Instagram Facebook-f Youtube
Consultation appointment

Privacy Policy

Download practice information on data protection

Praxisinformation_Datenschutz_Patienteninformation.pdf

Last updated: October 2026

1. Overview and Controller

This Privacy Policy describes what personal data is processed when you visit this website, for what purposes, on what legal basis, and for how long. Personal data includes any information that can be used to personally identify you, such as your name, email address, or IP address. How we handle data from your treatment is described in the patient information above.

Controller

Überörtliche Berufsausübungsgemeinschaft Dres. med. Baican, Köhler, Luther, Potente GbR (“Plastische Chirurgie Frankfurt | Hochtaunus”), Oberhöchstadter Straße 8, 61440 Oberursel

Phone: 06171 59191, email: [email protected], [email protected]

Second location: Private Practice at Goetheplatz, Am Salzhaus 6, 60311 Frankfurt am Main

Data Protection Officer

Our Data Protection Officer is Dr. med. Livia Köhler. You can contact her by email at [email protected] or by mail to the address listed above, marked “Data Protection Officer.”

What Happens Without Consent and What Requires Consent

Without consent, the only services that run are those necessary for operating and securing the website or based on a legitimate interest: hosting with IONOS, including server log files and a firewall; Cloudflare as a network and security service; Cloudflare Web Analytics for audience measurement; the “Ally” accessibility assistant; and the cookie banner itself. This also applies to the information you provide when you call us or send us an email (for the contact form, see Section 5).

The following are loaded only after you give your consent in the cookie banner: Google Tag Manager with Google Analytics, the Meta Pixel, OpenAI’s measurement pixel for ads in ChatGPT, videos from YouTube and Vimeo, maps from Google Maps, and our Instagram feed. Prior to that, your browser does not establish a connection to these providers.

2. Your Rights

You have the following rights with respect to us:

Right to object (Art. 21 GDPR): If we process your data based on a legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time for reasons arising from your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Withdrawal of consent: You may withdraw your consent at any time with future effect (Art. 7(3) GDPR); for the services of this website, the easiest way to do so is via the cookie banner (Section 4). Any processing that took place prior to the withdrawal remains lawful.

For all of these requests, an informal message to the address above is sufficient.

Complaints: You may file a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden (office address: Wilhelmstraße 7, 65185 Wiesbaden), https://datenschutz.hessen.de.

There is no automated decision-making, including profiling, under Art. 22 GDPR.

3. Hosting, Security, and Server Log Files

Hosted by IONOS

The website is hosted on servers operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur. Privacy notice from IONOS: https://www.ionos.de/terms-gtc/datenschutzerklaerung/

Server Log Files

With every request, the server automatically stores:

We need this data to operate the website reliably and to detect errors and attacks, and we do not combine it with other data sources. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and trouble-free operation.

Security Firewall

On our server, a firewall (NinjaFirewall) checks requests for attack patterns. If it detects an attempted attack, it logs the IP address and the request. It runs on our own server; no data is sent to the developer. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the protection of the website and your data.

Cloudflare

Cloudflare acts as an intermediary between your browser and our server; the provider is Cloudflare Germany GmbH, Rosental 7, 80331 München, a group company of Cloudflare Inc., USA. Cloudflare delivers our pages more quickly (content delivery network) and defends against attacks. To this end, every request passes through Cloudflare’s servers, which process the log data mentioned above, in particular your IP address.

Cloudflare sets technically necessary cookies, such as __cf_bm (30 minutes), which distinguishes human visitors from automated requests. The legal basis is Art. 6(1)(f) GDPR and, for the cookies, Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG); our legitimate interest is fast and secure delivery. Privacy notice: https://www.cloudflare.com/privacypolicy/

Encrypted Transmission

The connection between your browser and our website is encrypted (TLS), as indicated by “https://” and the padlock icon in the address bar. No unauthorized party can read what you submit while it is in transit. We then forward inquiries submitted via the contact form by email to our practice mailbox.

4. Cookies and Consent Management

Cookies and Similar Technologies

Cookies are small text files that your browser stores on your device. Pixels and scripts that read information from your browser function in a similar way. Under Section 25 TDDDG, this is only permitted with your consent, unless it is strictly necessary for a service that you expressly wish to use. You can view, delete, or block cookies in your browser at any time; however, doing so may cause parts of the website to stop working.

