Privacy Policy

The controller responsible for the processing of personal data on this website is:

Dr. Jürgen Kohlmeyer’s Practice
Gereonsdriesch 23
50670 Cologne
Email: praxis@drkohlmeyer.de

No data protection officer has been appointed.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, contact details, IP addresses and – in connection with enquiries or treatment – possibly also health data.

We process personal data only where there is a legal basis for doing so. Depending on the processing concerned, the relevant legal bases may include in particular:

- Article 6(1)(a) GDPR where consent has been given,
- Article 6(1)(b) GDPR for steps taken prior to entering into a contract or for the performance of a contract,
- Article 6(1)(c) GDPR for compliance with legal obligations,
- Article 6(1)(f) GDPR for the purposes of legitimate interests,
- Article 9(2)(a) GDPR where explicit consent has been given to the processing of special categories of personal data,
- Article 9(2)(h) GDPR in conjunction with the relevant national provisions, in particular Section 22(1) no. 1(b) of the German Federal Data Protection Act (BDSG), where health data is processed for the purposes of healthcare, diagnosis or treatment.

We take appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised disclosure or unauthorised access.

When the website is merely accessed, the connection data required for its technical provision is processed automatically. The website cannot be delivered without this processing.

Contacting us is voluntary. However, if you wish to contact us, arrange an appointment or establish or manage a treatment relationship, you must provide the information required for this purpose. This information is necessary for steps taken prior to entering into a contract or for the performance of the treatment contract; certain information may also be required because of statutory documentation or billing obligations. Without the required information, we may be unable to process your enquiry, arrange an appointment or initiate or provide treatment. Any additional information is voluntary.

This website is hosted through ChatGPT Sites. For users in the European Economic Area and Switzerland, our contractual partner and processor for website hosting is:

OpenAI Ireland Limited
1st Floor, The Liffey Trust Centre
117–126 Sheriff Street Upper
Dublin 1, D01 YC43
Ireland

OpenAI hosts, maintains and supports the published website on our behalf. Under the ChatGPT Sites Terms, we are the controller of personal data processed through the Site. Hosting is governed by the ChatGPT Sites Data Processing Addendum published by OpenAI. According to its terms, it becomes part of the agreement when a ChatGPT Site is published or operated and personal data is processed in doing so.

When the website is accessed, the following categories of data in particular may be processed:

- IP address and other online or device identifiers,
- date and time of access,
- the address, page or resource accessed,
- referrer URL,
- browser type and version,
- operating system and device information,
- usage, connection, security and error data,
- HTTP status and response information,
- cookie identifiers or comparable technical identifiers, where such technologies are used by the platform or by a function that has been expressly enabled.

This processing is technically necessary to deliver the website, ensure its stability and security, identify errors and prevent abusive access. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of the website.

In its intended technical configuration, the website does not contain its own contact form, user accounts or a file-upload function. The website is therefore not intended for the direct entry or storage of health data through ChatGPT Sites. Appointments can be booked only after deliberately proceeding to Doctolib; email enquiries are processed through the email account hosted by netcup.

OpenAI uses sub-processors for ChatGPT Sites. According to the current list published by OpenAI, these may include in particular Cloudflare as a content delivery and web-hosting provider, as well as cloud-infrastructure providers such as Microsoft, CoreWeave, Oracle Cloud Infrastructure, Google Cloud Platform and Amazon Web Services. They may also include the support, security and moderation service providers named in the current list, to the extent that their services are actually used for the Site.

According to OpenAI’s published contractual documents, processing may take place within and outside the European Economic Area. For transfers to countries for which no adequacy decision exists, the Data Processing Addendum provides in particular for the European Commission’s Standard Contractual Clauses. Where an adequacy decision exists, the transfer may be based on that decision.

