Privacy Policy

1. Controller

The controller responsible for data processing on this website and in the practice within the meaning of the General Data Protection Regulation (GDPR) is:

Dr. med. Thurid Regula Gridl
Specialist in Plastic and Aesthetic Surgery
Eilenriedeklinik Hannover
Lister Kirchweg 43
30163 Hanover, Germany
Phone: +49 160 5544 218
Email: praxis@dr-gridl.de

Further details about the practice can be found in the imprint.

2. Data protection officer

My practice is not required to appoint a data protection officer under Art. 37 GDPR in conjunction with Sec. 38 BDSG. Your contact for all data protection matters is Dr. med. Thurid Regula Gridl herself. You can reach me using the contact details given in section 1, in particular by email at praxis@dr-gridl.de.

3. Legal bases for processing

I process personal data only where there is a legal basis for doing so. Depending on the context, these are:

• Art. 6(1)(a) GDPR – your consent, for example where you send me documents unprompted.
• Art. 6(1)(b) GDPR – initiation and performance of the treatment contract.
• Art. 6(1)(c) GDPR – legal obligations, in particular documentation and retention duties.
• Art. 6(1)(f) GDPR – legitimate interest in the secure, stable and functional operation of this website.
• Art. 9(2)(h) GDPR in conjunction with Sec. 22(1) no. 1(b) BDSG – processing of health data for the purposes of medical treatment.

4. Hosting and server log files

This website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany). When the pages are accessed, technically necessary connection data is processed, without which the content could not be delivered:

• IP address of the requesting device
• date and time of access
• the address requested and the volume of data transferred
• referrer URL, browser type and operating system

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and reliable provision of the website and in defending against attacks. This data is not combined with other sources and is not used to build user profiles.

Cloudflare operates a global server network, which means processing may also take place in third countries, in particular the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; in addition, the European Commission's Standard Contractual Clauses apply. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.

5. Adobe Fonts

To display typefaces consistently, this website loads fonts from Adobe Fonts (Typekit). The provider is Adobe Inc., 345 Park Avenue, San Jose, CA 95110, USA; for Europe, Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland.

When a page is opened, your browser loads the required fonts directly from the servers at use.typekit.net and p.typekit.net. Your IP address is transmitted to Adobe in the process; according to Adobe, aggregated usage data on the fonts delivered is recorded. Adobe does not set any cookies on this website in this context.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in a consistent and accessible presentation of the content. For the transfer to the USA, Adobe relies on the EU-US Data Privacy Framework and the Standard Contractual Clauses. Further information: https://www.adobe.com/privacy/policy.html

6. Cookies and local storage

This website sets no cookies for analytics, advertising or tracking purposes. No statistics or audience measurement services, social media plugins or advertising networks are embedded.

Solely for the language switch, a single value is stored in your browser's local storage recording whether you have chosen the German or the English version of this website. This value contains no personal data, is not transmitted to me or to any third party and remains exclusively on your device. It is strictly necessary for the language choice you have expressly requested (Sec. 25(2) no. 2 TDDDG); Art. 6(1)(f) GDPR applies in addition. You can delete the value at any time via your browser settings.

7. Contact by email and telephone

If you contact me by email or telephone, I process the details you provide – such as your name, contact details and the content of your enquiry – solely in order to handle that enquiry and any follow-up questions relating to it.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is directed at a treatment contract, and otherwise Art. 6(1)(f) GDPR. Where you share health data with me, processing is based on Art. 9(2)(h) GDPR.

Please note that unencrypted email may be read by third parties in transit. I therefore recommend that you do not send sensitive health data by ordinary email, but discuss it by telephone or in person.

8. Contact via WhatsApp

This website contains a link that lets you start a WhatsApp conversation with the practice. The link itself establishes no connection – WhatsApp opens on your device only once you click it.

The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, a company of the Meta group. If you use this route, WhatsApp processes your phone number and the metadata of the communication under its own privacy terms, over which I have no influence: https://www.whatsapp.com/legal/privacy-policy-eur

Message content is end-to-end encrypted; connection data is not. I therefore expressly recommend that you do not send health data, findings or photographs via WhatsApp and use this channel only for organisational matters. The legal basis is your decision to use this route, Art. 6(1)(a) and (b) GDPR.

9. Online appointment booking

For appointment booking, this website links to an external booking system at onlinetermine.dr-gridl.de. Clicking “Book now” takes you away from this website; the data you enter there – such as name, contact details, preferred appointment and reason for the visit – is processed by the provider of the booking system on behalf of the practice.

