Privacy Policy

1. Controller

The controller for the processing of personal data on this website is:

Hausarztpraxis Yousif Khalaf Al-Alwani
Hüttenstraße 6
49716 Meppen
Germany

Telephone: +49 5931 3470
E-mail: praxiskhalaf@web.de

2. General information

The protection of your personal data is important to us. We treat your data confidentially and in accordance with the statutory provisions, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

Personal data is processed only in so far as this is necessary for providing the website, for dealing with your enquiries, or on the basis of your consent.

3. Hosting

This website is operated on a server of Contabo GmbH, Aschauer Straße 32a, 81549 München.

When the website is accessed, the server processes technically necessary access data, in particular the IP address, the date and time, the page accessed, the browser type and the operating system. This processing serves the secure and technically faultless operation of the website. The legal basis is Art. 6(1)(f) GDPR.

The content of this website is stored in our own database on the same server. No third-party website builder is used.

The website is delivered through the content delivery network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare terminates the TLS encryption. This means that not only the connection data (in particular the IP address and the address requested) is processed: all content transmitted through this website is present at Cloudflare in unencrypted form – including the details from our request forms and the messages you write to the practice assistant. The processing serves to deliver the website and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR; for transfers to the USA, Cloudflare relies on the European Commission’s standard contractual clauses.

4. Contacting us

You can reach us by telephone, by e-mail or via WhatsApp. If you write to us, we process the details you give us – in particular your name, your contact details and the content of your message – solely in order to deal with your enquiry. The legal basis is Art. 6(1)(b) or Art. 6(1)(f) GDPR.

Please do not send us findings, diagnoses, medication plans or other particularly confidential medical documents by e-mail or WhatsApp. For prescriptions, sick notes and referrals, please use the request forms provided for that purpose (section 5), the telephone, or a personal visit to the practice.

We do not offer a general contact form with a free-text field on this website.

5. Online requests: prescription, sick note and referral

For prescriptions, sick notes and referrals we provide separate request forms. These forms are expressly intended to receive the details necessary for processing your request.

The data processed here are, in particular:

• name and date of birth
  - telephone number and, if provided, e-mail address
  - the details of the request itself, such as the name of a medicine, the medical speciality requested for a referral, or the date an illness began
  - optionally, a file uploaded by you

These details are health data within the meaning of Art. 9 GDPR. They are processed for the purpose of health care and of treatment by our practice, on the basis of Art. 9(2)(h) GDPR in conjunction with Art. 6(1)(b) GDPR and the professional and confidentiality obligations of doctors.

Transmission is encrypted (TLS). The requests are stored on our own server and are processed exclusively by the practice; they are not passed on to third parties for other purposes.

Please limit the details you give to what is necessary for dealing with your request.

6. Online appointment request

Using the appointment request you can select a service, a day and a time and send us your name and telephone number. We use these details in order to confirm the appointment.

No external appointment booking system is used. The request is processed on our own server. The legal basis is Art. 6(1)(b) GDPR.

7. Practice assistant (chat)

On this website you can contact the practice through a chat assistant. The assistant answers organisational questions from a list of answers maintained by the practice and makes no medical statements. Questions it cannot answer are passed to the practice, where they are read and answered by our staff.

We process the messages you write and – where you provide them – your name and your telephone number or e-mail address. If you let the assistant fill in a request form with you (prescription, sick note, referral), section 5 applies in addition.

Please do not share findings, diagnoses, medication plans or other particularly sensitive health data in the chat. The assistant is not suitable for emergencies and is not monitored continuously: in an emergency please call 112, and outside our consulting hours the medical on-call service can be reached on 116 117. Files cannot be sent through the assistant.

The legal basis is Art. 6(1)(b) or Art. 6(1)(f) GDPR. Where you communicate health data, the processing is based on your consent under Art. 9(2)(a) GDPR, which you give by sending your message and may withdraw at any time with effect for the future.

A random identifier is stored in your browser so that you can find your conversation again on a later visit. A conversation is deleted automatically and in full no later than 90 days after its last message; at your request we delete it sooner.

8. Google Maps

On the home page we provide a map showing how to reach us. The map is not loaded automatically: at first you see only a notice with a button. Only when you click this button is the map loaded from Google and your IP address transmitted to Google.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by clicking the button. If you have your decision remembered, it is stored locally in your browser; you can withdraw it at any time by deleting the site data.

Our contact page merely links to Google Maps. Simply calling up that page does not transmit any data to Google.

9. Audience measurement

We measure the use of our website with our own data-minimising solution on our own server. We do not use Google Analytics or comparable third-party services. There is no transmission to third parties and no cross-site tracking.

Measurement takes place only if you have consented beforehand. The data collected are the page accessed, the time, the language version and a random identifier which applies only for the duration of your visit and is not linked to your name.

The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time by deleting this site's data in your browser. The measurement data are deleted after 13 months at the latest.

10. WhatsApp

On our website you will find a button which opens a chat with our practice via WhatsApp. Only when you click it do you leave our website; any further processing is then governed by the privacy terms of WhatsApp Ireland Limited.

Use is voluntary. Please do not send any findings, diagnoses, medication plans or other particularly confidential medical documents via WhatsApp. For such matters, please use the request forms, the telephone or a personal visit.

11. Storage in your browser

This website does not use any advertising cookies or any third-party cookies. The only items stored in your browser's storage are:

• your decision about the audience measurement
  - your decision about loading the map, if you have it remembered
  - your answer to the question about your health insurance card, so that the request forms remain visible
  - during a visit, a random identifier for the audience measurement, if you have consented

These entries remain in your browser and can be deleted at any time via its settings.

12. Storage period

We keep requests submitted through the forms for as long as is necessary for processing them and for complying with statutory retention obligations, for a maximum of 24 months. Audience measurement data are deleted after 13 months at the latest. The statutory medical retention periods apply to the patient records held in the practice.

13. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21), as well as the right to withdraw consent you have given at any time (Art. 7(3) GDPR).

To exercise your rights, please contact:

Hausarztpraxis Yousif Khalaf Al-Alwani
Hüttenstraße 6, 49716 Meppen
E-mail: praxiskhalaf@web.de
Telephone: +49 5931 3470

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany

15. Updates

We amend this privacy notice when the functions of our website, the services used or the legal requirements change.

Last updated: September 2026