Privacy Policy

Last updated: 19 August 2026

1. Controller

HM Medical Hair UG (haftungsbeschränkt)
Wallrafplatz 2–4, 50667 Cologne, Germany
Second location: Harscampstr. 81, 52062 Aachen, Germany
Managing Director: Daniela Freesemann
Medical Director: Dr Zeynalova
Phone: +49 163 78 92 490
E-mail: info@hm-hairmedical.de

We have not appointed a data protection officer, as the statutory thresholds under section 38 BDSG are not currently met. For any privacy question, please use the contact details above.

2. Principles and categories of data

We process personal data solely on the basis of the GDPR, the German Federal Data Protection Act and the rules applicable to healthcare professions. Depending on the occasion, we process:

• Basic data: name, form of address
• Contact data: phone number, e-mail address
• Content data: your message, your concern, the topic you select
• Health data (special category under Art. 9 GDPR): information on hair loss, scalp, pre-existing conditions, medication, previous procedures and photographs of the scalp, insofar as you send them to us or they arise during consultation and treatment
• Usage data: technical access data when the website is called up (see section 3)

We process health data only on the basis of your explicit consent (Art. 9(2)(a) GDPR) or – once a treatment relationship exists – for the purposes of preventive healthcare and treatment by staff subject to a professional obligation of secrecy (Art. 9(2)(h) in conjunction with Art. 9(3) GDPR, section 22(1) no. 1(b) BDSG). You may withdraw your consent at any time with effect for the future; this does not affect the lawfulness of processing carried out up to that point.

3. Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstrasse 68, 02742 Friedersdorf, Germany. The provider processes the data in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place.

When you access the website, the server automatically records:

• the IP address of the requesting device
• date and time of access
• the page requested and the volume of data transferred
• the referrer URL
• browser type, browser version and operating system

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and fault-free operation of the website and in defending against attacks. Retention period: log files are deleted after 30 days at the latest. [PLEASE CHECK: confirm the actual log file retention period at ALL-INKL. and enter it here.] These data are not merged with other data sources.

4. No cookies, no tracking, no advertising tools

This website sets no cookies for analytics, marketing or profiling purposes. We use no Google Analytics, no Meta Pixel and no other tracking or advertising services. No fonts or scripts are loaded from external servers; all design elements are stored on our own server. For this reason we also do not need a consent banner.

Only if you actively load the map (see section 8) will a technical marker be stored in your browser's sessionStorage so that you do not have to consent again within the same session. This entry contains no personal data and is deleted automatically when you close the tab.

5. Contact form

On some pages we offer a contact form. The data entered are processed exclusively on our own server and forwarded as an e-mail to our mailbox. No external form service is used.

We process: name, phone number, e-mail address, the topic selected and your message.

Because your entries regularly allow conclusions to be drawn about your hair and health situation, we obtain your explicit consent via a mandatory checkbox before submission. Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR (consent) as well as Art. 6(1)(b) GDPR for pre-contractual measures.

Retention period: enquiries that do not lead to a treatment relationship are deleted no later than six months after the last contact. If a treatment relationship arises, the periods in section 10 apply.

To protect against automated submissions, the form contains a field that is invisible to you and a timing check. Both evaluate purely technical characteristics of the submission and do not create a user profile.

6. Contact by phone, e-mail and WhatsApp

If you call us or write an e-mail, we process your details in order to handle your request on the basis of Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR.

Our website contains links to WhatsApp. These are plain links – simply visiting our pages does not establish any connection to WhatsApp and no data are transmitted to WhatsApp. Only when you click such a link and then message us does WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland (Meta group) process your data under its own responsibility. Metadata (e.g. phone number, device identifiers, timestamps) may arise and be transferred to third countries, in particular the USA. We have no influence over this processing.

Please do not send us health data or photographs of your scalp via WhatsApp. For confidential information, please use the telephone, our contact form or a personal appointment. If you nevertheless write to us via WhatsApp, this is based on your consent under Art. 6(1)(a) and Art. 49(1)(a) GDPR, which you give by actively contacting us. We delete WhatsApp correspondence no later than six months after the last contact, unless a treatment relationship arises.

7. Online appointment booking

For appointments we link to our booking system at onlinebuchung.hairmedical.de. When you click the link you leave this website. The data processed there are your name, contact details, the service requested and the date and time of the appointment. The legal basis is Art. 6(1)(b) GDPR.

[PLEASE ADD: provider of the booking system with full company name and address, server location and whether a data processing agreement under Art. 28 GDPR is in place.]

8. Google Maps – only after your consent

On our location pages we embed maps from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is not loaded automatically. Instead you first see a placeholder with a button. Only when you click it is a connection to Google established, transmitting your IP address among other data. Google may link these data to your Google account if you are signed in, and may transfer them to the USA.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by clicking the button and which you can withdraw by closing or reloading the page. Without a click, no data are transmitted to Google. You can reach our locations at any time using the addresses given, without the map.

9. Recipients and processors

We only pass on your data where this is necessary. Recipients may be:

• our hosting provider (see section 3) as a processor
• the provider of the appointment booking system (see section 7)
• cooperating partners and practitioners, insofar as this is necessary for your treatment and you have consented or a legal basis exists
• our tax advisor, our bank and – in the event of late payment – a debt collection agency, in each case within the legally permitted scope
• authorities and courts, insofar as we are legally obliged to do so

Transfers to recipients in third countries outside the EU/EEA take place only in the cases described in sections 6 and 8 (WhatsApp, Google Maps) and are based there on your explicit consent (Art. 49(1)(a) GDPR) or on the European Commission's standard contractual clauses. The USA does not offer a level of protection equivalent to that of the EU in every respect; in particular, access by authorities there cannot be entirely ruled out.

10. Treatment records and retention periods

If a consultation or treatment takes place, we keep a patient file. The legal basis is Art. 9(2)(h) GDPR in conjunction with section 630f of the German Civil Code.

Once the relevant period expires, the data are deleted or destroyed in a data-protection-compliant manner.

11. Your rights

You have the following rights at all times:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure, unless a statutory retention obligation applies (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object under Art. 21 GDPR: where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests.

Right to lodge a complaint (Art. 77 GDPR): you may complain to a supervisory authority at any time. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestrasse 2–4, 40213 Düsseldorf, Germany
Phone: +49 211 38424-0 · E-mail: poststelle@ldi.nrw.de
www.ldi.nrw.de

12. Data security

This website is transmitted in encrypted form via TLS (recognisable by the padlock symbol and https:// in the address bar). We also use technical and organisational measures to protect your data against loss, alteration and unauthorised access. Our staff are bound by a duty of confidentiality.

13. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Treatment decisions are made exclusively by people.

14. Obligation to provide data

Providing your data is neither legally nor contractually required. However, without contact details we cannot advise you or arrange an appointment. In the context of treatment, information on pre-existing conditions and medication is necessary for your safety.

15. Changes to this privacy policy

We update this privacy policy when the legal situation or our services change. The version published here applies to your visit. Last updated: 19 August 2026.