Privacy Policy

Privacy Policy for Kliniki.de

1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
kliniki.de
Owner: MCHC Ltd., Blvd. Stefan Verkovich No. 10, fl. 1, 4000 Plowdiw, Bulgaria

E-mail: [email protected]
Website: https://kliniki.de

2. General Information on Data Processing
We process the personal data of our users only to the extent necessary to provide a functional website and our services. The processing of personal data generally takes place only with the consent of the data subject or where permitted by law.

3. Types of Data Processed

• Contact details (name, e-mail address, phone number, country)
• Medically relevant information voluntarily provided in the inquiry form
• Usage data (IP address, browser type, access time, visited pages)
• Communication content transmitted via the contact form

Note: No online payments or automated credit checks are performed.

4. Purpose of Processing
Data is processed for the following purposes:

• Handling patient inquiries
• Forwarding the inquiry to suitable medical specialists or clinics
• Preparing and conducting consultations and treatment offers
• Analyzing and improving the website and user experience

Legal bases for processing:

• Art. 6 (1)(b) GDPR (performance of a contract or pre-contractual measures)
• Art. 6 (1)(a) GDPR (consent)
• Art. 6 (1)(f) GDPR (legitimate interest in optimizing the website)
• Art. 9 (2)(a) GDPR (explicit consent for processing medical data)

5. Disclosure of Data
The data transmitted via the contact form is used solely to connect the patient with a suitable medical specialist. For this purpose, data may be shared with the respective doctor, clinic, or medical coordinator, if required for handling the inquiry.

Important:

• Data is not shared with third parties for advertising purposes.
• Data is shared only with the medical institutions explicitly selected by you.
• If medical information is transmitted, this is done based on your explicit consent (Art. 9 (2)(a) GDPR).

6. International Data Transfers
As we cooperate with clinics in German-speaking countries (Germany, Austria, Switzerland), your data may be transferred to these countries. Switzerland has an EU-recognized adequate level of data protection.
If data is transferred to other third countries, this will occur only on the basis of appropriate safeguards in accordance with the GDPR.

7. Data Security
We use appropriate technical and organizational security measures to protect personal data from unauthorized access, manipulation, loss, or destruction. These include:

• SSL/TLS encryption of the website
• Encryption of uploaded medical documents
• Access restrictions and authentication systems
• Regular security audits

8. Data Retention and Deletion
Personal data is deleted or blocked as soon as the purpose of storage no longer applies or the user withdraws consent. Stored contact inquiries are reviewed regularly and deleted no later than six months after receipt, unless statutory retention obligations apply.

9. Rights of Data Subjects
You have the following rights under the GDPR:

• Right of access (Art. 15) to your stored data
• Right to rectification (Art. 16) of inaccurate data
• Right to erasure (Art. 17) of your data
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21) to processing
• Right to withdraw consent with future effect

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

10. Special Protection for Health Data
Due to the sensitive nature of medical data, we apply enhanced protective measures:

• Limited employee access to patient data
• Separate storage of particularly sensitive information
• Encryption of medical documents
• Stricter access controls

11. Changes to this Privacy Policy
We reserve the right to amend this privacy policy as necessary to comply with legal requirements or reflect technical developments. The current version published on this website shall apply.

Last updated: October 19, 2025