Privacy policy

1 Controller

The controller within the meaning of Art. 4(7) GDPR is

Klinik am Seestern GmbH
Am Seestern 4
40547 Düsseldorf
Phone: 0211 699 09 20
Email: info@klinik-am-seestern.de

Represented by the managing directors Peter Henscheid and Alexander Gläser. Further details can be found in the imprint.

2 Data protection officer

You can reach our data protection officer at datenschutz@klinik-am-seestern.de or by post to the address given above, marked “For the attention of the data protection officer”.

3 Provision of the website and server logs

When you access our website, the web server processes technically necessary data transmitted by your browser: IP address, date and time of the request, address requested, amount of data transferred, status code, the page previously visited (referrer) as well as browser and operating system. We use this data to deliver the website, to ensure its security and stability and to defend against attacks.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. The server logs are deleted after 14 days, unless they are needed for longer to investigate a security incident.

The website is operated on servers on our behalf. A data processing agreement under Art. 28 GDPR is in place with the operator.

Fonts, search function and scripts of this website are loaded from our own server. When you merely visit the website, no data is transmitted to Google or other third-party providers without your consent.

4 Cookies and consent management

On your first visit, we ask you in a dialogue whether you allow optional services for statistics and marketing. We store your choice in the technically necessary cookie “cc_cookie” for six months so that we do not have to ask you again every time you open a page. The legal basis is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(c) and (f) GDPR.

You can change or withdraw your choice at any time via the “Privacy settings” link at the bottom of every page. Withdrawal takes effect for the future.

5 Google Tag Manager, statistics and marketing (only with consent)

Only if you allow “Statistics” or “Marketing” in the consent dialogue do we load the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The services you have consented to are then integrated via the Tag Manager, for example Google Analytics for audience measurement (Statistics category) or Google Ads conversion tracking and remarketing (Marketing category). In the process, cookies may be set and usage data, device information and truncated IP addresses may be transmitted to Google, including to the USA.

Enhanced conversions: If you have consented to “Marketing” and send an appointment booking, a call-back request or an enquiry, we transmit your email address and phone number to Google, irreversibly encrypted (hashed) in your browser beforehand using the SHA-256 method. This allows the enquiry to be attributed to the right ad even if the cookie is missing. Google does not receive your name, address, date of birth or messages.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Google is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses apply. Without your consent, the Tag Manager is not loaded. Further information: policies.google.com/privacy.

6 Contact form, call-back request and email

If you contact us via a form or by email, we process the details you provide (for example salutation, name, phone number, email address, desired treatment and your message) in order to answer your enquiry. The form transmits the details in encrypted form to our server, which forwards them as an email to the clinic’s patient management; they are not stored on the web server.

Details of a desired treatment may be health data. We process these on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give upon submission; otherwise, Art. 6(1)(b) GDPR (pre-contractual measures) applies. You can withdraw your consent at any time with effect for the future. We delete your enquiry as soon as it has been dealt with conclusively and no statutory retention obligations prevent this; if it leads to a treatment relationship, the retention periods for patient records apply (see section 11).

To protect against automated requests, we use ALTCHA, a check that solves a small calculation task in your browser. ALTCHA runs on our own server, sets no cookies and does not transmit any data to third parties. In order to limit the number of requests per sender, we do not store your IP address in plain text, but only as a check value (hash) that is encrypted afresh every day, for no more than 15 minutes and, for appointment booking, for no more than one hour. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against misuse.

7 Online appointment booking

For booking a consultation appointment under Book consultation, we use the practice management software Praxismanager. You choose the treatment, appointment and location and provide your name, your phone number and your email address. For confirmation, you receive a code by SMS or email that is valid for ten minutes; on our server, it is stored only as a check value. The details are transmitted in encrypted form to Praxismanager and stored there as an appointment request; you receive the appointment confirmation by email.

For sending SMS messages, we use Esendex GmbH, Germany, as a processor; only your mobile number and the text containing the code are transmitted. The legal basis for the appointment booking is Art. 6(1)(b) GDPR, and for details of the desired treatment Art. 9(2)(a) GDPR. We store the appointment data for as long as it is required for organising the consultation and a subsequent treatment and statutory retention obligations exist.

8 Processing of data

(1) In addition to the purely informational use of our website, we offer various services which you can use if you are interested. To do so, you will generally have to provide further personal data, which we use to provide the respective service and to which the aforementioned principles of data processing apply.