The provider is pixelmedics (Borealys GmbH), Rue des Anciennes Postes 7, 1845 Noville, Switzerland. The software is also used to run the practice, so alongside booking data it may process treatment and billing data. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. The provider's privacy policy is available at https://pixelmedics.ch/pixelmedics-datenschutzerklarung

The provider is based in Switzerland. The European Commission has recognised Switzerland as offering an adequate level of data protection (adequacy decision under Art. 45 GDPR), so the transfer is permitted without additional safeguards.

The legal basis is Art. 6(1)(b) GDPR (initiation of the treatment contract), and additionally Art. 9(2)(h) GDPR for any health information. Booking data is transferred into the patient record once the appointment has taken place, or deleted as soon as it is no longer needed for scheduling.

10. Patient data in the practice

In the course of treatment I process the data required for diagnosis, consultation, treatment and aftercare. This includes master data, medical history and pre-existing conditions, findings, photographic documentation, treatment and surgical reports, and billing data.

The legal basis is Art. 9(2)(h) GDPR in conjunction with Sec. 22(1) no. 1(b) BDSG as well as Art. 6(1)(b) and (c) GDPR. The duty to document follows from Sec. 630f of the German Civil Code (BGB) and professional regulations; under Sec. 630f(3) BGB, treatment records must generally be retained for ten years after the conclusion of treatment, and in individual cases other provisions require longer periods.

My team and I are bound by medical confidentiality under Sec. 203 of the German Criminal Code (StGB) and by the professional code of the Ärztekammer Niedersachsen (Medical Association of Lower Saxony). Your data is disclosed only where you have consented, where I am legally obliged to do so, or where disclosure is necessary for your treatment and covered by your consent.

Competent chamber: Ärztekammer Niedersachsen (Medical Association of Lower Saxony), Berliner Allee 20, 30175 Hannover. Competent supervisory authority: Gesundheitsamt der Region Hannover (public health authority, Hanover region), Weinstrasse 2, 30159 Hanover. Professional title: Ärztin (physician), awarded in the Federal Republic of Germany. The following professional regulations apply in particular:

• Bundesärzteordnung (BÄO) – German Federal Medical Practitioners Act
• Kammergesetz für die Heilberufe (HKG) of the State of Lower Saxony
• Berufsordnung der Ärztekammer Niedersachsen – professional code of the Medical Association of Lower Saxony

The versions currently in force can be consulted on the website of the Ärztekammer Niedersachsen.

11. Recipients of data

Your data may be transmitted – in each case only to the extent necessary – to the following recipients:

• co-treating and referring physicians, hospitals, anaesthesia and pathology services, where you have agreed
• laboratories carrying out tests commissioned by me
• your private health insurer or public-sector reimbursement office, where you submit invoices there
• IT service providers maintaining practice software or systems on my behalf – in particular pixelmedics (Borealys GmbH) as the provider of the practice and appointment management system (see section 9); data processing agreements pursuant to Art. 28 GDPR are in place with them
• authorities and public bodies, where there is a statutory obligation to transmit data

12. Links to social networks

In the footer of this website you will find links to the practice's profiles on Instagram and LinkedIn. These are plain hyperlinks, not embedded content or plugins. Merely opening this website transmits no data whatsoever to the operators of these networks.

Only when you click one of these links does your browser establish a connection to the network in question, and that network's privacy terms then apply. The providers are Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (Instagram) and LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

13. Retention periods

I store personal data only for as long as it is required for the respective purpose or as statutory retention periods demand. In concrete terms:

• treatment records: as a rule ten years after the conclusion of treatment (Sec. 630f(3) BGB), unless a longer period applies
• billing and tax-relevant documents: six or ten years respectively under Sec. 257 HGB and Sec. 147 AO
• enquiries not followed by treatment: deleted once the matter is closed and no retention obligation applies
• server log files: stored briefly by the host for security purposes

14. Your rights

You have the following rights vis-à-vis the controller:

• access to the data processed about you (Art. 15 GDPR)
• rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
• erasure, unless a statutory retention obligation stands in the way (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on a legitimate interest (Art. 21 GDPR)

You may withdraw consent you have given at any time with effect for the future; this does not affect the lawfulness of processing carried out up to that point. An informal message to the contact details above is sufficient to exercise your rights.

Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority for the practice is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
poststelle@lfd.niedersachsen.de

15. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Your data is neither evaluated for advertising purposes nor passed to third parties for such purposes.

16. Encryption

For security reasons, this website uses TLS encryption throughout. You can recognise this by the address bar of your browser beginning with “https://” and by the padlock symbol. Content you transmit to this website therefore cannot be read by third parties.

17. Note on generated imagery

The imagery shown on this website is illustrative and has in part been generated or edited with the support of AI; the delivered image files are marked accordingly. These are not treatment results and not photographs of patients. No personal data is processed as a result.