Privacy and data protection
Privacy policy
Information from PD Dr. med. Daniel P. Berthold about personal data processed on this website and when handling inquiries.
Introduction
General information
This policy concerns the personal website of PD Dr. med. Daniel P. Berthold. You can read the content without an account. Technical access data are processed during your visit. Additional data may be processed when you contact us or activate an external service such as YouTube.
Personal data such as your name, address, email address or telephone number are processed in accordance with the General Data Protection Regulation (GDPR) and applicable German data-protection law. This policy explains the nature, scope and purposes of processing and the rights of data subjects.
Technical and organizational measures are used to protect processed data. Nevertheless, internet-based transmissions can have security vulnerabilities and absolute protection cannot be guaranteed. Personal data can therefore also be communicated through alternative means, such as by telephone.
Responsibility
Data controller
The controller for this website is PD Dr. med. Daniel P. Berthold, c/o OrthoCenter München, Maximilianstraße 10, 80539 München, Germany.
Telephone via the practice: +49 89 461 34 53 0. For questions about this website and data protection, email dr.berthold@ortho-center.eu.
Processing in connection with medical treatment or by linked providers is also subject to the privacy information of the responsible institution or service.
Terminology
Definitions
The following terms reflect the GDPR definitions and are intended to make this policy clear and understandable.
Personal data: any information relating to an identified or identifiable natural person. A person is identifiable directly or indirectly, particularly by a name, identification number, location data, online identifier or characteristics specific to their identity.
Data subject: any identified or identifiable natural person whose personal data are processed.
Processing: any operation involving personal data, whether or not performed by automated means. This includes collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, matching, restriction, erasure or destruction.
Restriction of processing: marking stored personal data with the aim of limiting their future processing.
Profiling: automated processing of personal data used to evaluate, analyze or predict particular personal aspects of an individual.
Pseudonymization: processing that prevents personal data from being attributed to a specific person without additional information held separately. That additional information must be protected by technical and organizational measures.
Controller: a natural or legal person, public authority, agency or other body that determines the purposes and means of processing, alone or jointly with others.
Processor: a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
Recipient: a natural or legal person, public authority, agency or other body to which personal data are disclosed. Public authorities acting within a particular statutory inquiry are not necessarily considered recipients.
Third party: a body other than the data subject, controller, processor or persons authorized to process data under the direct authority of the controller or processor.
Consent: a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they agree to the processing of their data.
Website operation
Website access, hosting and server data
This website is provided through ChatGPT Sites by OpenAI and delivered using Cloudflare infrastructure. IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, manages the domain drdanielberthold.de and its DNS settings; IONOS does not host this website. Visiting a page involves processing technical connection and access data, particularly the IP address, requested page and access time.
These data are required to deliver content correctly, maintain the website’s functionality and security, investigate faults and defend technical systems against attacks. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of this website.
Sites does not guarantee that data processing is restricted to Germany or the EU; this also applies to logs. Processing outside the EU or EEA is therefore possible. We do not have confirmed product-specific retention periods or anonymization assurances for provider-side access data. Questions about processing, recipients and possible international transfers can be directed to the controller identified above.
Hosting statistics
Visitor statistics provided by the host
Sites automatically records website traffic and provides the operator with statistics about unique visitors, page views and changes over time. These statistics help understand how the information on this website is used.
These provider-side statistics are separate from the website-code functions. We do not embed our own analytics or advertising trackers; this does not mean the hosting provider processes no usage data or never uses cookies. Our website code does not transmit answers from the local interactive checks. The Sites documentation provides further information about visitor statistics.
Communication
Connection encryption and contacting us
When you access a page via https://, the connection between your browser and the web server is encrypted with TLS. Your browser’s security information shows the connection status. Website encryption does not mean that a separately sent email is end-to-end encrypted.
If you contact us by email or telephone, the information voluntarily provided is stored to process and respond to your inquiry. Depending on its purpose, the legal basis is Article 6(1)(b) or 6(1)(f) GDPR. If health data are involved, the requirements of Article 9 GDPR also apply.
Please do not send complete medical records or imaging datasets in an initial unencrypted email. A suitable transfer method for sensitive documents is agreed after initial contact.
This website does not provide user registration, its own contact form or medical-record uploads. Answers in interactive checks and orientation tools are evaluated only in your browser’s memory, are not sent to the practice and are not stored permanently. Reloading the page resets the answers.