The published ChatGPT Sites Data Processing Addendum does not specify a fixed retention period in days that applies to all server and access logs. OpenAI generally processes hosted data for the duration of the provision of the services and, where necessary, beyond that period. Once the services have ended, the data is returned or deleted in accordance with the contractual provisions, unless statutory retention obligations prevent this. A specific log-retention period will be added to this Policy as soon as it has been confirmed as binding by OpenAI.

Further information:

- ChatGPT Sites Terms: https://openai.com/de-DE/policies/chatgpt-sites-terms/
- ChatGPT Sites Data Processing Addendum: https://openai.com/policies/chatgpt-sites-data-processing-addendum/
- OpenAI Sub-processor List: https://openai.com/policies/sub-processor-list/

The domain drkohlmeyer.de, the associated DNS services and the email accounts are operated by the following service provider:

netcup GmbH
Emmy-Noether-Straße 10
76131 Karlsruhe
Germany

netcup does not host the website accessible at drkohlmeyer.de. The web-hosting package held with netcup is not used as the delivery server for the current website. In this context, netcup provides only domain registration and DNS management as well as the email infrastructure.

We have entered into a data processing agreement with netcup in accordance with Article 28 GDPR. It covers the domain, DNS and email services actually used, including the technical and administrative data and connection logs required for those services.

The netcup data processing agreement names the following additional processors in particular:

- Anexia Holding GmbH, Feldkirchner Straße 140, 9020 Klagenfurt, Austria,
- Anexia Cloud Solutions GmbH, Feldkirchner Straße 140, 9020 Klagenfurt, Austria,
- Anexia Cloud Solutions GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany.

The locations named are within the European Union or the European Economic Area. According to the contractual information currently available, no further transfer to a third country is envisaged in connection with the netcup services specifically used.

When the email services are used, netcup processes connection data that is technically necessary. According to netcup, email logs do not contain message content. The connection logs concerned are generally retained by netcup for 14 days. The legal basis for providing and securing the communication infrastructure is Article 6(1)(f) GDPR; Article 6(1)(b) GDPR also applies to contract-related communications.

If you contact us by email or telephone, we process the data you provide in order to respond to your enquiry and, where applicable, take further steps. The following data in particular may be processed:

- name and contact details,
- the time and content of the enquiry,
- communication and connection data,
- information about the matter or appointment requested,
- health data or other particularly sensitive information provided voluntarily.

Depending on its content, a general enquiry is processed on the basis of Article 6(1)(b) GDPR where it serves to establish or manage a treatment relationship, or on the basis of Article 6(1)(f) GDPR where there is a legitimate interest in handling other enquiries appropriately.

Where an enquiry contains health data and its processing is necessary to assess, initiate or provide psychotherapeutic treatment, the processing is based on Article 9(2)(h) GDPR in conjunction with Section 22(1) no. 1(b) BDSG and the relevant professional regulations. Where processing is based on explicit consent, Article 9(2)(a) GDPR is the legal basis. Consent that has been given may be withdrawn at any time with effect for the future.

Telephone calls are not recorded.

Standalone initial enquiries by email or telephone that do not result in a treatment relationship and are not continued through Doctolib are deleted no later than six months after they have been finally dealt with. They are retained for longer only where statutory retention obligations apply or the data is required for the establishment, exercise or defence of legal claims.

If a treatment relationship is established, the data required for it is incorporated into the treatment records and retained in accordance with statutory and professional retention obligations. The standard retention period for treatment records is ten years after the end of treatment, unless particular circumstances require a longer period.

Please note that ordinary emails outside our sphere of control are not always transmitted using end-to-end encryption. You should therefore avoid sending detailed health information by unencrypted email wherever possible. The designated Doctolib service can be used for appointment bookings.

This website contains an external link for booking appointments with Doctolib. Doctolib is not loaded as an embedded booking form or script. No data is transmitted to Doctolib by this website unless you click the link. Only when you click it do you leave our website and access Doctolib’s service.

