Controller: Cell Regeneration Management FlexCo, Clessgasse 22, 1210 Vienna, (Art. 4 No. 7 GDPR). With regard to the processing of patient data in the context of medical treatment, the respective treating physician is the controller under data protection law.

 

1. Scope

This Privacy Policy applies to the website reg-med.at, including the entry domains knie-check.at and haare-check.at, the online initial assessments (knee, hair), the contact, callback and appointment functions, the associated backend (api.reg-med.at), as well as our social media presences.

We process personal data in accordance with the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

 

2. How Our System Is Structured

The pages are provided via Shopify. If you complete an initial assessment, the questionnaire is initially processed in your browser; only when you submit your contact details are your answers and contact details transmitted together to our backend. This backend (api.reg-med.at) runs on servers of Hetzner Online GmbH in the European Union; your questionnaire answers and the calculated result are stored there – and only there. For the knee and hair initial assessments, a customer record is additionally created in our shop system (Shopify), containing exclusively your contact details, an inquiry identifier and your newsletter selection – no health data. The practice team can view your inquiry in an access-protected dashboard. If you request a callback, the medical practice additionally receives an email containing your contact details (without questionnaire answers).

 

3. What Data We Process

Contact details (first and last name, email, telephone, place of residence): collected via our forms; stored in the backend (Hetzner, EU), and, for the knee and hair initial assessments, additionally as a customer record in the shop system; automatically deleted after 12 months.

Health data from the initial assessment (Art. 9 GDPR – your information concerning complaints, symptoms, findings, previous treatments, operations and objectives): collected in the knee and hair questionnaires; stored exclusively in the backend (Hetzner, EU) – not in the shop system and not in emails; automatically deleted after 12 months.

Result of the initial assessment (result category): calculated from your answers; stored in the backend (Hetzner, EU); automatically deleted after 12 months.

Newsletter consent (checkbox, not pre-selected by default): stored in the backend and also stored as an indicator in the customer record; valid until withdrawn.

Interaction data (clicks on the Appointment, Call, Callback, WhatsApp and Email buttons, including the time of the click): collected on the result and contact page; stored in the backend (Hetzner, EU); automatically deleted after 12 months.

Callback data (name, email, telephone, form type): when clicking “Request a callback”; transmitted by email to our mailboxes (World4You, Austria); deleted after the matter has been dealt with.

Marketing and conversion data (only with your consent, see Section 8): event data transmitted to Meta, Google and Shopify Analytics; stored in accordance with the retention periods of the respective provider.

Server logs (IP address, time, technical request data): generated when the backend is accessed; stored on Hetzner servers (EU); deleted after a short period as part of log rotation.

Uploading medical reports via the website is not provided for; please bring medical reports with you to your appointment.

 

4. Purposes and Legal Bases

Operation and security of the website and backend – legitimate interest (Art. 6(1)(f) GDPR).

Online initial assessment (creation and display of the result, storage of the inquiry, preparation for an appointment) – your explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR); you provide this consent in the questionnaire before submitting it and may withdraw it at any time with effect for the future.

Creation of the customer record in the shop system for the purpose of managing your inquiry – steps taken prior to entering into a contract (Art. 6(1)(b) GDPR); no health data is transferred.

Contact and callback requests as well as appointment organisation – steps taken prior to entering into a contract (Art. 6(1)(b) GDPR), and, in the case of health information, your consent (Art. 9(2)(a) GDPR).

Analysis of clicks on the contact buttons for the purpose of analysing functionality and reach – legitimate interest (Art. 6(1)(f) GDPR).

Newsletter and health information – your separate consent (Art. 6(1)(a) GDPR, Section 174 TKG 2021), see Section 9.

Online marketing and conversion measurement (Meta, Google Ads, Shopify Analytics) – your consent via the cookie banner (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). Answers from the health questionnaires are not transmitted to Meta or Google; only events (page view, “initial assessment completed”, click on contact buttons), together with the relevant area (knee/hair), are measured.

Medical treatment and documentation – Art. 9(2)(h) GDPR in conjunction with Section 51 ÄrzteG; the controller is the treating physician.

 

5. Online Initial Assessment (Knee, Hair)

The initial assessment is free of charge. It requires your explicit consent to the processing of your information for the purpose of creating and displaying the result and preparing for an appointment. The result is an automatically generated, rule-based orientation aid without legal effect – it is not a medical diagnosis and does not constitute automated decision-making within the meaning of Art. 22 GDPR. After receiving the result, you may book an appointment online yourself (Latido), call us, send us an email, request a callback or contact us via WhatsApp. If you request a callback, we process your contact details in order to contact you for the purpose of arranging an appointment.

