This privacy notice explains how personal data is processed when you visit the website of Physiotherapie am Musikforum.
1. Controller
The controller responsible for data processing is:
Levent Kent
Physiotherapie am Musikforum
Viktoriastraße 57
44787 Bochum, Germany
Telephone: +49 234 59877117
E-mail: datenschutz@physiotherapie-am-Musikforum.de
2. General information on data processing
Protecting your personal data is important to us. Personal data is processed exclusively in accordance with the applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
When you visit this website, personal data is processed only to the extent necessary for the secure and proper operation of the website, the delivery of its content or the use of individual functions. The sections below explain which data is processed in each case, for which purposes, and on which legal basis.
Where a processing operation requires your consent, it is carried out solely on the basis of the consent you have given beforehand. Beyond that, personal data is processed only where a statutory legal basis exists.
Personal data is stored only for as long as is necessary to fulfil the respective purpose or for as long as statutory retention obligations apply. Once the purpose no longer applies or the statutory retention period has expired, the data is erased or its processing is restricted in accordance with the law.
We use appropriate technical and organisational security measures to protect your data against loss, manipulation, unauthorised access and other unlawful processing.
3. Your rights as a data subject
Where we process your personal data, you have the following rights under the GDPR:
Right of access (Art. 15 GDPR)
You have the right to obtain confirmation as to whether, and which, personal data concerning you we process. You may also request information about the purposes of the processing, the categories of personal data, the recipients of the data, the storage period and further information provided for by law.
Right to rectification (Art. 16 GDPR)
You have the right to obtain the rectification of inaccurate personal data and the completion of incomplete personal data without undue delay.
Right to erasure (Art. 17 GDPR)
Subject to the statutory conditions, you may request the erasure of your personal data, in particular where it is no longer necessary for the purposes for which it was collected or where you have withdrawn your consent.
Right to restriction of processing (Art. 18 GDPR)
Subject to the statutory conditions, you have the right to request the restriction of the processing of your personal data.
Right to data portability (Art. 20 GDPR)
Where processing is based on consent or on a contract and is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, or to have it transmitted to another controller where technically feasible.
Right to object (Art. 21 GDPR)
Where personal data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. If your objection is justified, we will stop the processing unless there are compelling legitimate grounds to the contrary or the processing serves to establish, exercise or defend legal claims.
Right to withdraw consent (Art. 7(3) GDPR)
Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular the authority responsible for your habitual residence, your place of work or the place of the alleged infringement.
The supervisory authority generally responsible for our practice is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
E-mail: poststelle@ldi.nrw.de
4. Hosting of the website and the content management system
This website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The content management system that delivers this website's content – texts, images, services, team and practice details – runs on the same infrastructure.
For the purpose of providing and securely operating the website, the hosting provider processes, as our processor, the personal data that is technically required each time the website is accessed. This may include in particular:
the IP address of the requesting device (stored in the server log files in anonymised form),
the date and time of access,
the pages and files requested,
the volume of data transferred,
the HTTP status code,
the browser type and version,
the operating system used,
the referrer URL, where transmitted by the browser.
This data is processed in order to deliver the website technically, to ensure the security and stability of the system, to analyse errors and to prevent unauthorised access.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and uninterrupted provision of our website.
A data processing agreement pursuant to Art. 28 GDPR has been concluded with the hosting provider, ensuring that personal data is processed solely on our instructions and in compliance with applicable data protection law.
Server log files are stored for 7 days by default and then deleted. IP addresses in the web server log files are anonymised for data protection reasons.
5. SSL/TLS encryption
For security reasons and to protect the transmission of personal data and other confidential content, this website uses SSL/TLS encryption.
You can recognise an encrypted connection by the address bar of your browser starting with “https://” and by the padlock symbol.
Encryption prevents transmitted data from being read or manipulated by unauthorised third parties.
6. Cookies and consent management
This website uses strictly necessary cookies only. Cookies are small text files that are stored on your device and contain certain information.
At present a single cookie is set, and only once you have made a choice in the notice banner:
Cookie name: cookie-consent
Purpose: stores your choice in the notice banner so that the banner does not reappear on subsequent visits
Content: the value “accepted” or “declined”
Storage period: 180 days
The cookie contains no identifier that could be used to recognise you and is evaluated on your device only. No cookie is set before you make your choice. Web server session cookies such as “PHPSESSID” are no longer used on this website.
This strictly necessary cookie is used on the basis of Section 25(2) no. 2 TDDDG. Where personal data is processed in this context, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, technically faultless and user-friendly provision of our website.
Using the “Cookie settings” link at the bottom of the website, you can call up your choice again at any time and change it for the future. The stored cookie is deleted and the notice banner is displayed again.
