data may be processed.

Pro­cess­ing is car­ried out, inso­far as it serves the treat­ment, in par­tic­u­lar on the basis of Art. 6 para. 1 lit. b GDPR and Art. 9 para. 2 lit. h GDPR.

SMS via Click­Send

We use the Click­Send SMS ser­vice for trans­mit­ting cer­tain orga­ni­za­tion­al infor­ma­tion.

We use it in par­tic­u­lar to send decryp­tion codes for sep­a­rate­ly trans­mit­ted pro­tect­ed doc­u­ments and occa­sion­al­ly neu­tral appoint­ment reminders.

This involves pro­cess­ing the mobile phone num­ber and the respec­tive mes­sage text in par­tic­u­lar.

Diag­noses, find­ings, or oth­er med­ical con­tent are not sent by us via SMS.

Auto­mat­ed Trans­mis­sion via Zapi­er

For indi­vid­ual tech­ni­cal process­es, we use Zapi­er as an inter­face ser­vice.

In par­tic­u­lar, data from des­ig­nat­ed Google forms can be auto­mat­i­cal­ly for­ward­ed to Click­Send.

Only the infor­ma­tion required for the respec­tive process is processed, in par­tic­u­lar the mobile phone num­ber and decryp­tion code or mes­sage text.

The cor­re­spond­ing data records are delet­ed prompt­ly after suc­cess­ful trans­mis­sion.

20. AI-sup­port­ed Assis­tance Sys­tems

We use AI-sup­port­ed assis­tance sys­tems in select­ed admin­is­tra­tive, orga­ni­za­tion­al, and tech­ni­cal work process­es.

These serve in par­tic­u­lar to sup­port research, struc­tur­ing, and lin­guis­tic pro­cess­ing of infor­ma­tion, as well as the devel­op­ment and main­te­nance of inter­nal tech­ni­cal appli­ca­tions.

Inso­far as exter­nal gen­er­al AI ser­vices are used for case dis­cus­sions or com­pa­ra­ble tasks, infor­ma­tion is gen­er­al­ly anonymized or reduced to such an extent that direct iden­ti­fi­ca­tion of the data sub­ject is avoid­ed.

In indi­vid­ual approved work process­es, we use busi­ness ser­vices from Ope­nAI, includ­ing in con­nec­tion with approved cor­po­rate appli­ca­tions such as our busi­ness email com­mu­ni­ca­tion.

Depend­ing on the spe­cif­ic work order, per­son­al data and, if applic­a­ble, health data may be processed as a result.

We use busi­ness accounts for this and only employ the ser­vices with­in the scope of use approved for the prac­tice.

Oth­er exter­nal AI ser­vices are only used with iden­ti­fi­able patient data if this has been reviewed under data pro­tec­tion law and approved for the respec­tive pro­cess­ing pur­pose.

AI sys­tems do not make inde­pen­dent med­ical treat­ment deci­sions in our prac­tice. Diag­nos­tic and ther­a­peu­tic deci­sions are made by our treat­ing physi­cians.

21. AI-sup­port­ed Doc­u­men­ta­tion of Con­sul­ta­tions

To sup­port med­ical doc­u­men­ta­tion, we may use the tome­do® Con­sul­ta­tion Assis­tant from zoll­soft GmbH.

In this process, a doc­tor-patient con­ver­sa­tion is record­ed and auto­mat­i­cal­ly tran­scribed exclu­sive­ly after pri­or explic­it con­sent from all record­ed per­sons.

The tran­script can then be struc­tured with the help of an AI-sup­port­ed lan­guage mod­el and sum­ma­rized into a doc­u­men­ta­tion pro­pos­al.

The gen­er­at­ed con­tent is reviewed by med­ical pro­fes­sion­als before being trans­ferred to the patient file.

The sys­tem serves exclu­sive­ly to sup­port doc­u­men­ta­tion. It does not make inde­pen­dent diag­nos­tic or ther­a­peu­tic deci­sions.

The use of the Con­sul­ta­tion Assis­tant is vol­un­tary. Refusal has no impact on your treat­ment.

The audio record­ing is only stored for as long as nec­es­sary for tran­scrip­tion, review, and cre­ation of the med­ical doc­u­men­ta­tion, and is then delet­ed as quick­ly as pos­si­ble.

