Privacy Policy

How We Handle Your Data

Protecting your personal data is a matter of great importance to us. We process your data exclusively on the basis of statutory provisions (GDPR, BDSG, TDDDG). In this privacy policy, we inform you about the nature, scope, and purpose of the processing of personal data within the context of our online services.

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, your name, address, email address, or IP address.

As a physiotherapy practice, we may also process health data, which is subject to special protection under Article 9 GDPR. How we handle this data is explained separately in Section 12 (Contact and Appointment Requests) and Section 13 (Storage Duration).

Please note that data transmission over the internet (e.g., when communicating by email) can have security vulnerabilities. Complete protection of data against access by third parties is not possible.

1. Data Controller

The controller within the meaning of the General Data Protection Regulation is:

Lämmerhirt Practice
Civil-law partnership (GbR), represented by the partners Martin Lämmerhirt and Jennifer Lämmerhirt
Schillerstraße 30–40
60313 Frankfurt am Main, Germany
Phone: +49 (0) 69 92038093
Fax: +49 (0) 69 92038094
Email: info@praxis-laemmerhirt.de

No data protection officer has been appointed. Under Article 37 GDPR in conjunction with Section 38 BDSG, there is no obligation to do so: fewer than 20 people in our practice are permanently engaged in the automated processing of personal data. As a small joint practice, we also do not carry out large-scale processing of special categories of personal data within the meaning of Article 37(1)(c) GDPR (cf. Short Paper No. 12 of the German Data Protection Conference).

2. Rights of Data Subjects

As a data subject, you have the following rights:

a) Right to Information, Erasure, and Rectification
Within the scope of the applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipients, and the purpose of the data processing (Article 15 GDPR), and, where applicable, a right to rectification (Article 16 GDPR) or erasure (Article 17 GDPR) of this data. Please note that statutory retention periods apply to treatment records (see Section 13), which may prevent immediate erasure.

b) Right to Data Portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format (Article 20 GDPR). If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

c) Right to Restriction of Processing
You have the right to request the restriction of the processing of your personal data (Article 18 GDPR). This right exists in particular if you contest the accuracy of the data, if the processing is unlawful, if we no longer need the data but you require it to assert legal claims, or if you have objected to the processing pursuant to Article 21 GDPR.

d) Withdrawal of Your Consent to Data Processing
Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by the withdrawal.

e) Right to Object to Data Collection in Special Cases and to Direct Marketing (Article 21 GDPR)
If the data processing is based on Article 6(1)(e) or (f) GDPR, you have the right at any time to object, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on these provisions. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves to assert, exercise, or defend legal claims. If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is connected with such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing.

f) Right to Lodge a Complaint with the Competent Supervisory Authority
In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work, or the place of the alleged violation. The supervisory authority responsible for us is:

The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
P.O. Box 3163, 65021 Wiesbaden, Germany

3. Legal Basis for Processing

Where we obtain consent from the data subject for processing operations involving personal data, Article 6(1)(a) GDPR serves as the legal basis. When processing to fulfill a contract or to carry out pre-contractual measures, Article 6(1)(b) GDPR serves as the legal basis. Insofar as processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR serves as the legal basis. If the processing is necessary to protect legitimate interests and the interests, fundamental rights, and freedoms of the data subject do not override these interests, Article 6(1)(f) GDPR serves as the legal basis.

Insofar as health data is processed, the processing is additionally based on Article 9(2)(h) GDPR (processing for the purposes of health care, medical diagnosis, and treatment) in conjunction with Section 22 BDSG, or on your express consent pursuant to Article 9(2)(a) GDPR.

4. Note on Data Transfer to Third Countries

Among other things, we use services whose providers are based in the USA. This may result in a transfer of personal data to the USA. For the USA, there is an adequacy decision by the EU Commission (EU-US Data Privacy Framework). Insofar as we transfer data to providers certified under the Data Privacy Framework or with whom standard contractual clauses pursuant to Article 46 GDPR have been agreed, an adequate level of data protection is guaranteed.

5. Cooperation with Processors and Third Parties

Insofar as, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them, or otherwise grant them access to the data, this is done only on the basis of a legal permission, your consent, a legal obligation, or on the basis of our legitimate interests. Insofar as we commission third parties to process data on the basis of a data processing agreement, this is done on the basis of Article 28 GDPR.

6. Cookie Consent with Complianz

Our website uses the consent technology of Complianz to obtain your consent for the storage of certain cookies in your browser and to document this in compliance with data protection regulations. The provider of this technology is Complianz B.V., Atoomweg 6B, 9743 AK Groningen, Netherlands.

When you enter our website, a connection is established in order to obtain and store your consent. The consent data collected in this process is stored until you request its deletion, delete the Complianz cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected.

Complianz is used in order to obtain the legally required consent for the use of cookies. The legal basis for this is Article 6(1)(c) GDPR.

7. Server Log Data (Access Data)

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address

This data is not merged with other data sources. The collection of this data is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website. The log files are stored for security reasons (e.g., to investigate cases of misuse or fraud) for a maximum of 14 days and then deleted.

