Last updated: 28 June 2026. This privacy policy informs you about the nature, scope and purpose of the processing of personal data on hno-ruesselsheim.de (Art. 13 GDPR). The legally binding version is the German one; this English text is provided for your convenience.
1. Controller
Muzaffer Balaban, Specialist in Ear, Nose and Throat Medicine (ENT)
HNO-Praxis Muzaffer Balaban
Liebigstraße 2, 65428 Rüsselsheim am Main, Germany
Phone: +49 6142 57243 · Email: mail@hnoruesselsheim.de
Data Protection Officer: The appointment of a data protection officer is not mandatory for our practice under Section 38 of the German Federal Data Protection Act (BDSG) in conjunction with Art. 37 GDPR, since neither the threshold of 20 persons regularly engaged in automated data processing is reached, nor does extensive processing of special categories of personal data constitute a core activity within the meaning of Art. 37(1)(c) GDPR. For any data protection matters, please contact the address stated above directly.
2. General information on data processing
We process our users’ personal data only insofar as this is necessary to provide a functional website along with our content and services. As a rule, personal data is processed only with the user’s consent or in cases where prior consent cannot be obtained for factual reasons and the processing is permitted by law.
3. Provision of the website and server log files
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device: IP address, date and time of access, URL accessed, volume of data transferred, HTTP status code, referrer URL, browser and operating system used. This data is stored in log files to ensure the functionality of the website and the security of our IT systems. The legal basis is Art. 6(1)(f) GDPR. The logs are anonymised or deleted after 14 days at the latest.
Hosting and data processing on our behalf: The website is operated and maintained on our behalf by Marco Stankowitz, an IT service provider based in Germany, acting as a processor within the meaning of Art. 28 GDPR on the basis of a data processing agreement concluded with us. The servers are located at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in German data centres (Falkenstein, Nuremberg). Hetzner has been approved by us as a sub-processor; a corresponding data processing agreement between Marco Stankowitz and Hetzner is in place. No transfer to third countries takes place.
4. Contact by email or telephone
If you contact us by email or telephone, the personal data you provide (name, address, telephone number, content of your enquiry, health-related information) is stored and processed to handle your request. Legal basis: Art. 6(1)(b) GDPR (initiation of a treatment contract) and Art. 9(2)(h) GDPR (health care). Providing your data is necessary to process your enquiry and initiate a treatment contract; without the required information we cannot respond to your request. The data is deleted as soon as it is no longer required to achieve its purpose; statutory retention obligations (e.g. Section 630f of the German Civil Code (BGB): patient records for 10 years) remain unaffected.
5. Online appointment booking via Doctolib
Our website includes links to online appointment booking with the external service provider Doctolib GmbH (Mehringdamm 51, 10961 Berlin, Germany). When you click an appointment button, you leave our website and are redirected to Doctolib. From that point on, Doctolib’s privacy terms apply: doctolib.de/terms/agreement. No data is transferred to Doctolib through the link on our own website. Legal basis for the link: Art. 6(1)(f) GDPR (legitimate interest in modern appointment scheduling).
6. Contact via WhatsApp
As an additional, voluntary means of contact — in particular for private patients — we offer contact via the messaging service WhatsApp. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a company of Meta Platforms, Inc. (1601 Willow Road, Menlo Park, CA 94025, USA).
Our website contains no WhatsApp widget and no tracking pixel, merely a referral button. When you click it, an information dialog appears first; only after your express confirmation do you leave our website and get redirected to WhatsApp. Simply visiting our website therefore does not transfer any data to WhatsApp or Meta.
If you contact us via WhatsApp, we process the data you transmit (in particular your mobile number, your profile name and the content of your message) to handle your request. In addition, Meta independently processes connection and metadata when WhatsApp is used (e.g. time of the message, device and connection information). We have no influence over this processing by Meta; WhatsApp’s privacy policy applies: whatsapp.com/legal/privacy-policy-eea.
The legal basis for processing by us is Art. 6(1)(b) GDPR (initiation or performance of a treatment contract) as well as your consent under Art. 6(1)(a) GDPR, which you grant by actively contacting us. By using WhatsApp you also consent, pursuant to Art. 49(1)(a) GDPR, to the associated transfer of your data to the USA (see Section 8).
Important note on health data: Please do not send us any sensitive health data via WhatsApp (e.g. diagnoses, findings, symptoms or medical histories). Even though message contents are end-to-end encrypted, WhatsApp is not suitable for transmitting special categories of personal data within the meaning of Art. 9 GDPR. For such information, please use the telephone, postal mail or contact us in person at the practice.
The use of WhatsApp is voluntary. You can of course also reach us without WhatsApp by telephone (+49 6142 57243), by email or in person; you will suffer no disadvantage as a result. You may withdraw any consent granted at any time with effect for the future by ceasing communication via WhatsApp and informing us accordingly. We delete conversations conducted via WhatsApp as soon as they are no longer required to achieve their purpose; statutory retention obligations remain unaffected.
7. Cookies, analytics, external resources
Our website uses exclusively technically necessary cookies within the meaning of Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). No analytics, marketing or tracking cookies are used.
| Cookie | Purpose | Storage period | Provider |
|---|---|---|---|
pll_language | Stores the language setting chosen by the visitor (German/English/Turkish) | 1 year | Polylang (local WordPress plugin, no external server) |
Fonts (Inter) are served exclusively from our own server — no requests to Google Fonts. No content delivery network is interposed that would forward user data to third parties.
8. Transfer to third countries and automated decision-making
Transfer to third countries: As a rule, no transfer of your personal data to countries outside the European Union or the European Economic Area takes place. An exception applies solely if you voluntarily and actively use our WhatsApp contact (see Section 6): in that case, data is transferred to the USA by the provider Meta. For this transfer, Meta relies on the European Commission’s adequacy decision regarding the EU-US Data Privacy Framework (Art. 45 GDPR) and, additionally, on standard contractual clauses (Art. 46(2) GDPR); the transfer is also based on your explicit consent (Art. 49(1)(a) GDPR). Nevertheless, a level of data protection fully equivalent to European law cannot be guaranteed in every case in the USA. If you do not use WhatsApp, no transfer to third countries takes place.
Automated decision-making and profiling: We do not use any automated decision-making within the meaning of Art. 22 GDPR. No profiling takes place.
9. Your rights (Art. 15–22 GDPR)
You have the following rights vis-à-vis us:
- Right of access to your stored data (Art. 15 GDPR)
- Right to rectification of inaccurate data (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
To exercise your rights, please contact the address stated in Section 1.
10. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:
The Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit)
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
datenschutz.hessen.de