The med­ical doc­u­men­ta­tion trans­ferred to the patient file, how­ev­er, is sub­ject to statu­to­ry reten­tion peri­ods.

22. Exter­nal Med­ical Diag­nos­tics and Lab­o­ra­to­ries

Inso­far as it is nec­es­sary for diag­nos­tics and treat­ment, we trans­mit the required per­son­al data, health data, and, if applic­a­ble, exam­i­na­tion mate­r­i­al to exter­nal med­ical lab­o­ra­to­ries and spe­cial­ized diag­nos­tic facil­i­ties.

This con­cerns in par­tic­u­lar:

• Spe­cial hor­mone analy­ses
• Infec­tion diag­nos­tics
• Genet­ic exam­i­na­tions
• Oth­er spe­cial exam­i­na­tions that we do not per­form our­selves.

For genet­ic exam­i­na­tions, we col­lab­o­rate with, among oth­ers, the Med­ical Genet­ic Cen­ter (MGZ) Munich.

For genet­ic exam­i­na­tions, we observe the spe­cial legal require­ments, in par­tic­u­lar the pro­vi­sions of the Genet­ic Diag­nos­tics Act, includ­ing the nec­es­sary infor­ma­tion and con­sent.

23. Ger­man IVF Reg­is­ter

We par­tic­i­pate in the Ger­man IVF Reg­is­ter (D·I·R).

A pseu­do­nymized trans­mis­sion of treat­ment data to the D·I·R takes place with us after a sep­a­rate­ly obtained con­sent for this pur­pose.

For this, we use a sep­a­rate con­sent form.

Patient mas­ter data is not trans­mit­ted to the D·I·R.

The trans­mit­ted data serves in par­tic­u­lar for qual­i­ty assur­ance and sci­en­tif­ic eval­u­a­tion of repro­duc­tive med­ical treat­ments.

24. Cry­op­reser­va­tion and FERTILA GmbH

If you decide on cry­op­reser­va­tion and sub­se­quent stor­age, the per­son­al data and health data required for this pur­pose may be trans­mit­ted to FERTILA GmbH.

FERTILA GmbH con­cludes its own con­tract with you for stor­age, bills its ser­vices itself, and process­es the data required for this under its own data pro­tec­tion respon­si­bil­i­ty.

You will receive sep­a­rate data pro­tec­tion infor­ma­tion regard­ing the pro­cess­ing of your data by FERTILA GmbH.

25. Sperm Banks and oth­er Med­ical Facil­i­ties

The selec­tion and com­mis­sion­ing of exter­nal sperm banks is gen­er­al­ly done by the patients them­selves.

Inso­far as you express­ly com­mis­sion us with com­mu­ni­ca­tion or pro­cess­ing with a sperm bank or anoth­er repro­duc­tive med­ical facil­i­ty, we trans­mit the per­son­al and, if applic­a­ble, med­ical data required for this to the nec­es­sary extent.

The same applies if, at your request, sam­ples, treat­ment doc­u­ments, or oth­er med­ical infor­ma­tion are to be trans­mit­ted to anoth­er med­ical facil­i­ty.

26. Billing

As a pri­vate prac­tice, we gen­er­al­ly bill our med­ical ser­vices direct­ly to our patients.

Trans­mis­sion of billing, treat­ment, or oth­er per­son­al data to pri­vate health insur­ance com­pa­nies or oth­er cost bear­ers is gen­er­al­ly only car­ried out by us at your request or with your cor­re­spond­ing approval, or if anoth­er legal basis exists for this.

We do not use an exter­nal pri­vate med­ical billing ser­vice provider.

27. Pay­ment Ser­vice Providers

Depend­ing on the cho­sen pay­ment method, pay­ment data may be processed by exter­nal pay­ment ser­vice providers.

These cur­rent­ly include, in par­tic­u­lar:

• Stripe
• Pay­Pal
• SumUp
• the pay­ment ser­vice provider used for pay­ments via arzt-direkt.Pay.

The pro­cess­ing of data required for pay­ment pro­cess­ing is car­ried out accord­ing to the respec­tive applic­a­ble data pro­tec­tion infor­ma­tion of the pay­ment ser­vice providers.

