Privacy policy

My practice takes the protection of your personal data very seriously.

I want you to know when we collect which data and how we use it.

Our website has deliberately been designed to use as little data as possible. We do not use visitor statistics or advertising tracking. Technically necessary cookies may be used.

External services are available to you for online appointment booking and the digital medical history form. Via ATHENA in particular, you can securely transmit personal details and health data of your child to our practice.

1. Data controller

2. Definitions

Personal data means individual details about the personal or material circumstances of an identified or identifiable natural person. This includes information such as your name, address, telephone number, date of birth or IP address.

3. Hosting

This website is published via the Lovable platform. It is delivered with the help of Cloudflare, which is used as a content delivery network (CDN) and reverse proxy. This is a worldwide network; pages are delivered via a geographically nearby network node wherever possible. Delivery restricted exclusively to the European Union is not offered by the provider. Processing of connection data outside the European Union, in particular in the USA, can therefore not be ruled out.

Lovable does not publish the exact storage location of the hosting and security logs. The subprocessors used for hosting are listed at https://trust.lovable.dev/subprocessors(in German).

The legal basis for hosting is our legitimate interest in providing our website securely, stably and reliably (Art. 6(1)(f) GDPR).

4. Server logs and retention period

Each time our website is accessed, connection data that your browser must transmit to retrieve the page is necessarily processed for technical reasons, in particular the IP address of your device and the address accessed. Without this processing, the page cannot be delivered.

In addition, request logs are created and stored by the provider. The provider has not conclusively confirmed to us which details these logs contain in each case. The processing serves to provide the website and to ensure its stability and security, for example to defend against attacks and to analyse errors. The legal basis is Art. 6(1)(f) GDPR.

According to the provider, individual log entries cannot be deleted on request. The provider does not publish specific storage locations or retention periods for request logs, security logs, technical events and error reports. We are therefore currently unable to state a fixed retention period.

5. Cookies and technical events

The provider's visitor statistics are deactivated for this website. During the technical check after deactivation, neither the cookie session-id nor requests to /~flock.js, /~api/analytics or /__l5e/trackevents were observed. Deactivation only takes effect for the future; data collected before deactivation is not automatically deleted as a result.

The following cookies are set when the website is provided:

• __dpl (Lovable): assigns your requests to a consistent version (deployment) of the website so that all parts of the page are loaded from the same version. According to Lovable, the cookie contains a deployment hash that is identical for all visitors of the same version and no individual visitor information. In our check on 22 October 2026 it was valid for a maximum of 24 hours (86,400 seconds) and is set again with every successful page request. Attributes: Path=/, SameSite=Lax, Secure; HttpOnly is not set. The cookie cannot be technically disabled.
• _cfbm (Cloudflare): serves to detect and defend against automated access (bot management). According to Cloudflare's documentation, the cookie expires after 30 minutes of inactivity; in our check on 22 October 2026 it was set with the attributes HttpOnly, SameSite=None and Secure. According to Cloudflare, cookie data may by default also be processed in data centres in the USA. Further information: Cloudflare's cookie information(in German)

We base the storage of these cookies on your device and access to them on § 25(2) no. 2 TDDDG, insofar as they are strictly necessary for us to provide you with the website securely and in working order. Insofar as personal data is processed in this context – for example your IP address during bot defence – the legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR).

Scroll position (sessionStorage)

So that the last viewed position is restored when you go back between pages, the website creates the entry "tsr-scroll-restoration-v1_3" with scroll positions in your browser's session storage (sessionStorage). It applies only to the respective browser tab and is not transmitted by the website. This storage is strictly necessary for operating the website (§ 25(2) no. 2 TDDDG).

Storing your language choice (localStorage)

When you select a language, your choice is stored solely locally in your browser (localStorage, entry “praxis-lang”), so that we can offer you the appropriate language on your next visit. This is not a cookie, the information is not transmitted to us, and you can delete it at any time through your browser settings. This storage is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG).

6. Fonts

The fonts used on this website are served directly from our own server. No connection is made to the servers of Google or any other font provider.

7. Google Maps (only after clicking)

On the “Getting here” page, you can display a Google Maps map. The map is only loaded when you actively click “Load map”. Only then is a connection established to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; this involves the processing of data including your IP address and possibly Google cookies. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Further information: Google's privacy policy

The map is also available in the contact section of the home page. Your activation is not stored permanently. The “Remove content” button ends the embedding immediately. The displayed map is also removed by reloading or leaving the page; it is only loaded again after another click. Data already transmitted to Google cannot be recalled in this way. You can delete cookies already stored by Google via your browser settings.

8. YouTube videos (only after clicking)

On individual pages, we embed YouTube videos using privacy-enhanced mode (youtube-nocookie.com). A video is only loaded when you click “play”. A connection is then established to servers of Google Ireland Limited and your IP address is transmitted. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Activation of a video is not stored permanently. The “Remove content” button ends the embedding immediately. The video is also removed by reloading or leaving the page; it is only loaded again after another click. Data already transmitted cannot be recalled in this way. You can delete cookies already stored by Google or YouTube via your browser settings.

9. Online appointment booking (DampSoft)

For online appointment scheduling, we use the online appointment management of DAMPSOFT GmbH, Vogelsang 1, 24351 Damp, Germany.

An external link takes you to the appointment booking portal. There, in particular personal master data, contact data, appointment data and, where applicable, health data may be processed.

