This is a courtesy translation for international patients. The legally binding version is the German original.
This privacy policy informs you about the nature, scope and purpose of the processing of personal data in connection with our website, our medical services and online payment processing.
Dr. Beata Lutomska-Kaufmann
Liebiggasse 4, TOP 6
1010 Vienna
Austria
Phone: +43 664 5163145
Email: ordination@reaging-medicine.at
We process the following categories of personal data:
Processing is carried out for the following purposes:
Processing is carried out on the following legal bases:
In the context of our medical services, in particular telemedicine consultations, we process health data within the meaning of Art. 9 GDPR.
This processing is carried out for medical diagnosis, treatment, documentation and billing in accordance with Art. 9 (2) (h) GDPR and professional regulations.
Health data is subject to medical confidentiality.
For processing online payments we use the following payment service provider:
Stripe Payments Europe Ltd.
1 Grand Canal Street Lower
Grand Canal Dock
Dublin, Ireland
Stripe processes personal data such as name, email address, payment data, IP address and technical data in order to carry out the payment and to prevent fraud.
Processing is based on Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (f) GDPR (legitimate interest in secure payment processing).
Further information can be found in Stripe's privacy policy: https://stripe.com/privacy
This website is hosted by Netlify (Netlify, Inc., 44 Montgomery Street, San Francisco, CA 94104, USA). When the website is accessed, the server log data referred to above is processed by Netlify as a processor.
As Netlify is based in the USA, a transfer to a third country takes place to that extent. Netlify is certified under the EU-US Data Privacy Framework and additionally applies the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914). The data processing agreement under Art. 28 GDPR forms part of Netlify's terms of use.
We have access to these server logs for the most recent 24 hours in each case. The legal basis is our legitimate interest in the secure and reliable operation of the website (Art. 6 (1) (f) GDPR). Further information can be found in Netlify's privacy policy.
For the appointment form and the self-assessment questionnaires on our website we use the Jotform service provided by Jotform Inc., 4 Embarcadero Center, Suite 780, San Francisco, CA 94111, USA.
Storage location: Jotform's EU data centre is enabled for our account. Your entries are stored and processed on servers in Germany. In normal operation no transfer to the USA takes place. Where access by the US parent company occurs in an individual case, it is based on Standard Contractual Clauses under Art. 46 GDPR.
No automatic loading: Forms and questionnaires are not loaded automatically. They are embedded only once you actively click the relevant button. Until that click, no data whatsoever is transmitted to Jotform. With the click, your IP address is transmitted to Jotform.
Appointment form: When you complete the appointment form, the data you enter (name, email address, telephone number, subject and message) is processed in order to handle your enquiry. The legal basis is Art. 6 (1) (a) GDPR (consent given by loading the form) and Art. 6 (1) (b) GDPR (steps prior to entering a contract). If you voluntarily provide health data in the free-text field, it is processed under Art. 9 (2) (h) GDPR in the context of medical treatment.
Self-assessment questionnaires: The questionnaires on gut health, thyroid and hormonal balance ask for neither your name nor any contact details. What is collected is your information about complaints and symptoms, from which a score is calculated automatically to give you a first orientation. For technical reasons your IP address is also stored with every submitted response; the responses are therefore not fully anonymous. This information constitutes health data within the meaning of Art. 9 GDPR. The legal basis is your explicit consent under Art. 9 (2) (a) GDPR, which you give by actively loading the questionnaire.
Participation in the self-assessments is voluntary and is not a prerequisite for treatment or for making an appointment. The result does not constitute a medical diagnosis. You may withdraw your consent at any time with effect for the future; the lawfulness of processing carried out up to that point remains unaffected.
Further information can be found in Jotform's privacy policy: https://www.jotform.com/privacy/
For certain medical services, in particular online consultations and administrative services (e.g. prescription orders), advance payment may be required.
Payment data is processed in order to perform the treatment contract.
In connection with the use of Stripe and Jotform, personal data may be transferred to third countries (in particular the USA).
Transfers are made on the basis of appropriate safeguards under Art. 46 GDPR, in particular Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
We engage external service providers (e.g. hosting providers, payment service providers, form providers) as processors under Art. 28 GDPR.
Personal data is stored only for as long as is necessary for the respective purposes or as long as statutory retention obligations exist.
Relevant retention periods:
You have the following rights:
Austrian Data Protection Authority: https://www.dsb.gv.at
Consent may be withdrawn at any time with effect for the future.
When you visit our website, server log files (e.g. IP address, time, browser) are processed in order to ensure the secure operation of the website.
This website sets no cookies of its own and uses neither analytics nor advertising cookies. Your behaviour is not tracked.
No third-party content on page load: Simply opening our pages loads no third-party content. The fonts used are also stored locally on our server; there is no connection to Google Fonts or any other external font provider.
Only when you actively load a form or questionnaire is content from Jotform embedded. Only then can technically necessary cookies be set by Jotform. Without that click, no third-party cookies are set.
If you contact us by email or telephone, the data transmitted is processed in order to handle your enquiry.
We take technical and organisational security measures in accordance with Art. 32 GDPR to protect your data against loss, misuse and unauthorised access.