Privacy notice

This is a courtesy translation. In case of any discrepancy, the German version is authoritative.

1. Controller

The controller for the processing of personal data on this website within the meaning of Art. 4(7) GDPR is:

Henning Finck
Alter Güterbahnhof 4b
22303 Hamburg, Germany

Phone: +49 151 24 23 15 92
Email: praxis@henning-finck.de

2. General

Protecting your personal data matters to me. I process personal data solely in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Digital Services Act (DDG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Personal data means any information relating to an identified or identifiable natural person.

3. Purposes and legal bases

Personal data is processed in order to provide this website, to deal with enquiries, to take steps prior to entering into a contract, to arrange appointments, to display patient reviews and to comply with legal obligations.

The legal bases are Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual steps), (c) (legal obligation) and (f) (legitimate interests). Where health data is processed, processing is additionally based on Art. 9(2)(a) GDPR (explicit consent) and Art. 9(2)(h) GDPR (healthcare and treatment).

4. Hosting and server log files

This website is hosted by STRATO AG. When you visit, server log files are processed automatically. These comprise your IP address, the date and time of access, browser type and version, operating system, referrer URL, the volume of data transferred and the pages requested.

This processing is technically necessary in order to deliver the website, to maintain its stability and security and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR. This data is not combined with other sources and is not analysed for advertising or analytics purposes. Log files are deleted automatically once the retention period configured at the hosting provider has elapsed.

A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

5. Review components embedded from Doctify

Review components from the review platform Doctify are embedded on the home page, on the “About” page and on the “Therapeutic approach” page. The provider is Doctify Ltd., London, United Kingdom.

What is transmitted. When you open a page containing such a component, your browser connects directly to Doctify's servers. Your IP address is transmitted to Doctify, together with technical details such as browser type and version, operating system, language setting, the date and time of access and the specific page requested. Doctify may also store information on your device or read information already stored there.

Who is responsible for what. For the collection of this data and its transmission to Doctify, I am a joint controller together with Doctify within the meaning of Art. 26 GDPR, following the judgment of the Court of Justice of the European Union of 29 July 2019 (Case C-40/17). Doctify alone is responsible for its subsequent processing of the data, over the nature and extent of which I have no influence. You may exercise your rights as a data subject against me and against Doctify alike.

Legal basis. Art. 6(1)(f) GDPR. My legitimate interest lies in making independently collected and verified feedback from other patients available to prospective patients. You may object to this processing at any time — see section 14.

Transfer to a third country. The transfer is to the United Kingdom. An adequacy decision of the European Commission under Art. 45 GDPR is in place for the United Kingdom, establishing an adequate level of data protection; no additional safeguards are therefore required.

Retention. Doctify determines how long it retains this data. For details, and for the cookie terms that apply there, please see Doctify's privacy notice.

Beyond this, the website embeds no content from third-party servers. This website's own fonts, images, video and stylesheets are served exclusively from this server; the components themselves load their stylesheets, fonts and images from Doctify's servers. In particular, no Google Fonts, no mapping services and no external video platforms are used.

6. Leaving a review via Doctify

The contact page carries a link and a QR code through which you can leave a review on Doctify. No data is transmitted for that purpose until you actively follow the link or scan the code. In doing so you leave this website; Doctify alone is responsible for the processing that takes place there.

Leaving a review is voluntary. It has no bearing on your treatment, and a review is neither expected nor rewarded.

7. TLS encryption

This website uses TLS encryption to protect confidential content in transit. The contact form is transmitted to the website's server exclusively over this encrypted connection.

8. Contact form

The details collected through the contact form — first name, surname, email address, phone number, preferred appointment times and your free-text description of your concern — are transmitted in encrypted form to this website's server and forwarded from there to the practice by email. Form data is not stored in a database.

Because what you write about your concern will regularly permit inferences about your health, it constitutes a special category of personal data within the meaning of Art. 9(1) GDPR. Processing therefore takes place solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give separately in the form. You may withdraw that consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal is unaffected.

