The protection of your personal data is important to us. In accordance with the General Data Protection Regulation (GDPR), we provide the following information regarding the processing of personal data when you use this website and our services. Services that require consent will only be activated after you have given your consent via our consent banner (Cookiebot).

1. Data Controller

MY HEALTH & BEAUTY Clinic GmbH, Kamekestraße 21, 50672 Cologne. Represented by Managing Director Michael Auf der Mauer. Phone: 0221 29240403, Email: info@myhb.app. If you have any questions regarding data protection, please contact us at info@myhb.app.

2. Legal Basis for Processing

We process personal data based on your consent (Art. 6(1)(a) GDPR), to fulfill a contract or pre-contractual measures (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), and to protect legitimate interests (Art. 6(1)(f) GDPR). We process health data for the purpose of medical treatment pursuant to Art. 9(2)(h) GDPR in conjunction with § 22 BDSG or based on your explicit consent (Art. 9(2)(a) GDPR). Our physicians are bound by medical confidentiality.

3. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing (Art. 21 GDPR). You may withdraw any consent you have given at any time with future effect. You also have the right to lodge a complaint with a supervisory authority, in particular with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

4. Website Provision and Hosting

When you access the website, information is automatically stored in server log files (including IP address, date/time, page accessed, browser type, operating system) in order to deliver the website and ensure its security (Art. 6(1)(f) GDPR). Hosting is provided by Vercel Inc. (U.S.); content and media are additionally delivered via Cloudflare, Inc. (U.S.). Data processing agreements are in place; data transfers to the U.S. are safeguarded by appropriate safeguards (Standard Contractual Clauses or the EU-U.S. Data Privacy Framework).

5. Cookies and Consent Management (Cookiebot)

To obtain and manage your consent, we use the Cookiebot consent management platform provided by Cybot A/S (Havnegade 39, 1058 Copenhagen, Denmark; part of the Usercentrics Group). Cookiebot stores your consent decision and processes data for this purpose, such as an anonymized IP address, the time of consent, browser information, and a consent key (Consent ID). We set technically necessary cookies based on Section 25(2) of the TDDDG; cookies and technologies requiring consent are used only with your consent (Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR). You can revoke your consent at any time via the Cookiebot banner.

6. Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to manage website tags. Google Tag Manager itself does not set any cookies and does not collect any personal data for analytical purposes; its purpose is to deliver other services—only after you have given your consent.

7. Contacting Us

If you contact us by email or phone, we process your information to handle your inquiry (Art. 6(1)(b) or (f) of the GDPR). The data will be deleted as soon as it is no longer needed and there are no retention obligations that prevent this.

8. Customer Communication via Messenger (Superchat)

To communicate with prospective and existing customers via messaging and chat channels (e.g., WhatsApp, SMS, email), we use the Superchat platform provided by Superchat GmbH (Torstraße 19, 10119 Berlin). The data processed in this context (e.g., name, contact information, message content) is used to handle your inquiry and for customer communication. The legal basis is Art. 6(1)(b) or (f) of the GDPR; for communication via WhatsApp, your consent also applies (Art. 6(1)(a) of the GDPR). We have a data processing agreement in place with Superchat. When using WhatsApp, data may be transferred to the Meta corporate group (including to the U.S.).

9. Appointment Scheduling (Calendly)

We use Calendly (Calendly LLC, USA) for online appointment scheduling. Data processed during the booking process (e.g., name, contact information, preferred appointment time) is used to facilitate the appointment (Art. 6(1)(b) GDPR). Transfers to the U.S. are safeguarded by appropriate safeguards (Standard Contractual Clauses or the Data Privacy Framework).

10. Treatment and Health Data

As part of a consultation or treatment, we process the necessary data, including health data, for the purpose of preventive care and treatment (Art. 9(2)(h) GDPR in conjunction with § 22 BDSG) as well as to fulfill statutory documentation and retention obligations (including § 630f BGB, professional code of conduct). Medical confidentiality is maintained.

11. Web Analytics (Google Analytics)

If you have given your consent, we use Google Analytics (GA4), a web analytics service provided by Google Ireland Limited. This involves the use of cookies and similar technologies and the processing of usage information (including a truncated IP address), in part on Google’s servers in the United States. The legal basis is your consent (Art. 6(1)(a) of the GDPR); transfers to the U.S. are safeguarded by the EU-U.S. Data Privacy Framework or standard contractual clauses. You may withdraw your consent at any time via the cookie settings.

12. Google Ads (Conversion Tracking and Remarketing)

If you have given your consent, we use Google Ads (Google Ireland Limited) to measure the effectiveness of our advertising (conversion tracking) and for remarketing. In doing so, cookies may be set and usage data may be transmitted to Google (including to the U.S.) in order to display interest-based advertising to you and to measure campaign success. The legal basis is your consent (Art. 6(1)(a) GDPR); transfers to the U.S. are based on the DPF or standard contractual clauses.

13. Meta Pixel (Facebook and Instagram)

If you have given your consent, we use the Meta Pixel from Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin, Ireland). This allows us to measure the effectiveness of our advertising on Facebook and Instagram and to display targeted ads to you. In this process, information about your use of the website is transmitted to Meta and may be associated with your Meta account. We and Meta are joint controllers for the collection and transmission of the data (Art. 26 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR); data may be transferred to the U.S. (DPF or Standard Contractual Clauses).

14. TikTok Pixel

If you have given your consent, we use the TikTok pixel from TikTok Technology Limited (Ireland) or its affiliated companies to measure and optimize our TikTok advertising. In doing so, usage data is processed and transmitted to TikTok, which may involve transfers to third countries (including those outside the EU). The legal basis is your consent (Art. 6(1)(a) GDPR); transfers to third countries are safeguarded by standard contractual clauses.

15. Maps (Google Maps)

To display location maps, we use Google Maps (Google Ireland Limited) with your consent. Your IP address may be transmitted to Google in this process. The legal basis is Article 6(1)(a) of the GDPR.

16. Newsletter (Mailchimp)

To send our newsletter, we use the Mailchimp service provided by Intuit Inc. / The Rocket Science Group LLC (Atlanta, USA). When you subscribe to the newsletter, we process your email address and, if applicable, any additional voluntary information; registration is carried out via a double opt-in process. Mailchimp also analyzes usage data (e.g., open and click-through rates) to optimize the distribution of the newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR). We have a data processing agreement in place with Mailchimp; data transfers to the U.S. are safeguarded by the Data Protection Framework (DPF) or standard contractual clauses. You can unsubscribe from the newsletter at any time using the unsubscribe link.

17. Social Media Presence

We are active on social media platforms (including Facebook, Instagram, LinkedIn, and TikTok). When you visit these profiles, the privacy policies of the respective providers also apply. Our website merely includes links to these profiles; data is not transferred to the platforms until you click on the links.

18. Online Store

Separate privacy notices apply to our online store (shop.myhealthandbeauty.com), which are provided within the store.

19. Data Transfer to Third Countries

To the extent that data is transferred to service providers in third countries (in particular the U.S.), this occurs only where an adequate level of data protection is ensured—for example, through certification under the EU-U.S. Data Privacy Framework or through EU Standard Contractual Clauses. The former “EU-US Privacy Shield” is no longer a valid basis and does not apply.

20. Retention Period

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods (e.g., commercial and tax law deadlines, retention obligations for patient records). Afterward, the data is deleted or blocked.

21. Up-to-Date Status and Changes

This Privacy Policy will be updated as necessary to reflect changes in the legal landscape or changes to our services. The version published on this page is the current one.