Cookie Banner (Real Cookie Banner)

We manage your consent settings using the “Real Cookie Banner” plugin from devowl.io GmbH, Tübingen. It runs on our own server and stores your decision in cookies named real_cookie_banner (and variations thereof) for 365 days so that the banner does not appear every time the page is loaded. We also log your consent on our server so that we can provide evidence of it (Art. 7(1) GDPR). We retain these logs for 120 months (10 years). We do not store your IP address in plain text. The developer describes how the plugin processes data at https://devowl.io/de/rcb/datenverarbeitung/.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 25 TDDDG: We are required to obtain your consent and to be able to demonstrate it. You are not required to provide us with this data; however, without it, we cannot save your decision, and the banner will reappear every time you visit.

Here you can change your selections, view previous decisions, or withdraw all consents:

Change privacy settings | Privacy settings history | Withdraw consents

5. Contact and Appointment Booking

Contact form

On the “Contact” page, you can write to us using a form, with separate forms for Oberursel and Frankfurt. The form asks for your email address and message (required) and your name (optional). Your inquiry is sent by email to [email protected]. We use this information only to reply to you.

The legal basis is your consent, which you provide by checking the box on the form (Art. 6(1)(a) GDPR). If you tell us something about your health, this is health data; it is governed by Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) of the German Federal Data Protection Act (BDSG). Please do not send detailed medical information, medical reports, or photos via the form. We discuss such matters in person.

A hidden form field that only automated programs fill in protects against spam. This check is performed on our server without involving third-party providers. We delete your request once it has been dealt with and there is no obligation to retain it, or if you withdraw your consent. If it leads to treatment, the patient information applies.

Contact by Email or Phone

If you write to us or call us, we process your information to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR if it concerns treatment or preparation for treatment, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is responding to your inquiry. For health information, Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) BDSG applies.

Emails are generally transmitted unencrypted. Therefore, it is best not to send confidential medical records via email. We will delete the data once your matter has been resolved and there is no legal obligation to retain it. If this leads to treatment, the patient information applies.

Online Appointment Booking via Doctolib

The appointment buttons on our website are links to Doctolib (Doctolib GmbH, Mehringdamm 51, 10961 Berlin). Doctolib is not embedded: You will only leave our website once you click on the button. Doctolib’s privacy notice then applies to the booking: https://doctolib.legal/privacy-policy-B2C-DE

If you have consented to the use of OpenAI’s measurement pixel, we report a click on an appointment button as an event to OpenAI (Section 6). This does not happen without your consent.

6. Audience Measurement and Advertising

With the exception of Cloudflare Web Analytics, all services in this section run only if you have given your consent in the cookie banner. The legal basis in each case is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent via the cookie banner (Section 4).

Cloudflare Web Analytics

To see how often our pages are viewed and how quickly they load, we use Cloudflare Web Analytics (see Section 3 for the provider). To do this, each page loads a script from static.cloudflareinsights.com that sends measurement data about the page view to Cloudflare, such as the page accessed and loading times. Your IP address is transmitted in the process. The service does not set any cookies and does not store anything in your browser.

This measurement runs without consent, i.e., even before you make a selection in the cookie banner. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to measure and improve the website’s reach and loading times. You can object under Art. 21 GDPR.

Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to integrate measurement tools. On our website, Google Analytics is the only tool run through it. Google Tag Manager itself does not analyze usage, but Google receives your IP address when it loads.

Google Analytics

With Google Analytics 4 (Google Ireland Limited, address above), we can see which pages are visited, where visitors come from, how long they stay, and what devices they use. The cookies _ga and _ga_* recognize your browser and are deleted after 24 months. According to Google, Google Analytics 4 does not store IP addresses; however, your IP address is transmitted to Google when the page loads. The retention period for event data in Google Analytics 4 is a maximum of 14 months. Privacy notice from Google: https://policies.google.com/privacy

Meta Pixel

We use the Meta Pixel from Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, to measure whether our ads on Facebook and Instagram lead to visits to our website. We also use data from our website visitors to create target audiences for ads on those platforms. The pixel reports every page view to Meta, including the page viewed, your IP address, browser and device information, and an identifier from the cookie _fbp (3 months). If you are logged in to Facebook or Instagram, Meta can associate your visit with your account; to do so, Meta also uses its own cookies on facebook.com.