8. Hosting

This website is hosted by an external service provider. The provider is Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany. The personal data collected on this website is stored on the hoster's servers. This may include, in particular, IP addresses, contact requests, meta and communication data, names, website accesses, and other data generated via a website.

The hoster is used in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Article 6(1)(f) GDPR) and, where applicable, to fulfill a contract (Article 6(1)(b) GDPR). We have concluded a data processing agreement (DPA) with the hoster pursuant to Article 28 GDPR.

9. Google Analytics 4

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables us to analyze the behavior of website visitors. In doing so, the website operator receives various usage data, such as pages viewed, time spent, operating systems used, and the origin of users. Google Analytics uses technologies that enable the recognition of the user for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The data collected may be transferred to Google servers in the USA.

Google Analytics is used exclusively on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent can be withdrawn at any time. The transfer to the USA is based on the EU-US Data Privacy Framework and the standard contractual clauses of the EU Commission.

10. Google Ads and Conversion Tracking

We use the online advertising program Google Ads and, within this framework, conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads conversion tracking serves to evaluate the effectiveness of our advertisements. When you click on an ad placed by Google, a cookie for conversion tracking is set. If you then visit certain pages of our website, Google and we can recognize that you clicked on the ad and were directed to that page. The information collected in this process is used to create conversion statistics. We learn the total number of users who clicked on our ad. We do not receive any information with which users can be personally identified.

Use is based exclusively on your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent can be withdrawn at any time.

Integration via Google Tag Manager
To manage the tracking technologies used, we use Google Tag Manager. The provider is Google Ireland Limited. Google Tag Manager itself does not create user profiles, does not store cookies, and does not carry out any independent analyses. It merely serves to manage and deliver the tools integrated through it. However, Google Tag Manager does record your IP address, which may also be transferred to Google. The tools integrated via Tag Manager (Google Analytics, Google Ads) are only triggered after your consent via the consent mechanism.

11. Google Maps

This page uses the map service Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary to store your IP address. This information is generally transferred to a Google server in the USA and stored there. The provider of this page has no influence on this data transfer. When Google Maps is active, Google may use Google Fonts for the uniform display of fonts.

Google Maps is used on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. The map is only loaded after you have given your consent via the cookie banner.

12. Contact and Appointment Requests

Contact and Appointment Requests via the Form
On our website, we offer you the option of contacting us via a form or requesting an appointment. The following information is processed: salutation, first name, last name, phone number, email address, and your entries in the free-text field (description of your request). Your information is stored by us for the purpose of processing the request and in case of follow-up questions.

Note on Health Data: Our request form contains a free-text field for your request. Should you voluntarily provide information about your state of health or complaints in this field, this constitutes special categories of personal data pursuant to Article 9 GDPR. The processing of this information is based exclusively on your voluntary, express consent pursuant to Article 9(2)(a) GDPR, which you grant by submitting the form. You are not obligated to provide health information — for an appointment request, your name and contact details are sufficient.

The processing of the data from the contact form is based on Article 6(1)(b) GDPR, insofar as your request is related to the initiation of a treatment contract, and otherwise on the basis of our legitimate interest in the effective processing of the requests directed to us (Article 6(1)(f) GDPR), as well as — with regard to any health information — on your consent (Article 9(2)(a) GDPR).

The form is implemented using Elementor Pro Forms. The data submitted via the form is sent by email to our practice (info@praxis-laemmerhirt.de) and stored there to process your request.

Requests by Email, Phone, or Fax
If you contact us by email, phone, or fax, your request, including all personal data resulting from it (name, request), will be stored and processed by us for the purpose of handling your inquiry. The processing is based on the legal bases mentioned above.

The data you send us remains with us until you request its deletion, withdraw your consent to storage, or the purpose for storing the data no longer applies. Mandatory statutory provisions — in particular retention periods — remain unaffected.

13. Storage Duration

Unless a more specific storage duration has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for erasure or withdraw your consent to data processing, your data will be deleted, provided we do not have any other legally permissible grounds for storing it.

For treatment records, the statutory retention period under Section 630f(3) of the German Civil Code (BGB) of generally ten years after the conclusion of treatment applies; in certain cases, longer periods may apply.

14. Social Media Presences

We maintain profiles on social networks in order to communicate with the users active there and to inform them about our services. If you follow a link on our website to one of our social media profiles, you leave our website. The data protection provisions of the respective network then apply.

When you visit our social media profiles, your personal data is processed by the respective platform operator. We have only limited influence over this processing. Insofar as we are jointly responsible for the processing together with the platform operator, we have concluded corresponding agreements.

We are represented on the following networks:

Facebook (including Facebook pages and groups)
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The processing is based on an agreement on joint processing of personal data (Article 26 GDPR).
Privacy policy: https://www.facebook.com/privacy/policy
Opt-out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com/

Instagram
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Privacy policy and opt-out: https://privacycenter.instagram.com/policy

LinkedIn
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
Privacy policy: https://www.linkedin.com/legal/privacy-policy

Last updated: September 2026