Whether you have to provide the data. You are under no statutory or contractual obligation to provide your data. Without your name, email address, telephone number and a description of your concern, however, I cannot deal with your enquiry.

To guard against automated submissions, the form contains a hidden field that a human visitor will not fill in. No further analysis of your behaviour takes place.

9. Contact by email, telephone and WhatsApp

If you contact me by email or telephone, the details you provide are processed solely to deal with your enquiry, on the basis of Art. 6(1)(b) or Art. 6(1)(f) GDPR. Please note that unencrypted email is not secure against access by third parties. For confidential matters, please use the contact form or the telephone.

WhatsApp. The contact page has a link you can use to message me on WhatsApp. No data is transmitted unless you actively open that link. The provider is WhatsApp Ireland Limited, Dublin, a Meta group company. According to the provider, message content is end-to-end encrypted; however, the provider processes connection and device data such as your phone number and the time of the message on its own responsibility, possibly also outside the European Union. WhatsApp's privacy policy applies. I process the details you send me solely to deal with your enquiry, on the same legal basis as above. Please use WhatsApp for appointment questions only and do not send me details about your health there.

10. Appointment booking via Doctolib and other linked services

Doctolib is used for online appointment booking. On this website Doctolib is linked only, and not embedded as a widget or iframe. No data is transmitted until you actively click a Doctolib link and open Doctolib's own site. The personal data required for booking is then processed there by Doctolib GmbH as an independent controller. Doctolib's privacy policy applies in addition.

Other linked services. This website also links to Google Maps for directions (Google Ireland Limited) and to Instagram (Meta Platforms Ireland Limited). These services are not embedded. No data is transmitted unless you actively click such a link; the respective provider is responsible for any processing on its site. The Doctify badge on the fees and terms page is likewise served from this server and is simply a link.

11. Cookies and storage on your device

This website itself sets no cookies. I use no analytics, marketing or tracking services, and no usage profile is created.

The Doctify components described under section 5 may set cookies, or store and read information on your device, when they load. What exactly they store is determined by Doctify; their privacy and cookie notices govern this. You can block cookies generally or for individual websites in your browser settings, and delete cookies already set there.

12. Recipients of personal data

Personal data is disclosed to:

• STRATO AG as a processor, for hosting and email delivery;
• Doctify Ltd., when the components described under section 5 load and when you actively use the review link described under section 6;
• Doctolib GmbH, if you actively use the online booking service;
• WhatsApp Ireland Limited, if you actively contact me via WhatsApp;
• the providers of the services named under section 10, if you actively click their links;

and otherwise only where required by law or with your explicit consent. When the components load, the only transfer to a third country is to the United Kingdom, on the basis of the adequacy decision referred to under section 5. If you actively use WhatsApp or one of the services named under section 10, the respective provider processes your data on its own responsibility, possibly also outside the European Union. Personal data is never sold.

13. Retention

Personal data is retained only for as long as necessary for the relevant purpose or as required by statutory retention periods. Enquiries that do not lead to treatment are deleted no later than six months after the matter is closed. Treatment records are subject to the retention periods under professional law, generally ten years after the end of treatment.

14. Your right to object under Art. 21 GDPR

15. Your other rights

Subject to the conditions of the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to withdraw consent at any time with effect for the future (Art. 7(3)). Exercising these rights is free of charge. A message to the contact details under section 1 is sufficient.

16. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany

17. Data security

Appropriate technical and organisational measures under Art. 32 GDPR are in place to protect personal data against loss, manipulation and unauthorised access. These include end-to-end transport encryption for this website, the avoidance of any unnecessary collection of data, and restricting access to the controller. The measures are reviewed on an ongoing basis in line with technical developments.

18. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

19. Data protection officer

This practice is currently under no statutory obligation to appoint a data protection officer under Art. 37 GDPR or § 38 BDSG. For any data protection enquiry, please use the contact details under section 1.

20. Changes to this notice

This privacy notice will be updated whenever legal requirements or the technical services actually in use change. The version published here is the one that applies.

Last updated: November 2026