Skip to content
EN
Back to the home page

Privacy policy

This English translation is provided for information only. The German version is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation is:

Stefan Konstantinov

GP practice

Pontchateau-Platz 1

56377 Nassau

Germany

Telephone: +49 2604 1577

Fax: +49 2604 943399

Email: [email protected]

Email is not end-to-end encrypted and is sent at your own risk.

2. Data protection contact

Stefan Konstantinov is responsible for data protection. Please direct any data protection questions to the contact details given in section 1.

3. General information about the website

This website is provided as static HTML. The website itself does not use cookies and does not store any information in the localStorage of your device. Cloudflare is used to secure the website and may set technically necessary cookies. Please see section 5. No tracking or analytics services are used. There are no contact forms or embedded Google services. The fonts used are provided locally.

Apart from the technically necessary Cloudflare cookies described in section 5, no information is stored on your device and no information already stored on your device is accessed. § 25 TDDDG remains applicable to third-party services where, following active consent from the visitor, they store information on the device or access information already stored on it.

4. Hosting

The content of this website is hosted by webgo GmbH, Wendenstraße 8-12, 20097 Hamburg. The provider collects log files including IP addresses. These also include the date and time of access, the page accessed, the page previously visited, known as the referrer, and the browser used.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the reliable and secure presentation of the website. A data processing agreement has been concluded. The data is stored for as long as the purpose of processing exists. Following a request for erasure or an objection, it is deleted unless statutory retention periods or overriding legitimate grounds prevent this.

5. DNS, security and delivery through Cloudflare

This website uses Cloudflare as a DNS service, CDN and proxy to protect it against attacks, prevent misuse and deliver its content quickly. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare answers DNS queries for the domain of this website. All requests to the website are routed through Cloudflare servers.

The data technically required to process the request is handled, in particular your IP address, the date and time, the page accessed, browser and system information, and security-related features of the request. This data is stored in Cloudflare's infrastructure. Cloudflare may set technically necessary cookies to detect automated access, for example "__cf_bm" with a duration of 30 minutes or "cf_clearance" following a security check. These cookies are used exclusively for security and contain no tracking information.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure, stable and fast provision of the website. Technically necessary cookies are set on the basis of § 25(2)(2) TDDDG.

Cloudflare is certified under the EU-US Data Privacy Framework. Transfers to the USA are based on the European Commission's adequacy decision pursuant to Art. 45 GDPR. Further information is available in Cloudflare's Privacy Policy.

6. Contact by email and telephone

If you contact us by email or telephone, the data you provide will be processed to deal with your request. This applies in particular to requests concerning prescriptions, referrals and appointments, and to enquiries about the medical second opinion and discussion of medical findings for expats. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a treatment contract or pre-contractual measures. For general enquiries, the legal basis is Art. 6(1)(f) GDPR. The legitimate interest is responding to your enquiry. Where health data is processed, processing is based on Art. 9(2)(h) GDPR in conjunction with § 22(1)(1)(b) BDSG.

We store emails and the information they contain only for as long as required for the purpose of processing. For an enquiry, this means until it has been fully dealt with. We then delete the message unless statutory retention obligations apply or we need it for the establishment, exercise or defence of legal claims (Art. 17(3)(b) and (e) GDPR).

We add content that is essential for treatment to the treatment record. We keep the treatment record for ten years after the end of treatment pursuant to § 630f(3) of the German Civil Code (BGB) and § 10(3) of the Code of Professional Conduct, unless other provisions set different retention periods. Messages that must be kept under commercial or tax law are subject to the periods prescribed there.

Processing is carried out in compliance with medical confidentiality.

Ordinary email is not end-to-end encrypted. It is not possible to tell which route a message takes or who may be able to read it along the way. Email is sent at your own risk. You should therefore not send confidential health information by email. Please use the telephone or post for confidential information or discuss it in person at the practice.

7. External links to Google

The website contains external links to Google Maps for route planning and to the practice's Google Business Profile with its reviews. Google services are not embedded in this website and no Google API is used. No connection to Google is established before you click such a link.

If you click a Google link, the destination page opens in a new window. Technically necessary connection data, in particular your IP address, is then transferred to Google. From that point onwards, Google is independently responsible for processing there. Details can be found in Google's Privacy Policy.

