Privacy policy

Controller

ABS Dienstleistungs-Service GmbH, represented by Helmy Abdel Shafy

Liebigstraße 2-20, Haus 15, 22113 Hamburg, Germany, phone +49 162 1515001, email info@abs-dienstleistungs-service.de

Requests you send us

When you send us a request, we process the details you provide in order to handle that request. The legal basis is Article 6(1)(b) GDPR for a contract or pre-contractual measure, otherwise Article 6(1)(f) GDPR.

If you provide details of a diagnosis, findings or treatment, we process these as health data. The next section sets out what applies to that.

Special categories of personal data

If you send us medical findings, a diagnosis or treatment records, we process health data. These are special categories of personal data under Article 9 GDPR, for which stricter rules apply than for ordinary contact details.

We process these details only insofar as you provide them yourself and they are necessary for the referral and the support. The legal basis is your explicit consent under Article 9(2)(a) GDPR, which you can withdraw at any time with effect for the future.

The people who accompany you are bound to confidentiality. We forward records only to the clinic or practice you have commissioned, apart from the technical service providers named in this privacy policy.

Service providers we use

We use service providers to operate this website who process personal data on our behalf. The website itself is hosted on servers of a German provider, and the data does not leave Germany in the process.

Our forms are protected against automated abuse by Cloudflare Turnstile. A script from Cloudflare is loaded and your IP address is transmitted to Cloudflare as soon as you open a page containing a form, even if you never submit it. Cloudflare is based in the USA. Turnstile does not set any cookies in this process. The legal basis is our legitimate interest in usable forms without spam under Article 6(1)(f) GDPR.

Notifications are sent via Microsoft 365. The mailbox that receives your enquiry is held with a provider based in Germany.

Contact via WhatsApp

We use WhatsApp solely to arrange appointments with you. Please do not send us findings, diagnoses, treatment records or any other information about your health this way. We accept medical records only through a secure channel that we will provide to you.

When you message us on WhatsApp, we process your phone number, your profile name and the content of your messages. The legal basis is Article 6(1)(b) GDPR where arranging the appointment prepares an engagement, and Article 6(1)(f) GDPR otherwise. Our legitimate interest is arranging appointments simply and quickly.

We use the WhatsApp Business app for this. For users in Europe, WhatsApp is provided by WhatsApp Ireland Limited. WhatsApp also processes data of its own, such as connection and usage data, and transfers data to WhatsApp LLC and Meta Platforms, Inc. in the United States. For these transfers WhatsApp relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which both companies are certified. The content of your messages is end-to-end encrypted. WhatsApp explains how it processes your data in its own privacy policy.

Using WhatsApp is voluntary. You can also reach us to arrange appointments through the enquiry form or by phone.

Retention

We delete requests and any records sent with them as soon as the matter has been dealt with and no statutory retention periods apply. If a contract is concluded, the retention periods under commercial and tax law apply.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Consent you have given can be withdrawn at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority, for Hamburg the Hamburg Commissioner for Data Protection and Freedom of Information.

Cookies and analytics

This website currently sets no analytics or marketing cookies. Technically necessary storage is limited to what is required to operate the site.