Scheduled video consultations are also conducted through the video service provided by Doctolib. For this purpose, patients use Doctolib’s technical environment outside this website. The Doctolib video service is certified as a video service in accordance with Annex 31b to the German Federal Framework Agreement for Physicians (Bundesmantelvertrag-Ärzte). Communication during the video consultation is transmitted in encrypted form.

The provider is:

Doctolib GmbH
Friedrichstraße 111
10117 Berlin
Germany
Email: datenschutz@doctolib.de

Doctolib’s Privacy Policy applies to the operation of the Doctolib patient portal, the creation of a Doctolib account and Doctolib’s other own purposes. Where Doctolib processes appointment, patient, video or health data on our behalf as part of the services to which we subscribe, we are the controller and Doctolib is the processor. For this purpose, we have entered into a data processing agreement with Doctolib in accordance with Article 28 GDPR, which applies upon conclusion of the main Doctolib agreement.

The purposes of the processing are to arrange and manage appointments and to provide the technical infrastructure for video consultations. In particular, identity and contact details, appointment data, information about the reason for the visit, insurance status, health data provided by the data subject where applicable, and usage, connection and log data may be processed. Image and audio data are also transmitted in real time during a video consultation.

Our practice does not use the additional functions described in the Doctolib data processing agreement for exchanging or storing medical documents, creating or storing notes and screenshots, or processing payments. Our practice therefore does not process documents, notes, screenshots or payment data through Doctolib.

Processing for appointment booking and the provision of video consultations is based on Article 6(1)(b) GDPR for steps taken prior to entering into a contract or for the performance of the treatment contract. Where health data is processed, the legal basis is Article 9(2)(h) GDPR in conjunction with Section 22(1) no. 1(b) BDSG and the relevant professional regulations.

Under the Doctolib data processing agreement, personal data is stored within the European Economic Area. Amazon Web Services EMEA SARL, based in Luxembourg, and Thales Cloud Sécurisé S.A.S (S3NS), based in France, which operates on Google Cloud Platform infrastructure, are used to host health data. Certain support services relating to Google Cloud infrastructure may involve limited access from the United States. Doctolib refers to contractual and technical safeguards and to the EU–US Data Privacy Framework in this regard. Details are set out in the Doctolib data processing agreement and Doctolib’s Privacy Policy.

Unless we have issued different instructions, the standard retention period specified in the Doctolib agreement for appointment history is five years. A period of between one and twenty years can be configured. Other data processed by Doctolib on our behalf is deleted as soon as it is no longer required for the relevant purposes and there are no statutory or professional retention obligations or legitimate grounds for further storage. The functions for documents, notes, screenshots and payments that are not used by our practice do not give rise to any additional storage of such data.

The further use of patient data for anonymisation, product improvement and statistics offered by Doctolib is disabled in our Doctolib account. Appointment booking through Google Business is also disabled.

Further information: Doctolib Privacy Policy: https://doctolib.legal/privacy-policy-B2C-DE

We use Google Maps to display the location of the practice. For users in the European Economic Area and Switzerland, the controller is generally:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

Google Maps is integrated into this website using a two-click solution. Merely accessing the page does not load the map, and no data is transmitted to Google through the map integration. A connection to Google is established only when you expressly activate the map.

Following activation, the following data in particular may be transmitted to or processed by Google:

- IP address,
- browser, device and operating-system information,
- date and time of access,
- referrer URL,
- interactions with the map,
- location information where applicable,
- cookies, local-storage information or comparable identifiers, where Google uses them.

Activation is based on your consent in accordance with Article 6(1)(a) GDPR. Where information is stored on or accessed from your terminal device in this process, this is additionally based on Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent is voluntary. The rest of the website can be used without restriction if the map is not activated.

Consent applies only to your current use of the page. Leaving or reloading the page deactivates the embedded map again. You can therefore withdraw your consent at any time with effect for the future. The lawfulness of processing carried out before consent was withdrawn remains unaffected.

