Privacy policy

1. Controller

The controller responsible for processing personal data on this website is:

Finke & Frantzen GbR
Consultants in Plastic and Aesthetic Surgery
Heinrich-Roller-Straße 15, 10405 Berlin, Germany
Telephone: +49 30 473 770 24 · Fax: +49 30 443 172 62
Email: praxis@finke-frantzen.de

2. General information

We take the protection of your personal data very seriously. As a medical practice, we are also bound by medical confidentiality under Section 203 of the German Criminal Code and by the professional rules of the Berlin Medical Association. We process data in accordance with the GDPR, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG).

Health data are special-category personal data under Article 9 GDPR and receive a particularly high level of protection.

3. Your rights

You have the right to access your data (Art. 15 GDPR), rectification (Art. 16), erasure where no retention duty applies (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21), and withdrawal of consent with future effect (Art. 7(3)).

You can change or withdraw cookie consent at any time through “Cookie settings”. You may lodge a complaint with the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

4. Server log files and hosting

When you visit this website, our hosting provider automatically records browser type and version, operating system, referrer URL, host name, time of request and IP address. Processing is based on Art. 6(1)(f) GDPR for secure, technically reliable delivery and optimisation. Log files are deleted after no more than 30 days.

The website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, under a data-processing agreement pursuant to Art. 28 GDPR.

5. SSL/TLS encryption

This website uses SSL/TLS encryption. An encrypted connection is indicated by “https://” and the lock symbol in your browser.

6. Cookies and consent

Strictly necessary cookies are used under Section 25(2) TDDDG together with Art. 6(1)(f) GDPR. All other cookies, including statistics and third-party embedded content, are used only after consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

We use Complianz to obtain and manage consent. Details and retention periods appear in our cookie policy.

7. Contacting us

If you contact us by email, telephone, fax or answering machine, we process your details to answer your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a treatment contract, otherwise Art. 6(1)(f) GDPR.

Unencrypted email can be read in transit. Please do not send health data by unencrypted email. Contact us by telephone or discuss it in person. Enquiries are deleted when completed unless statutory retention duties apply.

8. Online appointments (arzt-direkt)

The appointments page embeds the booking calendar of zollsoft GmbH (arzt-direkt), Sophienstraße 40, 07743 Jena, Germany. Loading it transmits technical data, including your IP address, to zollsoft.

For a booking, we process your name, contact details, requested appointment and reason for visiting. Where this reveals health information, processing is based on Art. 6(1)(b) together with Art. 9(2)(h) GDPR. A data-processing agreement under Art. 28 GDPR is in place. Online bookings are binding and subject to a fee. You may book by telephone if you prefer not to transmit data to this provider.

9. Data in the treatment relationship

When treatment takes place, we process health data for diagnosis, treatment and billing under Art. 6(1)(b), Art. 9(2)(h) GDPR and Section 22(1)(1)(b) BDSG. Data are disclosed only where required for treatment, billing, by law or with consent—for example to other treating physicians, laboratories, hospitals or private medical billing services.

Patient records are retained for ten years after treatment under Section 630f(3) BGB unless longer periods apply. Billing documents are retained for six to ten years under tax and commercial law.

10. Google Maps

Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is loaded on the contact page only after you activate it. Google then receives your IP address and technical information; transfer to the USA is possible. The basis is consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. See Google’s privacy policy.

11. Google Tag Manager and Google Analytics

Google Tag Manager (GTM-WT6M67B) manages scripts but does not itself create user profiles or set cookies. Google Analytics 4 (measurement ID G-9C2LV3EPW2) is used only with consent to measure aggregated website use. IP addresses are shortened before further processing, data are retained for 14 months, and transfers to the USA may rely on the EU-US Data Privacy Framework and standard contractual clauses.

Analytics data are not connected with patient records. Consent may be withdrawn through Cookie settings or the Google opt-out add-on.

12. Microsoft Clarity

With consent, Microsoft Clarity (Microsoft Ireland Operations Limited, Dublin) records technical interaction events such as mouse movements, scrolling and clicks to provide heatmaps and session recordings. Form-field contents are masked before transmission. Recordings are deleted after 30 days. Transfers to the USA are possible. See the Microsoft privacy statement.

13. Fonts

All fonts are loaded from our own server. No connection is made to Google Fonts or another font provider.

14. Social networks and review portals

Links to Facebook, Instagram, Google and review portals are ordinary external links. Data are transferred to those providers only after you click a link. No social-media plugins are embedded.

15. Recipients and international transfers

Recipients may include our host, appointment provider, treating physicians, laboratories, hospitals and private medical billing services where required for the stated purposes, with consent or by law. Transfers outside the EU/EEA may occur for the services in sections 10–12 and are based on consent and appropriate safeguards such as EU standard contractual clauses.

16. Retention

We retain personal data only for as long as required for its purpose or by statutory retention rules. It is then deleted or restricted.

17. No obligation to provide data

You may use this website without directly providing personal data. Certain details are required to arrange an appointment or provide treatment. No automated decision-making, including profiling, takes place.

18. Changes

We update this policy when applicable law or the services used on this website change. The current version applies whenever you visit.

Version: 13 August 2026