Retention
Erasure, restriction and retention periods
Personal data are processed and stored only for as long as necessary for the relevant purpose or as required by statutory retention periods. When the purpose no longer applies or a mandatory period ends, data are erased or processing is restricted in accordance with the law.
Recipients may include technical service providers used for hosting, security and communication. Data are disclosed to other parties only when required to handle an inquiry, to comply with a legal obligation or on the basis of consent.
Your rights
Rights of data subjects
You can exercise your rights at any time using the contact details above. Each right applies subject to the relevant legal conditions.
Confirmation and access: you may request confirmation of whether personal data are being processed. If they are, you may request access and a copy free of charge. The information includes, in particular, purposes, data categories, recipients, retention periods, the source of the data, your other rights, automated decisions and, where relevant, transfers to third countries.
Rectification: you may request prompt correction of inaccurate personal data and completion of incomplete personal data.
Erasure: you may request erasure, particularly where data are no longer necessary, consent has been validly withdrawn, a valid objection applies, processing was unlawful or a legal obligation requires erasure. Statutory retention obligations and other legal exceptions remain unaffected.
Restriction of processing: you may request restriction if you contest the accuracy of data, processing is unlawful and you prefer restriction to erasure, the data are needed for legal claims, or a decision on an objection is pending.
Data portability: where automated processing is based on consent or a contract, you may receive the data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have them transferred directly to another controller.
Objection: for reasons relating to your particular situation, you may object to processing based on Article 6(1)(e) or 6(1)(f) GDPR. You may object to direct marketing at any time without giving a specific reason. Following a valid objection, processing stops unless compelling legitimate grounds or legal claims justify its continuation.
Automated decisions, including profiling: you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, unless a statutory exception applies. This website does not carry out such automated decision-making or profiling.
Withdrawal of consent: you may withdraw data-protection consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.
Right to complain: you may complain to a data-protection supervisory authority, particularly in the member state of your habitual residence, workplace or the suspected infringement. The Bavarian State Office for Data Protection Supervision is one possible contact for non-public bodies in Bavaria.
Legal bases
Legal bases and legitimate interests
Article 6(1)(a) GDPR applies when consent is obtained for a specific purpose. Processing necessary to perform a contract or take steps before entering a contract is based on Article 6(1)(b) GDPR.
Article 6(1)(c) GDPR applies where processing is required by a legal obligation. In rare cases, Article 6(1)(d) GDPR may apply to protect a person’s vital interests.
Article 6(1)(f) GDPR applies where processing is necessary for a legitimate interest and the interests, fundamental rights and freedoms of data subjects do not override it. Legitimate interests include, in particular, the secure operation of this website, handling inquiries and conducting business activities.
Special categories of personal data, particularly health data, are additionally subject to Article 9 GDPR and the applicable professional and health-law provisions.
Required information
Providing personal data
Providing personal data may be legally required, contractually agreed or necessary to enter a contract. If required information is not provided, an inquiry may be impossible to process or a contract may not be concluded.
You may contact the practice before sending information. The practice can explain in the individual case which details are required, the basis on which they are processed and the possible consequences of not providing them.
Technical services
Cookies, fonts, analytics and advertising
This website’s code does not include its own analytics, advertising or social-media trackers, or marketing cookies. Google Analytics, Google Ads or AdWords, and comparable conversion-tracking services are not currently used.
Necessary storage or security mechanisms may be used for technically essential hosting functions. Browsers can be configured to block cookies or ask before saving them; this may impair technically necessary functions.
The website does not load Google Fonts or other webfonts from external font servers. Fonts are local or system fonts already available on the device.
If optional analytics, marketing or external font services are added in future, this policy and, where required, consent controls will be updated before those services are used.
Third-party services
External links and services
Doctolib booking, Google Maps, Jameda, PubMed, ORCID, specialist journals, media articles and, where applicable, social networks are opened only as external links. A connection to the provider is established only when you click the link. The respective service’s privacy information then applies.
Videos initially display only a locally stored preview image. The YouTube player is loaded through youtube-nocookie.com’s privacy-enhanced mode only after you select Play video. This establishes a connection to YouTube or Google. In particular, your IP address, device and usage information, and the page accessed may be processed. If you are signed in to YouTube, the visit may be associated with your account. Google’s privacy policy provides further information.
The website does not automatically embed Google Maps, Jameda widgets, Facebook or Instagram feeds, or plugins from X, XING or LinkedIn. Simply viewing a page with a YouTube preview image does not establish a connection to YouTube.
If the type or scope of external integrations changes, this information will be updated before activation.
