Datenschutz

PRIVACY POLICY

English translation – for information only

The following English text is provided solely as a convenience translation. In the event of any discrepancies, ambiguities or differences in interpretation, the German version of this Privacy Policy shall be authoritative.

CONTROLLER

The controller responsible for the processing of personal data on this website is:

Panchasana®
Centre for Modern Tibetan Healing

Ralf Nusch
Heilpraktiker (German non-medical practitioner)

Jülicher Str. 4
50189 Elsdorf-Oberembt
Germany

Phone: +49 2274 903 904 7
Email: zentrum@panchasana.de

GENERAL INFORMATION ON DATA PROTECTION

The protection of your personal data is important to us. We treat personal data confidentially and in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), as well as this Privacy Policy.

Personal data means any information relating to an identified or identifiable natural person.

We process personal data only insofar as this is necessary for the operation of our website, communication with you, appointment scheduling, the provision of our services, our therapeutic activities or compliance with legal obligations.

LEGAL BASES FOR PROCESSING

Depending on the type of processing, personal data is processed in particular on the basis of:

Article 6(1)(a) GDPR – consent

Article 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract

Article 6(1)(c) GDPR – compliance with a legal obligation

Article 6(1)(f) GDPR – legitimate interests

Where special categories of personal data are processed, in particular health data, such processing takes place only on the basis of a lawful basis under Article 9 GDPR.

WEBSITE HOSTING

Our WordPress website is hosted by Host Europe.

When you access our website, technically necessary data may be processed by the hosting provider.

This may include in particular:

IP address
date and time of access
requested page or file
amount of data transferred
browser type and browser version
operating system
referrer URL
hostname of the accessing device

This processing is carried out to ensure the secure, stable and error-free provision of our website and to protect against misuse or unlawful access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our website.

SSL/TLS ENCRYPTION

For security reasons, this website uses SSL or TLS encryption.

You can generally identify an encrypted connection by the fact that the browser address begins with “https://”.

This helps protect data that you transmit to us during transmission.

COOKIES AND CONSENT MANAGEMENT

Our website uses cookies and comparable technologies.

Technically necessary cookies may be used where they are required to provide the website and functions expressly requested by you.

Non-essential cookies or external services are generally activated only after you have given your consent.

The legal basis for storing information on or accessing information from your device is governed by the applicable provisions of German telecommunications and digital services law. Where personal data is subsequently processed, this is carried out on the applicable legal basis under the GDPR.

BORLABS COOKIE

We use Borlabs Cookie on this website to manage your consent choices.

Provider:
Borlabs GmbH
Germany

Borlabs Cookie places a technically necessary cookie called “borlabs-cookie”.

This cookie stores, in particular, your consent decisions so that the website can recognise which services you have accepted or rejected.

You can change or withdraw your consent choices at any time via the cookie settings on our website.

If you delete the Borlabs cookie in your browser, your stored selection will also be deleted and you will be asked again for your choices when you next visit the website.

CONTACTING US

If you contact us by email, telephone or by another method, we process the data you provide in order to handle your enquiry.

This may include in particular:

name
email address
telephone number
content of your message
other information provided voluntarily

The legal basis is Article 6(1)(b) GDPR where your enquiry relates to treatment, an appointment or another contractual relationship.

In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in handling and responding to your enquiry.

CONTACT FORM USING JOTFORM

We use Jotform for our contact form.

Personal data may be transmitted to us through the form.

This may include the information you enter, such as:

name
email address
telephone number
message and enquiry
other information provided voluntarily

The data submitted is used to process your enquiry and, where applicable, to prepare a consultation or treatment.

Jotform is used as a technical service provider.

Where required, processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.

Please do not send medical or particularly sensitive information through a general contact form unless it is necessary for your enquiry.

Where health data is processed in connection with a medical enquiry, such processing is carried out only on the basis of a lawful basis under Article 9 GDPR.

ONLINE APPOINTMENT BOOKING WITH ZEEG

We use Zeeg for online appointment scheduling.

When you book an appointment through our website, the personal data required for the booking is processed.