7. Contacting us by e-mail or telephone
If you contact us by e-mail or by telephone, we process the personal data you provide solely in order to handle your enquiry and to communicate with you.
The processing is based on Art. 6(1)(b) GDPR where your enquiry serves to take steps prior to entering into a contract or to perform a contract. In all other cases, the processing is based on our legitimate interest in handling your enquiry pursuant to Art. 6(1)(f) GDPR or, where you have given consent, on Art. 6(1)(a) GDPR.
Your data is stored only for as long as is necessary to handle your enquiry or for as long as statutory retention obligations prevent its erasure.
8. Contact and appointment requests via the form on this website
You can send us an enquiry directly on this website using the “Book an appointment” button or the contact form.
Data processed. We process the details you enter: your name, telephone number, e-mail address and, where you fill in the field, your message. We also store the time at which you gave your consent and the language in which the form was completed, so that we can reply to you in that language.
Please do not send health data. The form is intended for appointment requests and general enquiries. Please tell us about symptoms, diagnoses or treatments by telephone or in person at the practice rather than through this form.
Purpose and recipients. Your enquiry is stored in our content management system and additionally sent to the practice by e-mail. If you have provided an e-mail address, you will receive a confirmation that your enquiry has been received.
Legal basis. The processing is based on your consent pursuant to Art. 6(1)(a) GDPR, which you give expressly before submitting the form, and – where your enquiry serves to initiate or carry out treatment – on Art. 6(1)(b) GDPR. You may withdraw your consent at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected.
Protection against automated requests. To protect against mass automated submissions, the form contains an additional field that is invisible to you and is only completed by automated programs; an enquiry identified in this way is not stored. We also limit the number of requests per IP address within a given time window. Your IP address is processed for this purpose only transiently in the server's memory, is not stored permanently and is not linked to your enquiry. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing automated access.
Storage period. Your enquiry is deleted once it has been dealt with conclusively and no statutory retention obligations prevent this. If a treatment relationship subsequently comes about, retention is governed by the statutory requirements applicable to it.
9. E-mail delivery via Resend
To send the e-mails generated in connection with the contact form – the notification to the practice and your confirmation of receipt – we use the delivery service Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA.
The details you enter in the form and your e-mail address are transmitted to this provider, which delivers the message on our behalf. The transfer to the delivery service is encrypted.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in reliable and deliverable e-mail dispatch. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. As this may involve a transfer of personal data to the USA, the transfer is based on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR together with supplementary safeguards.
10. Storage of images and media files
The images and other media files shown on this website are stored in a storage service operated by Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg) at the Frankfurt am Main data centre location (region eu-central-1).
Your browser does not connect to this storage service: the files are retrieved by our own server and delivered to you from there. Neither your IP address nor any other connection data is therefore transmitted to the storage service.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the reliable and fail-safe delivery of the website's content. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
11. Fonts
This website uses only fonts stored locally on our own server. There is no connection to Google Fonts or any other external font service, and no data is transmitted to third parties for this purpose.
12. Embedded video (YouTube)
This website may embed a video provided through the YouTube service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We use a two-click solution for this: initially only a preview image stored on our own server is displayed. A connection to YouTube is established only after you expressly start playback by clicking the button. Before that click, no data is transmitted to YouTube and no information is stored on or read from your device.
Once playback starts, your IP address and technical information about your device and browser in particular may be transmitted to YouTube. The video is embedded in extended data protection mode (youtube-nocookie.com), in which the provider states that cookies are set only when a video is played.
The legal basis for the processing that takes place after playback starts is your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG; we treat your click on the play button as giving that consent. The consent applies to the individual page visit only.
It cannot be ruled out that personal data is also transmitted to Google LLC in the USA. Further information is available at https://policies.google.com/privacy
13. Google Maps
Our contact page embeds the Google Maps mapping service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to help you find your way to our practice.
The map is loaded when the contact page is opened. In doing so, your IP address and technical information about your device and browser in particular may be transmitted to Google and processed there.
It cannot be ruled out that personal data is also transmitted to Google LLC in the USA or to other companies of the Google group. For transfers to third countries, Google states that it relies among other things on the EU-US Data Privacy Framework and further appropriate safeguards.
Google Maps is embedded on the basis of your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG.
Further information on data processing by Google is available at: https://policies.google.com/privacy
14. Analytics and tracking services
This website currently uses no analytics, tracking or marketing services that record visitors' browsing behaviour or process personal data for analysis, statistical or advertising purposes.
In particular, no web analytics services such as Google Analytics, Matomo, Microsoft Clarity, Hotjar or comparable tracking technologies are used.
15. Currency of this privacy notice and changes to it
This privacy notice is dated September 2026.
We reserve the right to amend this privacy notice where this becomes necessary due to technical developments, changes to our website or changes in statutory or regulatory requirements. The version published on this website at the time applies.