Data protection

This data protection notice applies to our practice services at Dorotheenstrasse 48, 22301 Hamburg as well as to our website and the services offered there (e.g. online appointment booking). We only process personal data if this is necessary to provide our medical and organizational services or if you have consented to this.

• Legal basis: Art. 6 Para. 1 GDPR (e.g. contract/treatment contract, legal obligations, legitimate interests), Art. 9 Para. 2 GDPR (especially health data).
• Data economy: We only process data that is necessary for the respective purpose.
• Transparency: We provide information about purposes, recipients, storage period and your rights.
• Security: We protect data through technical and organizational measures (e.g. access and access controls, encryption).

The orthopedic specialist practice, Dorotheenstrasse 48, 22301 Hamburg is responsible for data processing.

If you have any data protection concerns, you can contact us by email: info@citak.de. Please mark your request with “Data Protection” in the subject line.

• Master data: name, title, date of birth, address, contact details.
• Treatment and health data: anamnesis, diagnoses, findings, therapies, prescriptions, doctor's letters, image data (e.g. x-rays), documentation of treatment courses.
• Billing data: insurance number, cost bearer, billing information (GKV/PKV/self-payer).
• Appointment data: Appointment requests, confirmed appointments, waiting and treatment times.
• Communication data: Contents of inquiries via email or form, possibly telephone notes.
• Website data: server log files (e.g. IP address in anonymized/shortened form, date/time, pages accessed), consent status (local storage), technically necessary cookies, optional analysis data (Google Analytics 4) only with consent.

We only process your data for specified purposes. Depending on the purpose, we rely on different legal bases of the GDPR.

• Medical treatment and practice organization: Implementation of the treatment contract, documentation, appointment planning, quality assurance (Art. 6 Para. 1 lit. b GDPR; Art. 9 Para. 2 lit. h GDPR in conjunction with Section 22 BDSG).
• Fulfillment of legal obligations: storage of treatment documents, billing and tax obligations (Art. 6 Para. 1 lit. c GDPR).
• Communication: Processing your inquiries (Art. 6 Para. 1 lit. b or f GDPR; for health-related Art. 9 Para. 2 lit. h GDPR).
• Online appointment allocation: Management of appointment requests via an external service (Art. 6 Para. 1 lit. b GDPR; with consent, additionally Art. 6 Para. 1 lit. a GDPR).
• Web analysis/cookies: Range measurement and improvement of the website only with consent (Art. 6 Para. 1 lit. a GDPR).
• Safeguarding legitimate interests: IT security, defense against attacks, legal defense (Art. 6 Para. 1 lit. f GDPR).

Our website is operated by a hosting provider in the EU. When accessed, server log files are automatically processed in order to provide the website in a stable and secure manner.

• Processed data: IP address (shortened/anonymized if possible), date/time, URL/referrer, user agent, status codes.
• Purposes: Delivery of the website, error analysis, IT security (e.g. defense against attacks).
• Legal basis: Article 6 Paragraph 1 Letter f GDPR (legitimate interest in secure operation).
• Storage period: Log data is regularly stored for a short period of time and then deleted or anonymized unless a security-relevant evaluation is required.

Your data will only be passed on if it is required by law, is necessary to fulfill the treatment contract, you have consented or there is a legitimate interest and there are no overriding interests worthy of protection.

• Billing offices, payers (statutory/private health insurance companies), association of statutory health insurance physicians – if necessary for billing.
• Laboratories, radiological facilities, co-treating or further treating doctors – if medically indicated and with a legal basis.
• IT and hosting service providers (contract processors) for the operation, maintenance and security of our systems.
• Provider of online appointment scheduling (e.g. Doctolib) as processor.
• Legal advice, tax advice, if necessary courts/authorities in legal disputes and legal obligations.

We only store personal data for as long as it is necessary for the respective purposes or as long as legal retention periods apply. Health and treatment data are generally stored for at least 10 years after completion of treatment (including in accordance with Section 630f of the German Civil Code (BGB) in conjunction with professional regulations). Longer deadlines may apply for individual documents.

After the deadlines have expired, data will be deleted or anonymized unless there are legal or contractual reasons to the contrary.

We use an external service provider (e.g. Doctolib) to make appointments convenient. When you use online appointment booking, the necessary data will be transmitted to the service provider in order to process your appointment request.

