Skip to content
Praxis Maria Kasouha logo

Legal

Privacy policy

1. Privacy at a glance

This is a courtesy translation. Only the German version of this privacy policy is legally binding.

Protecting your personal data is particularly important to us as a medical practice. In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), this privacy policy explains which personal data are processed when you visit this website, for what purposes and on what legal basis, and which rights you have.

Personal data means any information that can be used to identify you personally, such as your name, email address or IP address. The relevant legal framework is in particular the GDPR, the German Federal Data Protection Act (BDSG) and, for storing and accessing information on your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG).

2. Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

Praxis Maria Kasouha
Maria Kasouha
Poststraße 7
57555 Mudersbach
Germany

Phone: 02745 910750
Fax: 02745 910759
Email: info@praxis-kasouha.de

3. Data protection officer

Our practice is not required to appoint a data protection officer under Art. 37 GDPR and Section 38 BDSG, and none has been appointed. Please direct any data protection questions to the controller named above.

4. General information on data processing

Legal bases

Unless stated more specifically below, we process personal data on the following legal bases:

  • Consent – Art. 6(1)(a) GDPR; for health data Art. 9(2)(a) GDPR; for access to your device additionally Section 25(1) TDDDG;
  • Contract and pre-contractual measures – Art. 6(1)(b) GDPR, e.g. for enquiries prior to treatment;
  • Legal obligation – Art. 6(1)(c) GDPR;
  • Legitimate interests – Art. 6(1)(f) GDPR, e.g. in the secure and reliable operation of this website.

Storage period

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. Once the purpose no longer applies and no retention obligations exist, the data are deleted. Specific periods are stated for each processing activity.

No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

5. Hosting and server log files

This website is operated by an external service provider (host):

[Please enter the hosting provider in the admin area]

When you access the website, the host's server automatically records information transmitted by your browser (server log files):

  • IP address of the requesting device,
  • date and time of access,
  • page or file requested (URL),
  • previously visited page (referrer URL),
  • browser and operating system used (user agent),
  • HTTP status code and amount of data transferred.

This processing is technically necessary to deliver the website and to ensure its stability and security, e.g. to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our website securely and without errors. Log files are generally deleted after 14 days at the latest unless they are needed for longer in an individual case to investigate a security incident. The data are not combined with other data sources.

We have concluded a data processing agreement with our host pursuant to Art. 28 GDPR. The host processes your data only in accordance with our instructions.

6. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the padlock symbol in your browser. When encryption is active, the data you send to us cannot be read by third parties.

7. Cookies, local storage and consent management

We use cookies and similar technologies. Cookies are small text files that your browser stores on your device. We set strictly necessary cookies without consent on the basis of Section 25(2) No. 2 TDDDG; all other technologies are used only with your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Our own consent management

We manage your consent with a solution developed in-house; no third-party consent management provider is used. On your first visit you can choose which of the following categories you agree to:

  • Necessary – required for the website to function; always active.
  • Statistics – anonymised or pseudonymised audience measurement (Google Analytics 4).
  • External media – content and services from third parties (Google Maps, Google reCAPTCHA).

To document your consent (Art. 7(1) GDPR), we store in our database a randomly generated consent ID, the categories selected, the version of this privacy policy, the time stamp and your shortened or hashed IP address and user agent. We keep this proof for three years. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

You can withdraw or change your consent at any time with effect for the future – via the “Cookie settings” link in the footer of every page or directly in the cookie settings. The lawfulness of processing carried out before the withdrawal remains unaffected.

Google Consent Mode v2

We use Google Consent Mode v2. All consent signals are set to “denied” by default. Only after you have consented to the “Statistics” category is this status changed and the corresponding Google services loaded. Without your consent, no Google statistics services are loaded.

Overview of cookies used

  • pk_consent (necessary) – stores your choice in the consent management; retention 12 months. Legal basis: Art. 6(1)(c) GDPR, Section 25(2) No. 2 TDDDG.
  • pk_csrf (necessary) – security token protecting our forms against cross-site request forgery; retention until the end of the browser session, max. 2 hours. Legal basis: Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG.
  • ci_session (necessary) – used exclusively in the practice's internal, password-protected administration area; not set for website visitors.
  • _ga, _ga_* (statistics) – Google Analytics 4 cookies used to distinguish visitors and sessions; retention up to 2 years. Set only after your consent. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

8. Contact form

When you send us a message via the contact form, we process the following data: name, email address, optionally your phone number, your message and the selected website language. To prevent abuse, we additionally store a hash of your IP address.