This may include in particular:

name
email address
telephone number
selected appointment
type of service booked
appointment location
information you voluntarily provide during the booking process

Processing is carried out in order to take steps prior to entering into a contract and to organise the appointment you have requested, on the basis of Article 6(1)(b) GDPR.

Where Zeeg processes personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.

APPOINTMENT MANAGEMENT WITH AMELIA

We may use the WordPress plugin Amelia to manage and organise appointments.

In connection with appointment booking or administration, the following personal data may be processed in particular:

name
email address
telephone number
service booked
date and time of appointment
other information provided by you

Processing is carried out to organise, administer and provide appointments on the basis of Article 6(1)(b) GDPR.

Booking data collected via Amelia is generally processed within our WordPress installation or the technical infrastructure used by us.

Where external services or integrations are used within Amelia, additional data processing may take place.

ONLINE PAYMENTS WITH STRIPE

We use Stripe to process online payments.

Depending on the payment transaction, the following data may be processed in particular:

name
email address
billing information
payment amount
selected payment method
transaction data
technical information relating to the payment process

Processing is carried out for the performance and handling of the relevant contract or payment transaction on the basis of Article 6(1)(b) GDPR.

In addition, statutory retention and documentation obligations may apply.

Depending on the specific processing activity, Stripe may process personal data partly as a processor and partly under its own responsibility as a controller.

Further details on data processing can be found in the relevant payment provider’s privacy information.

WOOCOMMERCE

We use WooCommerce for certain ordering, sales or payment processes.

In connection with an order, the following data may be processed in particular:

name
billing address
shipping address, where applicable
email address
telephone number
order information
products or services selected
payment status
technical information relating to the order process

Processing is carried out for the performance and fulfilment of orders and contracts on the basis of Article 6(1)(b) GDPR.

Certain data may also be stored due to statutory commercial or tax retention obligations. The legal basis for this is Article 6(1)(c) GDPR.

Depending on the WooCommerce extensions used, personal data may be transmitted to additional service providers, for example payment, shipping or billing providers.

OUR OWN DIGITAL APPLICATIONS

We develop and operate our own digital applications that support our work, in particular in the areas of medical history, constitution assessment, consultation, diagnostics, treatment planning and patient support.

These include, for example, applications such as heilpraxis.app as well as other digital applications developed by Panchasana.

Depending on the application, the following data may be processed in particular:

patient ID
user account and access data
information from questionnaires and medical histories
constitutional data
appointment and treatment information
laboratory and measurement data
therapy information
progress data
information entered by the user
where applicable, health data and other special categories of personal data

The exact data processed depends on the particular application and its function.

Processing is carried out in particular for pre-contractual measures, the provision of the services requested by you and within the scope of our therapeutic activities.

BASE44

Some of our own digital applications are developed and operated using the Base44 development and hosting platform.

These include, for example, internal and patient-related applications such as heilpraxis.app as well as other digital applications developed by Panchasana.

Our applications are configured as private and access-protected applications.

In addition, we use our own security and authorisation concepts to restrict access to personal and medical information to authorised persons.

Where technically and contractually available, the applications used by us are operated with a European data location.

Base44 provides technical security measures such as encrypted data transmission, encryption of stored data, access controls and security checks.

Where Base44 processes personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.

Where data is processed outside the European Union or the European Economic Area, this takes place only in accordance with the requirements of Articles 44 et seq. GDPR and with the safeguards provided for by law.

PSEUDONYMISATION OF PATIENT DATA

To protect particularly sensitive patient data, we use our own pseudonymisation concept within our digital applications.

Medical and treatment-related data in the relevant applications is generally stored under a patient ID and is not stored directly together with the patient’s name.

This may include in particular:

medical history data
constitutional data
laboratory and measurement values
findings
therapy information
progress data
other medical information

The link between the patient ID and the relevant individual is managed separately from the medical data itself.

This significantly reduces the risk of directly associating stored medical information with a particular person.

Information required for re-identification is accessible only to authorised persons.