Pay­Pal and SumUp are used by us in par­tic­u­lar for on-site pay­ments.

28. Tax Con­sult­ing and Account­ing

To ful­fill our legal tax, com­mer­cial, and account­ing oblig­a­tions, we trans­mit nec­es­sary data to tax con­sult­ing and account­ing ser­vice providers com­mis­sioned by us.

This may also involve pro­cess­ing indi­vid­ual out­go­ing invoic­es with the patien­t’s name and ser­vice items.

The trans­mis­sion is lim­it­ed to the extent nec­es­sary for the respec­tive pur­pose.

29. Author­i­ties and Legal­ly Des­ig­nat­ed Recip­i­ents

Inso­far as we are oblig­ed to report, doc­u­ment, or trans­mit per­son­al data due to legal, super­vi­so­ry, or pro­fes­sion­al reg­u­la­tions, data may be trans­mit­ted to the com­pe­tent author­i­ties or oth­er legal­ly des­ig­nat­ed bod­ies to the extent required.

30. Reten­tion of Treat­ment Data

Patient files and treat­ment doc­u­ments are retained in accor­dance with legal reg­u­la­tions.

For med­ical patient files, the statu­to­ry basic reten­tion peri­od is gen­er­al­ly ten years after the com­ple­tion of treat­ment.

For indi­vid­ual data, sam­ples, doc­u­men­ta­tion, and records, dif­fer­ent and longer reten­tion peri­ods may apply, par­tic­u­lar­ly due to repro­duc­tive med­ical, phar­ma­ceu­ti­cal, tis­sue, lab­o­ra­to­ry, or oth­er spe­cial legal reg­u­la­tions.

Inso­far as fur­ther stor­age is nec­es­sary and legal­ly per­mis­si­ble for the asser­tion, exer­cise, or defense of legal claims, the cor­re­spond­ing data may be stored for this pur­pose for a longer peri­od.

31. Data Back­up

We pro­tect prac­tice and patient data through tech­ni­cal and orga­ni­za­tion­al mea­sures against loss, unau­tho­rized access, and oth­er risks.

Data back­ups are encrypt­ed and stored under our own respon­si­bil­i­ty.

32. Recip­i­ents of Patient Data

Per­son­al data is only passed on if this is nec­es­sary for the exe­cu­tion of the treat­ment rela­tion­ship, legal­ly required, cov­ered by con­sent, or per­mis­si­ble on anoth­er data pro­tec­tion legal basis.

Pos­si­ble recip­i­ents include, in par­tic­u­lar:

• Co-treat­ing or refer­ring physi­cians
• Med­ical and genet­ic lab­o­ra­to­ries
• Oth­er med­ical or repro­duc­tive med­ical facil­i­ties
• FERTILA GmbH
• Sperm banks at your request
• The Ger­man IVF Reg­is­ter after sep­a­rate con­sent
• Pay­ment ser­vice providers
• Tax con­sult­ing and account­ing ser­vice providers
• IT, soft­ware, main­te­nance, and sup­port ser­vice providers
• Com­mu­ni­ca­tion and cloud ser­vice providers
• Com­pe­tent author­i­ties and oth­er legal­ly des­ig­nat­ed bod­ies.

33. Pro­cess­ing out­side the Euro­pean Eco­nom­ic Area

Some of the IT, cloud, com­mu­ni­ca­tion, automa­tion, or AI ser­vice providers we use may process per­son­al data out­side Ger­many or the Euro­pean Eco­nom­ic Area.

Inso­far as data is trans­ferred to third coun­tries, we use the trans­fer mech­a­nisms pro­vid­ed for by the GDPR.

These may include, in par­tic­u­lar, ade­qua­cy deci­sions by the Euro­pean Com­mis­sion, cer­ti­fi­ca­tion of the respec­tive com­pa­ny under the EU-US Data Pri­va­cy Frame­work, or the stan­dard con­trac­tu­al claus­es of the Euro­pean Com­mis­sion.

III. Data Pro­tec­tion Infor­ma­tion for Appli­cants

34. Appli­ca­tions

If you apply to us, we process the appli­ca­tion data you sub­mit to decide on the estab­lish­ment of an employ­ment rela­tion­ship.