The reviews reproduced on this website are selected reviews published publicly on Google. They are shown using the reviewer's first name and the initial of their surname. No data is retrieved from Google for this purpose.

8. Optional OpenStreetMap map

An optional OpenStreetMap map is not loaded automatically. An iframe from openstreetmap.org is loaded only after you actively consent. Your IP address is then transferred to the OpenStreetMap Foundation in the United Kingdom.

The legal basis for activation and the associated data transfer is your consent pursuant to Art. 6(1)(a) GDPR. Where the OpenStreetMap Foundation stores information on your device or accesses information already stored on it, consent is also given on the basis of § 25(1) TDDDG. You can withdraw your consent with effect for the future by not activating the map when you visit the page again. The lawfulness of processing carried out before consent was withdrawn remains unaffected.

The United Kingdom is covered by a European Commission adequacy decision. Further information is available in the OpenStreetMap Foundation Privacy Policy.

9. Recipients and categories of recipients

The recipients of personal data are webgo GmbH in connection with hosting and Cloudflare, Inc. in connection with DNS, security and delivery. Emails to the practice are processed by the provider of its mailbox. If you actively consent to the optional map, the OpenStreetMap Foundation receives the connection data required to retrieve it. If you click an external Google link, Google receives the required connection data.

10. Transfers to third countries

Whenever the website is accessed, the data listed in section 5 is transferred to Cloudflare, including to the USA. The basis for this transfer is Cloudflare's certification under the EU-US Data Privacy Framework and the European Commission's adequacy decision pursuant to Art. 45 GDPR.

After you actively consent, the optional OpenStreetMap map transfers data to the United Kingdom. This transfer is covered by the European Commission's adequacy decision pursuant to Art. 45 GDPR.

After you click a Google link, data may be transferred to Google LLC in the USA. The basis is certification under the EU-US Data Privacy Framework and the European Commission's adequacy decision pursuant to Art. 45 GDPR.

If you contact us from a country outside the European Union or the European Economic Area and we reply to you there, your data reaches that country. Where no adequacy decision exists for that country, the transfer is based on Art. 49(1)(b) GDPR because it is necessary for the performance of the contract or for pre-contractual measures taken at your request. The level of data protection in such countries may be lower.

11. Storage period

Personal data from contact enquiries is stored only for as long as required to deal with the request and for the associated treatment and administrative purposes. It is then deleted unless statutory retention obligations or legitimate grounds for further storage apply. Details on emails can be found in section 6.

Server log files and security data held by webgo and Cloudflare are stored for as long as the purpose of processing stated in sections 4 and 5 exists. Following a request for erasure or an objection, they are deleted unless statutory retention periods or overriding legitimate grounds prevent this. Cloudflare cookies expire automatically after a short period. Data processed by the relevant external provider after you actively consent to the OpenStreetMap map or click a Google link is subject to that provider's own deletion and retention rules.

12. SSL and TLS encryption

This website uses HTTPS with SSL or TLS encryption. This protects data transmitted between your browser and the server while it is in transit.

13. Rights of data subjects

Subject to the statutory requirements, you have the following rights in particular:

  • right of access pursuant to Art. 15 GDPR,
  • right to rectification pursuant to Art. 16 GDPR,
  • right to erasure pursuant to Art. 17 GDPR,
  • right to restriction of processing pursuant to Art. 18 GDPR,
  • right to be informed in connection with rectification, erasure or restriction pursuant to Art. 19 GDPR,
  • right to data portability pursuant to Art. 20 GDPR,
  • right to object pursuant to Art. 21 GDPR.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future pursuant to Art. 7(3) GDPR. The lawfulness of processing carried out before consent was withdrawn remains unaffected.

To exercise your rights, you can contact the controller using the contact details given in section 1.

14. Right to object

Pursuant to Art. 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you where that processing is based on Art. 6(1)(e) or (f) GDPR. The data will then no longer be processed unless compelling legitimate grounds for the processing can be demonstrated which override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

15. Right to lodge a complaint with the supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for the practice is:

Rhineland-Palatinate Commissioner for Data Protection and Freedom of Information

Hintere Bleiche 34

55116 Mainz

Telephone: 06131 8920-0

Fax: 06131 8920-299

Email: [email protected]

16. Date

Last updated: October 2026