For data protection purposes, such data is considered pseudonymised rather than fully anonymised where re-identification remains possible in principle.

HEALTH DATA

In the course of our therapeutic activities, we may process health data within the meaning of Article 9 GDPR.

This may include in particular:

information concerning symptoms and previous illnesses
medication
laboratory and measurement values
information concerning physical or psychological condition
medical history information
constitutional data
diagnostic findings
therapy and progress information

Such data is processed only to the extent necessary for the requested or provided consultation, diagnostic process or treatment and where such processing is legally permitted.

Health data is treated by us with particular confidentiality.

Access is restricted to those persons and technical systems that require access for the relevant task.

Data is disclosed only where there is a legal basis, where this is necessary to provide a service requested by you or where you have expressly consented.

PCLOUD

We use pCloud for the secure storage, transfer and backup of certain documents and files.

We use a European data location for this purpose.

Depending on the purpose, the following data may be stored there in particular:

documents
medical records
laboratory and diagnostic documents
internal practice documents
backup files
other treatment-related documents

Where provided for, personal or medical documents are additionally encrypted or stored in protected storage areas.

For particularly sensitive data, encrypted storage areas or additional client-side encryption methods may be used.

Access to the storage areas used by us is restricted to authorised persons.

Where pCloud processes personal data on our behalf, its use is subject to the applicable data protection requirements and, where required, a data processing agreement pursuant to Article 28 GDPR.

Processing is carried out in particular for the secure storage, provision, transfer and backup of documents in connection with our activities.

Depending on the type of data, the legal basis is Article 6(1)(b), (c) or (f) GDPR and, in the case of health data, an applicable legal basis under Article 9 GDPR.

STORAGE PERIOD

We store personal data only for as long as is necessary for the relevant processing purpose.

In addition, statutory retention periods may apply.

Once the purpose of processing no longer applies and any statutory retention periods have expired, the data is deleted unless another legal basis permits further storage.

RECIPIENTS OF PERSONAL DATA

In order to provide our services, we may use service providers that process personal data on our behalf.

These may include in particular:

hosting providers
IT and website service providers
form providers
appointment booking providers
payment service providers
email and communication service providers
cloud and storage providers
providers of our digital applications

Where these companies process personal data on our behalf, appropriate data processing agreements pursuant to Article 28 GDPR are concluded where required.

TRANSFERS TO THIRD COUNTRIES

We prefer services where personal data is processed within the European Union or the European Economic Area.

Where processing outside the European Union or the European Economic Area cannot be excluded for individual service providers, such transfers take place only in accordance with the legal requirements of Articles 44 et seq. GDPR.

This may be based, in particular, on an adequacy decision of the European Commission or appropriate safeguards such as the EU Standard Contractual Clauses.

YOUR RIGHTS

Subject to the legal requirements, you have in particular the following rights:

right of access under Article 15 GDPR

right to rectification under Article 16 GDPR

right to erasure under Article 17 GDPR

right to restriction of processing under Article 18 GDPR

right to data portability under Article 20 GDPR

right to object under Article 21 GDPR

right to withdraw consent under Article 7(3) GDPR

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

RIGHT TO OBJECT

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object to such processing at any time.

RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

You have the right to lodge a complaint with a data protection supervisory authority concerning the processing of your personal data.

For North Rhine-Westphalia, the competent authority is in particular:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

SECURITY

We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access or other unlawful processing.

Depending on the relevant system, these measures include in particular:

encrypted data transmission
access restrictions
user and authorisation concepts
private applications
pseudonymisation
separate storage of identification and health data
encrypted storage areas
regular backups
technical and organisational access controls

Our security measures are reviewed and adapted in accordance with technological developments and the level of protection required by the data processed.

CHANGES TO THIS PRIVACY POLICY

We reserve the right to amend this Privacy Policy if our website, digital applications, services used or legal requirements change.

The current version published on this website shall apply.

Last updated: September 2026

Nur was nötig ist

PANCHASANA®

ZENTRUM FÜR MODERNE TIBETISCHE HEILKUNDE