This may include, in par­tic­u­lar:

• Name and con­tact details
• Cur­ricu­lum vitae
• Cer­tifi­cates
• Qual­i­fi­ca­tions
• Infor­ma­tion on pro­fes­sion­al career
• Oth­er infor­ma­tion vol­un­tar­i­ly sub­mit­ted by you.

Appli­ca­tions are gen­er­al­ly accept­ed by email.

Appli­cants may reach us via job adver­tise­ments on exter­nal plat­forms, such as Indeed. The respec­tive plat­form provider is ini­tial­ly respon­si­ble for data pro­cess­ing there.

The legal basis for pro­cess­ing in the appli­ca­tion pro­ce­dure is, in par­tic­u­lar, Sec­tion 26 BDSG.

If an employ­ment rela­tion­ship is not estab­lished, we gen­er­al­ly delete the appli­ca­tion doc­u­ments no lat­er than six months after the con­clu­sion of the appli­ca­tion process, unless longer stor­age is required due to con­sent, a legal dis­pute, or anoth­er legal basis.

If an employ­ment rela­tion­ship is estab­lished, the data required for the employ­ment rela­tion­ship is trans­ferred to our per­son­nel admin­is­tra­tion.

IV. Your Rights

35. Infor­ma­tion, Rec­ti­fi­ca­tion, Era­sure, and Restric­tion

In accor­dance with legal require­ments, you have the right to infor­ma­tion about the per­son­al data stored about you and to rec­ti­fi­ca­tion of inac­cu­rate data.

You can also request the era­sure of your data or the restric­tion of pro­cess­ing, pro­vid­ed that the legal require­ments for this are met.

A right to era­sure does not exist, in par­tic­u­lar, inso­far as we are legal­ly oblig­ed to fur­ther store data, for exam­ple, due to med­ical doc­u­men­ta­tion and reten­tion oblig­a­tions.

36. Data Porta­bil­i­ty

Inso­far as the legal require­ments are met, you have the right to receive per­son­al data that you have pro­vid­ed to us in a struc­tured, com­mon­ly used, and machine-read­able for­mat or to request its trans­mis­sion to anoth­er con­troller.

37. With­draw­al of Con­sents

Inso­far as pro­cess­ing is based on your con­sent, you can revoke this con­sent at any time with effect for the future.

The law­ful­ness of pro­cess­ing car­ried out until the time of with­draw­al remains unaf­fect­ed by this.

38. Right to Object

Inso­far as we process per­son­al data based on a legit­i­mate inter­est in accor­dance with Art. 6 para. 1 lit. f GDPR, you can object to this pro­cess­ing for rea­sons aris­ing from your par­tic­u­lar sit­u­a­tion.

Inso­far as per­son­al data is processed for the pur­pose of direct mar­ket­ing, you have the right to object to this pro­cess­ing at any time.

39. Right to Lodge a Com­plaint with a Super­vi­so­ry Author­i­ty

You have the right to lodge a com­plaint with a data pro­tec­tion super­vi­so­ry author­i­ty if you believe that the pro­cess­ing of your per­son­al data vio­lates data pro­tec­tion reg­u­la­tions.

The super­vi­so­ry author­i­ty respon­si­ble for us is:

Bavar­i­an State Office for Data Pro­tec­tion Super­vi­sion (BayL­DA)
Prom­e­nade 18
91522 Ans­bach

Phone: +49 981 180093–0
E‑mail: poststelle@lda.bayern.de
www.lda.bayern.de

40. No Exclu­sive­ly Auto­mat­ed Med­ical Deci­sions

We do not use exclu­sive­ly auto­mat­ed deci­sion-mak­ing with­in the mean­ing of Art. 22 GDPR that pro­duces legal effects con­cern­ing you or sim­i­lar­ly sig­nif­i­cant­ly affects you.

In par­tic­u­lar, med­ical diag­noses and ther­a­py deci­sions are not made exclu­sive­ly auto­mat­i­cal­ly.

41. Updat­ing this Pri­va­cy Pol­i­cy

We will adapt this Pri­va­cy Pol­i­cy if our data pro­cess­ing pro­ce­dures, the ser­vices we use, or the legal frame­work con­di­tions change.