Google processes data on servers in various countries. A transfer to the United States cannot be ruled out. For such transfers, Google refers in particular to its certification under the EU–US Data Privacy Framework and, where required, to the European Commission’s Standard Contractual Clauses. Despite these safeguards, processing in the United States may entail risks, particularly because of possible access by public authorities.

Further information:

- Google Privacy Policy: https://policies.google.com/privacy?hl=de
- Google’s legal framework for data transfers: https://policies.google.com/privacy/frameworks?hl=de

In its intended technical configuration, this website does not use any analytics or marketing services of its own. The practice does not carry out user-specific audience measurement, tracking for advertising purposes or automated profiling.

Technically necessary cookies or comparable technologies of the hosting service may be used where they are required for the secure provision of the website. Third-party services that are not technically necessary are not loaded without your prior consent. This applies in particular to the integration of Google Maps.

Within the practice, access to personal data is restricted to those persons who require it in order to perform their duties and who are bound by confidentiality or professional secrecy.

Outside the practice, data may – where necessary and legally permissible – be transferred in particular to the following categories of recipients:

- website-hosting, infrastructure, security and support providers, in particular OpenAI Ireland Limited and the service providers named in OpenAI’s current sub-processor list for ChatGPT Sites,
- domain, DNS and email service providers, in particular netcup GmbH and the sub-processors named in the netcup data processing agreement,
- appointment, video-consultation and practice-management service providers, in particular Doctolib GmbH and its contractually named sub-processors,
- providers of a map service activated only after consent has been given, in particular Google Ireland Limited and Google LLC,
- authorities, courts or other public bodies where there is a legal obligation to transfer the data,
- other recipients where you have consented to the transfer or another legal basis applies.

When the website is hosted through ChatGPT Sites, OpenAI and its published sub-processors may also process data outside the European Union or the European Economic Area. Depending on the recipient and country, OpenAI provides in particular for adequacy decisions or the European Commission’s Standard Contractual Clauses in this regard.

According to the contractual information available, the specifically named sub-processors for the netcup domain, DNS and email services used are located in Germany or Austria.

Further transfers to third countries may take place where a service is expressly activated or accessed externally, particularly in connection with Google Maps or limited support access at Doctolib. In these cases, the safeguards described in the relevant sections apply. These may include an adequacy decision, certification under the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Unless a specific retention period is stated in this Privacy Policy, we retain personal data only for as long as is necessary for the relevant purpose. The data is then deleted or anonymised, unless statutory or professional retention obligations, legitimate interests in defending legal claims or other legal grounds require further retention.

The published contractual documents for ChatGPT Sites do not specify a uniform fixed period in days for hosting, security and access logs generated by ChatGPT Sites. The relevant factors are therefore the need for provision, security and error analysis, the term of the contract, our instructions and any legal obligations. This information will be updated as soon as OpenAI confirms a specific binding period.

Subject to the statutory requirements, you have the following rights in particular:

- access to the personal data processed about you in accordance with Article 15 GDPR,
- rectification of inaccurate data or completion of incomplete data in accordance with Article 16 GDPR,
- erasure of your data in accordance with Article 17 GDPR,
- restriction of processing in accordance with Article 18 GDPR,
- data portability in accordance with Article 20 GDPR,
- objection to processing based on Article 6(1)(e) or (f) GDPR in accordance with Article 21 GDPR,
- withdrawal of consent at any time with effect for the future in accordance with Article 7(3) GDPR,
- the right to lodge a complaint with a data protection supervisory authority in accordance with Article 77 GDPR.

To exercise your rights, you may use the contact details provided under “Controller”.

Special information on the right to object

Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then cease processing the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims.

We do not carry out solely automated decision-making, including profiling, within the meaning of Article 22 GDPR.

You may contact, in particular, the data protection supervisory authority responsible for us:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
Telephone: 0211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

Your right to lodge a complaint with any other data protection supervisory authority competent under Article 77 GDPR remains unaffected.

We update this Privacy Policy if the website, the services used or the legal requirements change. The version published on this website at the relevant time is authoritative.