We and Meta are joint controllers for the collection of data on our website and its transfer to Meta (Art. 26 GDPR). This is based on a joint controllership agreement with Meta (the “Controller Addendum”): https://www.facebook.com/legal/controller_addendum. You can exercise your rights with Meta or with us. Meta is the sole controller for further processing after the transfer. Meta’s Privacy Policy: https://www.facebook.com/privacy/policy/

OpenAI Measurement Pixel (Ads in ChatGPT)

We display ads in ChatGPT and use the Measurement Pixel of OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, to measure whether visitors request a consultation appointment after clicking on such an ad. To do this, the pixel reports a click on an appointment button (Doctolib) as an event to OpenAI, including, among other things, the URL of the page visited, a timestamp, and a random identifier for your browser. Cookies:

Privacy notice from OpenAI: https://openai.com/policies/eu-privacy-policy/

7. Embedded Content

Some pages contain videos, maps, or images from third-party providers. These are not loaded until you have given your consent in the cookie banner; prior to that, your browser does not establish a connection with the provider. As soon as content loads, the provider receives at least your IP address and information about which of our pages you are visiting. The legal basis in each case is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent via the cookie banner (Section 4).

YouTube

The provider is Google Ireland Limited (address in Section 6). When videos are played, YouTube may set cookies and collect usage data. If you are signed in to your Google account, YouTube may associate the view with your account. Privacy notice: https://policies.google.com/privacy

Vimeo

The provider is Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA. When videos are played, Vimeo may set cookies and collect usage data; the data is processed in the United States. Vimeo is certified under the EU-U.S. Data Privacy Framework. Privacy notice: https://vimeo.com/privacy

Google Maps

We display maps from Google Maps on several pages to help you find our locations. The provider is Google Ireland Limited. When the map loads, it also loads fonts from Google’s servers. Privacy notice: https://policies.google.com/privacy

Instagram Feed

On some pages, we display posts from our Instagram account using the “Smash Balloon Instagram Feed” plugin. The images come from Instagram’s servers. The provider is Meta Platforms Ireland Limited (address in Section 6). Instagram’s Privacy Policy: https://privacycenter.instagram.com/policy

8. Fonts and Accessibility

Fonts

The fonts used on this website (PT Sans and Italiana) are hosted on our own server. Loading them does not establish a connection to Google or any other font provider. The exception is Google Maps, which loads its own fonts from Google after you give your consent (Section 7).

“Ally” Accessibility Assistant

The “Ally” tool from Elementor Ltd., Israel, allows you to adjust font size and contrast, for example. It is loaded from cdn.elementor.com without prior consent; in doing so, Elementor receives your IP address and information about your browser. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to make the website more accessible to people with disabilities. As soon as the page loads, “Ally” creates two entries in your browser to save your settings: ea11y-global-state in local storage, where it remains until you delete it, and ea11y-session-state for the duration of the session. Privacy notice: https://elementor.com/about/privacy/

9. Retention Period, Recipients, Third Countries, and Changes

Retention Period

We store personal data only for as long as required for the respective purpose or until you withdraw your consent. If there are statutory retention periods, we will use the data solely for that purpose until the end of the retention period and then delete it. The retention period of the cookies set via our website is stated under the respective services, to the extent we know it; for embedded content, the provider determines it. The server log files at IONOS are deleted after approximately eight weeks; the IP addresses they contain are truncated, with the last segment replaced by 0.

Recipients

We only disclose personal data as described in this policy: to our technical service providers (IONOS, Cloudflare, Elementor), to the providers of measurement tools and embedded content if you have given your consent, and to Meta as a joint controller for the Meta Pixel. Service providers who process data on our behalf are bound by our instructions under Art. 28 GDPR.

Transfers to Third Countries

Some providers also process data outside the European Union. This occurs only if the European Commission has recognized the recipient’s level of data protection as sufficient or if the provider has contractually committed to EU standards (Standard Contractual Clauses):

Changes

We will update this Privacy Policy if the website, the services used, or the legal situation changes. The version published here applies.

Consultation appointment