(2) In some cases, we make use of external service providers to provide all of our services and – in connection with this – to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored. They include in particular, but not exclusively:

Westfalenklinik Fachklinik für Plastische und Ästhetische Chirurgie GmbH, Rosemeyerstr. 2-4, 44139 Dortmund
Weight Doctors Worldwide GmbH, Rosemeyerstr. 2-4, 44139 Dortmund
Hair Doctors GmbH, Rosemeyerstr. 2-4, 44139 Dortmund
AKH Alster-Klinik Hamburg GmbH, Rothenbaumchaussee 7, 20148 Hamburg
Weight Doctors GmbH, Rosemeyerstr. 2-4, 44139 Dortmund
Lincura GmbH, Hauptmarkt 11, 90403 Nürnberg
Main-Tauber-Klinik GmbH, Rotkreuz Str. 2, 97877 Wertheim
Bürgerspital Wertheim gGmbH, Rosemeyerstr. 2-4, 44139 Dortmund
Medisch Centrum Waalre B.V., Van Dijklaan 9, 5581 WG Waalre, Netherlands

(3) We also use your personal data for marketing our services, for example for information and offers by post, for our newsletter by email and for other promotions. You can unsubscribe from this at any time: via the unsubscribe link in every newsletter or with an informal message to info@klinik-am-seestern.de. After that, we no longer use your data for this form of advertising.

(4) Furthermore, we may pass on your personal data to third parties if participation in promotions, advertising measures, prize draws, conclusions of contracts or similar services are offered by us together with partners. You will receive more detailed information on this when you provide your personal data or below in the description of the offer. You can also unsubscribe from this at any time with an informal message to info@klinik-am-seestern.de. After that, we no longer use your data for this form of advertising.

(5) Otherwise, we collect, process and use personal data only insofar as it is necessary for establishing, determining the content of or amending the legal relationship.

9 Maps, videos and external links

Google Maps: On the Contact and Directions pages, we initially show only a photo. Only when you click “Load map” is the map from Google Maps (Google Ireland Limited) loaded. In the process, your IP address and usage data are transmitted to Google, including to the USA. The legal basis is your consent, given by clicking, under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Videos: Videos on this website are stored on our own server. Should we embed videos from YouTube, these will likewise only be loaded after you click; the privacy notices of Google Ireland Limited then apply.

Reviews: The reviews displayed come from ProvenExpert (Expert Systems AG, Berlin) and are retrieved when the website is built. When you visit our pages, there is no connection to ProvenExpert. Only when you follow a link to our profile do the privacy notices of ProvenExpert apply.

Financing: If you open a financing application of our financing partner via our website, you leave our website; the financing partner is then responsible for the processing of your details.

10 Job applications

We process applications that you send us by email or post in order to carry out the application procedure under Section 26 BDSG (German Federal Data Protection Act) and Art. 6(1)(b) GDPR. If no employment relationship is established, we delete the documents six months after the end of the procedure, unless you have consented to longer retention.

11 Patient data

In the context of a consultation and treatment, we process master data, contact data, health data, billing and insurance data. The legal bases are Art. 6(1)(b) and (c) and Art. 9(2)(h) GDPR in conjunction with the treatment contract (Sections 630a et seq. BGB [German Civil Code]). Recipients may – where necessary or required by law – be doctors providing joint or follow-up treatment, laboratories, payers, billing offices with your consent, and authorities. In accordance with Section 630f BGB, we retain patient records for at least ten years after the end of treatment, unless other regulations provide for longer periods. No transfer to third countries is intended.

12 Your rights

Under the GDPR, you have the right to

• information about the data processed by us (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on Art. 6(1)(f) GDPR on grounds arising from your particular situation (Art. 21),
• withdraw consent you have given with effect for the future (Art. 7(3)).

To do so, use the contact details given in section 1 or 2. You also have the right to lodge a complaint with a data protection supervisory authority, for example with the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, which is responsible for us, Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

There is no automated decision-making, including profiling, under Art. 22 GDPR.

13 Data security

The connection to our website is encrypted using TLS. We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access, and adapt them to the state of the art.

14 Minors

Our services are aimed at adults. Persons under the age of 18 should not send us any personal data without the consent of their parents or legal guardians.

15 Last updated

Last update of this privacy policy: September 2026. We adapt it when the services we use or the legal situation change.