• Processed data: master data, contact details, appointment data; optional information about the treatment request.
• Legal basis: Implementation of pre-contractual measures/treatment contract (Art. 6 Para. 1 lit. b GDPR); for sensitive information, Art. 9 Para. 2 lit. h GDPR.
• Order processing: The service provider processes the data on our behalf and on the basis of a contract in accordance with Art. 28 GDPR.
• Further information: Data protection information from the provider (e.g. doctolib.de/datenschutz).

If you contact us by email, we will process your information to process the request. Please send only the most necessary personal data by email. For particularly sensitive information, we offer secure communication channels upon request.

Legal basis: Art. 6 Para. 1 lit. b GDPR (initiation/processing), if applicable Art. 6 Para. 1 lit. f GDPR (legitimate interest in efficient communication); in the case of health-related matters, Art. 9 Para. 2 lit. h GDPR.

We only use cookies or similar technologies (e.g. local storage) that are technically necessary for the operation of the website. Optionally, we only load Google Analytics 4 after you have given your active consent via the cookie banner. No range measurement will take place without consent.

• Consent banner: A banner appears on the first visit. You can agree or disagree; Your selection will be saved in Local Storage (`cg-consent-v2`: value `accepted` or `declined`).
• Technically necessary cookies/technologies: Storage of the consent status (local storage), if necessary session cookies from the hosting/CDN. Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in operations).
• Analysis (optional): Google Analytics 4 via Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Cookies etc. `_ga`, `_ga_*`; Purpose: range measurement, error analysis; Storage period i. d. R. 14 months. Legal basis: Your consent in accordance with Article 6 Paragraph 1 Letter a GDPR.
• Revocation: You can change your selection at any time in the banner (“Cookie Settings”) or revoke consent that has already been given with effect for the future.
• Third countries: Google can transfer data to the USA. EU standard contractual clauses apply. No analytics will be loaded without your consent.

We embed YouTube videos (Google Ireland Ltd.). The preview is provided locally; the actual video player only loads after you click. From this point on, data (e.g. IP address, device/browser data, URL accessed) can be transferred to YouTube/Google.

• Legal basis: Art. 6 Para. 1 lit. a GDPR (consent by clicking on the video).
• Third countries: Google may transfer data to the USA; EU standard contractual clauses apply.

If you apply to us, we will process your application data exclusively for the purpose of deciding whether to establish an employment relationship.

• Legal basis: Section 26 BDSG (justification of an employment relationship), if applicable Art. 6 Para. 1 lit. a GDPR (consent) for longer storage in the talent pool.
• Storage period: Typically 6 months after completion of the procedure; longer storage only with consent.

• Information (Art. 15 GDPR): You will receive information about the data processed about you.
• Correction (Art. 16 GDPR): You can have incorrect data corrected.
• Deletion (Art. 17 GDPR): You can request deletion, provided there is no obligation to retain it.
• Restriction (Art. 18 GDPR): You can have processing restricted.
• Data portability (Art. 20 GDPR): You receive data in a structured, common format.
• Objection (Art. 21 GDPR): You can object to processing that is based on Art. 6 Para. 1 lit. e or f GDPR.
• Revocation of consent (Art. 7 Para. 3 GDPR): Consent can be revoked at any time with future effect.
• Right to complain: You can complain to a data protection supervisory authority, e.g. B. at the Hamburg Commissioner for Data Protection and Freedom of Information (datenschutz-hamburg.de).

If, in individual cases, processing takes place by providers outside the EU/EEA, we ensure that an appropriate level of data protection exists (e.g. adequacy decision of the EU Commission or EU standard contractual clauses) and only the necessary data is transmitted.

We protect your data using measures appropriate to the risk. These include, among other things: encrypted transmissions (TLS), access and access controls, authorization concepts, regular updates and sensitization of the practice staff.

In order to provide medical treatment, we need certain personal and medical information. Without this data, appropriate care is generally not possible. Only the data required in each case must be provided for website functions; Further information (e.g. analytics) is provided voluntarily.

We adapt this information if legal situations, technical standards or our processes change. The current version applies, which can be seen from the status date above.

Orthopedic specialist practice, Dorotheenstrasse 48, 22301 Hamburg

Email: info@citak.de

Supervisory authority: Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, www.datenschutz-hamburg.de