The data are stored in our database on our host's server and also forwarded to the practice by email. For sending emails we use Zoho Mail of Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands. The data are processed in a data centre within the EU; a data processing agreement pursuant to Art. 28 GDPR is in place with Zoho.

The processing serves to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to treatment or its initiation, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The IP hash is stored on the basis of Art. 6(1)(f) GDPR to protect against abuse.

Health data

Messages may contain information about your health, which is specially protected under Art. 9 GDPR. Where you voluntarily provide such information, we process it on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give by sending the message and may withdraw at any time. Please do not send detailed health information via the form. For medical matters, please call the practice or book an appointment via Doctolib.

Spam protection

To protect against automated requests, we use a field invisible to humans (honeypot) and limit the number of requests (rate limiting). No data are transferred to third parties in this process. The legal basis is Art. 6(1)(f) GDPR. If you have consented to the “External media” category, we additionally use Google reCAPTCHA (see below).

Storage period

Contact enquiries are automatically deleted from our database after 720 days unless statutory retention obligations apply. Providing your data is neither legally nor contractually required; however, we cannot process your enquiry without your name, email address and message.

9. Contact by email, phone or fax

If you contact us by email, phone or fax, we process your details (e.g. name, contact details, content of the enquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR for enquiries relating to treatment and otherwise Art. 6(1)(f) GDPR; where you share health data, additionally Art. 9(2)(a) or (h) GDPR. Please note that unencrypted emails are not fully protected against access by third parties during transmission.

10. Online appointment booking via Doctolib

For online appointment booking, we link to the platform of Doctolib GmbH, Mehringdamm 51, 10961 Berlin, Germany. Our website only contains a link; data are transferred only when you click the link and open the Doctolib page. Doctolib is responsible for data processing on its platform. For more information, see Doctolib's privacy policy.

11. Google Maps

To show our location, we use the map service Google Maps provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Using a two-click solution, the map is loaded only after you have consented to the “External media” category or actively enabled the map. Until then, no connection to Google is established.

Once loaded, your IP address, date and time and browser information, among other things, are transmitted to Google; Google may use cookies or similar technologies. A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (DPF), for which an adequacy decision of the European Commission under Art. 45 GDPR exists.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you can withdraw at any time in the cookie settings. Further information: Google Privacy Policy.

12. Google reCAPTCHA

To protect our contact form against abuse and spam, we use Google reCAPTCHA v3 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA uses various characteristics (e.g. IP address, time spent on the page, mouse movements, browser and device information) to determine whether an input comes from a human or an automated program. These data are transmitted to Google; a transfer to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework, is possible.

reCAPTCHA is loaded only if you have consented to the “External media” category. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Without your consent you can still use the contact form; it is then protected by our own measures described above. You can withdraw your consent at any time in the cookie settings. Further information: Google Privacy Policy.

13. Google Analytics 4

If you have consented to the “Statistics” category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to analyse how our website is used (e.g. pages viewed, time spent, approximate location, device type) and to improve our services. For this purpose, the cookies _ga and _ga_* are set.

Google Analytics 4 does not store IP addresses; data from the EU are first processed on servers in the EU, where the IP address is used only to derive an approximate location and is then discarded. We have set the retention period for event data to 2 months; Google Signals is disabled. A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework. A data processing agreement is in place with Google.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time in the cookie settings. Further information: Google Privacy Policy.

14. Fonts

The fonts used on this website are hosted locally on our server. No connection to Google Fonts or other font providers is established when you view our pages.

15. Treatment data

No treatment or patient records are processed via this website. Patient data processed in the course of your treatment are handled separately in our practice, are subject to medical confidentiality (Section 203 of the German Criminal Code, StGB) and are not covered by this privacy policy. We inform you about this separately in the practice.

16. Your rights

With regard to your personal data, you have the following rights against us:

  • right of access (Art. 15 GDPR),
  • right to rectification (Art. 16 GDPR),
  • right to erasure (Art. 17 GDPR),
  • right to restriction of processing (Art. 18 GDPR),
  • right to data portability (Art. 20 GDPR),
  • right to object to processing (Art. 21 GDPR),
  • right to withdraw consent with effect for the future (Art. 7(3) GDPR), e.g. via the cookie settings.

To exercise your rights, an informal message to the contact details above is sufficient, e.g. by email to info@praxis-kasouha.de.

Right to object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
(State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)
Hintere Bleiche 34
55116 Mainz, Germany
www.datenschutz.rlp.de

17. Changes to this privacy policy

We will amend this privacy policy whenever changes to our website or the legal situation make this necessary. The current version published here applies.

Last updated: 30.10.2026