Privacy policy
How we handle personal data on this website and in the practice — including data about children.
1. Controller
Purzelbaum Kinderphysiotherapie, Inhaberin Marlene Kuhnert, Hildesheimer Straße 128, 30173 Hannover, Germany. Telephone +49 511 2874 630, email hallo@purzelbaum-kinderphysio.de. We have not appointed a data protection officer; we are below the threshold of § 38 (1) BDSG. Please address any question about data protection to the controller directly.
2. Hosting and server log files
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, with delivery from data centres in the EU (Frankfurt am Main). Each request is logged with the IP address, date and time, the page requested, the referrer, the browser and the operating system. This is necessary to operate and secure the site; legal basis Art. 6 (1) (f) GDPR. Logs are deleted after 14 days. A data processing agreement under Art. 28 GDPR is in place with Vercel, including the EU standard contractual clauses for any transfer to the USA.
3. Cookies
We use only cookies that are technically necessary. There is no analytics, no tracking, no advertising and no profiling on this site. Your choice in the cookie banner is stored locally in your browser (localStorage) so that we do not ask again; that entry stays on your device and is never transmitted to us. Legal basis for necessary cookies: § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR.
4. Map
The map on the contact page is not loaded until you press the button. Only then is a request made to openstreetmap.org (OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0DS, United Kingdom), which transmits your IP address and browser data. Legal basis: your consent under Art. 6 (1) (a) GDPR, which you may withdraw at any time by reloading the page.
5. Doctolib and jameda
We link to our appointment diary at Doctolib (Doctolib GmbH, Mehringdamm 51, 10961 Berlin) and to our reviews at jameda (jameda GmbH, Balanstraße 71a, 81541 Munich). Nothing is loaded from either service on this website — no widget, no script, no image. Data is only transferred when you click the link and leave our site, at which point the privacy policy of that provider applies.
6. Appointment request form
The form transmits the name and contact details of the parent or guardian, the first name and age of the child, whether a prescription exists, and the free-text message. We use these details solely to arrange an appointment and to prepare it. Legal basis: Art. 6 (1) (b) GDPR (steps prior to a treatment contract) and, for details about health, Art. 9 (2) (h) GDPR together with § 22 (1) no. 1 (b) BDSG. If an appointment follows, the details become part of the patient record and are kept for ten years after the end of treatment (§ 630f (3) BGB). If no appointment follows, we delete the request after six months.
7. Data about children (Art. 8 GDPR)
Our patients are minors. We only ever accept their data from a parent or guardian: the form states this and asks you to confirm it, and we never invite a child to send us their own details. We ask for the minimum needed — first name and age, not a surname, not a date of birth, not a photograph. Please do not upload or email photographs of your child; if you send one anyway, we delete it and tell you that we have. From the age of about fourteen we discuss with the young person themselves what is recorded about them and who sees it, within the limits of parental responsibility. Everything else about a child in our care is held in the patient record under the same medical confidentiality (§ 203 StGB) as for any patient.
8. Contact by telephone and email
If you call or email us, we process the data you provide to answer your enquiry, on the basis of Art. 6 (1) (b) or (f) GDPR. Email is not an encrypted channel; please do not send medical documents by email. Enquiries that do not lead to treatment are deleted after six months.
9. Recipients
Health insurers and, for private patients, our billing service receive the data required to invoice a treatment. Reports go to the prescribing doctor, because the prescription requires it. Beyond that we pass nothing to anyone without your explicit consent. Our practice software is operated on servers in Germany under a data processing agreement.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw consent at any time with effect for the future. For a child, a parent or guardian exercises these rights. The right to erasure is limited while the statutory retention period for patient records applies. You may also complain to a supervisory authority, for example Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.
11. Changes
We update this privacy policy when the website or the legal position changes. Current version: 1 September 2026.