DampSoft processes patient data as a processor on behalf of our practice within the scope of the contractually agreed services. The processing serves to organise and carry out appointments. The legal basis is the initiation or performance of the treatment contract (Art. 6(1)(b) GDPR); insofar as health data is processed, additionally Art. 9(2)(h) GDPR.

Further information on data protection at DampSoft can be found at: https://www.dampsoft.de/datenschutz

10. Digital medical history – ATHENA Anamnese@Home

For the digital recording of patients' medical history, we use ATHENA Anamnese@Home of DAMPSOFT GmbH, Vogelsang 1, 24351 Damp, Germany.

Via the external medical history link, you can transmit personal details and health data of your child before your visit to the practice.

The data entered is transmitted via the ATHENA infrastructure to our practice or our practice software for further processing.

DampSoft processes this data as a processor on behalf of our practice within the scope of the contractually agreed services.

The processing serves to prepare and carry out dental treatment. The legal basis is the treatment contract (Art. 6(1)(b) GDPR) in conjunction with Art. 9(2)(h) GDPR.

Further information: https://www.dampsoft.de/datenschutz

11. Contact by email or telephone

If you contact us by email or telephone, we process your details to handle your enquiry.

If your enquiry concerns treatment or an appointment, the legal basis is the initiation or performance of the treatment contract (Art. 6(1)(b) GDPR), and for health information additionally Art. 9(2)(h) GDPR. Statutory retention obligations apply to information included in the treatment records (see section 12).

We handle general enquiries without a treatment context on the basis of our legitimate interest in responding (Art. 6(1)(f) GDPR).

We delete your details as soon as they are no longer required for the respective purpose, unless statutory retention obligations prevent this. Please note that unencrypted emails are not fully protected against access by third parties – wherever possible, please do not send us sensitive health data by email.

12. Patient data and professional confidentiality

Data that we collect as part of your child's treatment at the practice is subject to dental professional confidentiality (§ 203 StGB). Processing for treatment and billing is based on the treatment contract (Art. 6(1)(b) GDPR). Insofar as we are legally obliged, for example to document and retain records or to meet billing and reporting obligations, the legal basis is Art. 6(1)(c) GDPR. For health data, Art. 9(2)(h) GDPR additionally applies. In accordance with statutory requirements, treatment records are generally retained for ten years after completion of treatment (§ 630f BGB).

13. Your rights

You have the right at any time to obtain information free of charge about the data we hold about you (Art. 15 GDPR), as well as to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw consent you have given at any time with effect for the future. Erasure and restriction of processing are each subject to their own statutory requirements (Art. 17 and Art. 18 GDPR). If statutory retention obligations prevent erasure, for example for treatment records, we restrict processing insofar as the requirements for this are met. Your rights also apply to data processed by our service providers, for example in hosting logs; technical particularities of the provider do not exclude them. We examine each request individually and support you in dealing with the service providers. Simply contact kontakt@kinder-jugendzahnheilkun.de to do so.

Right to object under Art. 21 GDPR: Insofar as we process your personal data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. This also applies to profiling based on these provisions. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons; this also applies to related profiling. This website does not use direct marketing or advertising profiling. You can send your objection to the contact details given in section 1.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. How you can remove loaded maps and videos is described in sections 7 and 8.

14. Right to complain to the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de

15. Links to other providers' websites

Our website contains external links to our Instagram profile as well as to Google reviews and the public profiles of the reviewers. The review excerpts shown on our website are stored as website content; no Google review widget is loaded. Instagram content is not embedded either.

Merely displaying these links does not establish a connection to Instagram or to the linked Google review pages. Only when you click a link do you open the external website. The respective provider then receives, among other things, your IP address; further processing may result, for example, from your login with the provider and its cookies. The privacy information of the respective provider applies to this processing. Independently of this, the optionally embedded Google map is only loaded after a separate click, as described in section 7.

16. Avatar help "TheDoc" (help panel and read-aloud function)

*[English translation – pending linguistic review. The German version is authoritative.]*

The avatar help "TheDoc" is available on all pages. It guides you to existing pages and uses only fixed, reviewed content of this website. It does not create medical statements of its own. What you type into the text field is matched against fixed keywords in your browser; the help neither sends it to us or third parties nor stores it.

Reading aloud: For selected fixed texts (greeting, notices and answers to the topics offered), TheDoc plays pre-generated audio files on the German, English, Romanian, Russian, Ukrainian, Turkish, Chinese and Albanian pages; the Arabic pages use the English audio files. When played, these files are transmitted to your device via our hosting (see sections 3 and 4) like other parts of the website. The files were generated once in advance exclusively from fixed website texts. No speech service is called during playback. For longer page texts, TheDoc currently does not offer reading aloud; the text is only displayed.

No voice input: The help currently does not offer voice input via the microphone; it does not access the microphone.

The avatar help can be used fully via text and buttons without the read-aloud function. Reading aloud can be stopped at any time.

Session storage: For its operation, the help uses your browser's session storage (sessionStorage) with up to three entries: "thedoc-nudge-seen" (the speech bubble has already been shown), "thedoc-companion" (language of the help while it accompanies you after opening a page) and "thedoc-followup" (after a page is opened, TheDoc asks once how it can help further; this entry is deleted when read). The entries apply only to the respective browser tab and are removed according to your browser's rules when you close the tab or window. The help itself does not transmit these entries. This storage is strictly necessary for the help function you use (§ 25(2) no. 2 TDDDG). The help itself does not set any cookies.

17. Changes

As this website develops, it may become necessary to update this privacy policy. We therefore recommend that you read it again from time to time.

*This English version is provided for information only; the German version is legally binding.*