 

6. Recipients and Processors

Shopify International Ltd. – provision of the website and customer administration; processes the contact details of knee/hair inquiries, the inquiry identifier and the newsletter selection, but no questionnaire answers (location USA/EU; data processing agreement and EU Standard Contractual Clauses).

Hetzner Online GmbH – operation of the servers for our backend (api.reg-med.at); all inquiry and questionnaire data is stored there (location Germany/EU; data processing agreement).

World4You Internet Services GmbH – email hosting and transmission of callback emails containing name, email, telephone and form type, without health data (location Austria; data processing agreement).

Meta Platforms Ireland Ltd. – advertising and conversion measurement (Meta Pixel and Conversions API) as well as WhatsApp; processes event data including hashed contact details (advanced matching), and, in the case of contact via WhatsApp, additionally your telephone number, profile name and message content (location USA/Ireland; consent, EU Standard Contractual Clauses).

Google Ireland Ltd. – advertising and conversion measurement (Google Ads tag, Enhanced Conversions); processes conversion and click events, the click ID (gclid) and hashed contact details (location USA/Ireland; consent, EU Standard Contractual Clauses).

Latido (patient.latido.at) – external appointment booking portal of the medical practice; processes exclusively the data that you yourself enter there for the purpose of booking an appointment; Latido’s privacy information applies.

BK Management GmbH – creation and technical operation of advertisements and online forms on our behalf (processor pursuant to Art. 28 GDPR).

Data processing agreements are in place with all service providers used; in the case of providers with a US connection, EU Standard Contractual Clauses or an adequacy decision additionally apply. Your data is not disclosed for third-party advertising purposes.

WhatsApp Business. You may contact us via WhatsApp; contact is initiated exclusively by you (by clicking the WhatsApp button with a pre-prepared message). In doing so, your telephone number, profile name and message content are transmitted via WhatsApp (Meta Platforms Ireland Ltd.); WhatsApp’s privacy information also applies. We use WhatsApp only for arranging appointments and making contact, do not transmit medical reports or diagnoses via WhatsApp, do not store patient data in the address book of the practice device and delete chat histories after appointment arrangements have been completed. Please do not send us medical documents via WhatsApp.

 

7. Retention Periods and Deletion Concept

Inquiries, questionnaire answers, results and click events in the backend are permanently deleted by an automated deletion process 12 months after creation. If a customer record in the shop system is deleted, the associated entry in the backend is also deleted via a daily synchronisation process. Callback emails are deleted after the matter has been dealt with.

Newsletter consents remain valid until withdrawn; thereafter, a blocking notice is retained.

We retain invoice data for 7 years (Section 132 BAO). Cookie consent is stored for 12 months.

Important distinction: The website stores inquiry data relating to prospective patients, not a medical treatment record. If you become a patient, the relevant information is transferred to the medical records of the practice and is then subject to the statutory medical retention obligations; the website inquiry itself is deleted after 12 months.

 

8. Cookies, Tracking, Social Media

Non-essential technologies are activated only after you have given your consent via the cookie banner; you can change your selection at any time via “Cookie Settings” in the footer.

The following are used: the Meta Pixel with advanced matching and Conversions API (server-side transmission of the events referred to in Section 4), the Google Ads tag with Enhanced Conversions (upon completion of a form, the hashed email address, telephone number and name are transmitted; the click ID gclid is stored as the _gcl_aw cookie), as well as Shopify Analytics. Without your consent, no transmission to Meta or Google takes place. Transfers of data to the USA are based on EU Standard Contractual Clauses or an adequacy decision. With regard to our Facebook and Instagram pages, we are jointly responsible with Meta for Page Insights (Art. 26 GDPR).

 

9. Newsletter

Registration takes place via a checkbox in our forms that is not pre-selected and is voluntary; it is not a prerequisite for the initial assessment or for arranging an appointment. Sending begins only after you have confirmed your registration via a confirmation email (double opt-in). Your consent is logged together with the time and the version of the consent text. Every mailing contains an unsubscribe link; consent may be withdrawn at any time with effect for the future.

 

10. Your Rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection, and the right to withdraw consents previously given – at any time by contacting . You also have the right to lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, .

We amend this Privacy Policy whenever changes to services, technologies or the legal situation make this necessary.