Privacy policy

This translation is for information only. The German version is legally binding.

1. In short

• This website sets no cookies, uses no analytics or tracking, and loads nothing from other providers (no Google fonts, no embedded map, no videos, no social media buttons).
• When you open a page, our web host briefly keeps technical access data (server log files) so the site runs safely. Then it is deleted.
• If you call or email us, we use what you tell us only to deal with your request.
• Please do not send test results or other health information by email. Ordinary email is not end-to-end encrypted. Please call us instead.

2. Who is responsible?

This website belongs to the Praxisgemeinschaft Dr. med. Dietrich Gorriahn und Helmut Hartl: two independent medical practices under one roof.

For this website, both doctors are joint controllers (Art. 26 GDPR):

• Dr. med. Dietrich Gorriahn, Franz-Joseph-Str. 38, 80801 München
• Helmut Hartl, Franz-Joseph-Str. 38, 80801 München

Phone +49 89 349935 · Email kontakt@goha-praxis.de

The essence of our arrangement (Art. 26(2) GDPR): We run the website together and decided together how it works. We agreed that ❓ one doctor / both via the shared practice address receives and answers data protection requests and keeps this policy up to date. You can still contact either of us about anything (Art. 26(3) GDPR); we will pass your request on internally.

For your treatment, only the doctor who treats you is responsible. The two practices keep patient records separately. ❓ confirm Each practice informs you separately about how it handles your data during treatment. This policy covers only the website and contact by phone and email.

Data protection officer: ❓ see German version

3. What happens when you visit this website?

When you open a page, your browser sends technically necessary data to the server, which stores it in a log file:
your device's IP address ❓ full or shortened, date and time, the page or file requested and the status code, the amount of data sent, and browser and operating system (if your browser sends them). ❓ referrer: switch off if possible

Purpose: delivering the website, finding errors, detecting and stopping attacks.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in safe, stable operation).
Retention: ❓ 7 days recommended, 30 days at most. Entries needed to investigate a security incident are kept until it is resolved. We do not use log files to identify you and do not combine them with other data.

Web host: ❓ name and address, acting on our behalf (Art. 28 GDPR). Servers in ❓ country, ideally Germany/EU. The connection is encrypted with TLS ("https://").

4. No cookies, no tracking, no third-party content

We set no cookies, use no analytics, statistics or advertising tools, and no tracking pixels. Fonts are served from our own server; no connection is made to Google or other font providers. We embed no content from other providers (no maps, videos, social media buttons or chat). That is why there is no cookie banner: there is nothing to consent to.

5. Map and directions

The "Your visit" page shows a map image stored on our own server. Viewing it sends no data to a map service.
❓ map source and licence, e.g. "Map data © OpenStreetMap contributors, ODbL" Links such as "Open route in maps app" take you off our website only when you click them. The provider's own privacy policy then applies (e.g. OpenStreetMap, Apple or Google). We have no control over that.

6. Settings stored in your browser

This website stores nothing on your device. You choose the language through the page address. Reduced animation follows your device's setting.

7. Contact by phone and email

There is no contact form on this website.

Phone: Tapping a phone number only opens your phone app; the website learns nothing. We use what you tell us on the phone to deal with your request (e.g. to book an appointment). ❓ answering machine?

Email: Clicking an email address opens your own email program. We receive your address and message only when you send it.

• Purpose: answering your request.
• Legal basis: Art. 6(1)(b) GDPR for treatment or appointments, otherwise Art. 6(1)(f) GDPR. If you choose to send health information, we process it for your care under Art. 9(2)(h) GDPR with § 22(1) no. 1(b) BDSG. ❓
• Retention: deleted once dealt with ❓ e.g. after 6 months, unless it belongs in your medical record; records are kept for 10 years after treatment ends (§ 630f(3) German Civil Code).
• Email provider: ❓ name and location, acting on our behalf (Art. 28 GDPR).

Important: Email is encrypted in transit (TLS) ❓ check, but ordinary email is not end-to-end encrypted. It may sit on servers we do not control. Please do not send test results, lab values, photos of skin or other health information by email. Just tell us what it is about and how to reach you, or call us. We reply by email only with general information (e.g. appointment options), never with results. ❓

8. Who receives your data?

We do not pass on or sell your data. Only these have access: our web host and email provider as processors,
❓ the practice's IT service provider, and authorities where the law requires it. We do not transfer data outside the EU/EEA. ❓ confirm

9. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) unless we must keep the data, restriction (Art. 18) and data portability (Art. 20) where it applies.

Right to object (Art. 21 GDPR): Where we rely on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

Contact either of us (section 2). We usually reply within one month.

Complaint to a supervisory authority (Art. 77 GDPR): For medical practices in Bavaria this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de

10. Do you have to give us data?

No. You can use the website without telling us anything. Server log data (section 3) arises technically when a page is opened. For an appointment we need your name and a way to reach you. ❓ anonymous HIV test route We make no automated decisions and build no profiles (Art. 22 GDPR).

11. Changes

We update this policy when the website or the law changes.

Last updated: ❓ YYYY-MM-DD