Privacy notice
This is a courtesy translation. In case of any discrepancy, the German version is authoritative.
1. Controller
Henning Finck
Alter Güterbahnhof 4 B
22303 Hamburg, Germany
Phone: +49 151 24 23 15 92
Email: praxis@henning-finck.de
2. General
Protecting your personal data matters to me. I process personal data solely in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable data protection law. Personal data means any information relating to an identified or identifiable natural person.
3. Purposes and legal bases
Personal data is processed solely to provide this website, to deal with enquiries, to take steps prior to entering into a contract, to arrange appointments and to comply with legal obligations.
The legal bases are Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual steps), (c) (legal obligation) and (f) (legitimate interests). Where health data is processed, processing is additionally based on Art. 9(2)(a) GDPR (explicit consent) and Art. 9(2)(h) GDPR (healthcare and treatment).
4. Hosting
This website is hosted by STRATO. When you visit, server log files are processed automatically, including your IP address, the date and time of access, browser type, operating system, referrer URL and the pages requested. This is based on Art. 6(1)(f) GDPR, in the interest of secure and stable operation. Where required, a data processing agreement under Art. 28 GDPR is in place with the hosting provider.
5. No third-party content
This website embeds no content from third-party servers. Fonts, images, video, stylesheets and scripts are served exclusively from this server. In particular, no Google Fonts, no mapping services and no external video platforms are used. Visiting this site therefore transmits your IP address to no third party.
6. TLS encryption
This website uses TLS encryption to protect confidential content in transit. The contact form is transmitted to the website's server exclusively over this encrypted connection.
7. Contact form
The details collected through the contact form (first name, surname, email address, phone number, preferred appointment times and your free-text description of your concern) are transmitted in encrypted form to this website's server and forwarded from there to the practice by email. Form data is not stored in a database.
Because what you write about your concern will regularly permit inferences about your health, it constitutes a special category of personal data within the meaning of Art. 9(1) GDPR. Processing therefore takes place solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give separately in the form. You may withdraw that consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal is unaffected.
To guard against automated submissions, the form contains a hidden field that a human visitor will not fill in. No further analysis of your behaviour takes place.
8. Contact by email and telephone
If you contact me by email or telephone, the details you provide are processed solely to deal with your enquiry, on the basis of Art. 6(1)(b) or Art. 6(1)(f) GDPR. Please note that unencrypted email is not secure against access by third parties. For confidential matters, please use the contact form or the telephone.
9. Appointment booking via Doctolib
Doctolib is used for online appointment booking. On this website Doctolib is linked only, and not embedded as a widget or iframe. No data is transmitted until you actively click a Doctolib link and open Doctolib's own site. The personal data required for booking is then processed there by Doctolib GmbH as an independent controller. Doctolib's privacy policy applies in addition.
10. Cookies
This website sets no cookies. No analytics, marketing or tracking services are used. A consent banner is therefore not required.
11. Recipients
Personal data is disclosed only to the hosting provider STRATO as a processor, to Doctolib GmbH as an independent controller if you actively use that service, where required by law, or with your explicit consent. No transfer to third countries outside the EU/EEA takes place.
12. Retention
Personal data is retained only for as long as necessary for the relevant purpose or as required by statutory retention periods. Enquiries that do not lead to treatment are deleted no later than six months after the matter is closed. Treatment records are subject to the retention periods under professional law.
13. Your rights
Subject to the conditions of the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent at any time with effect for the future (Art. 7(3)).
14. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
15. Data security
Appropriate technical and organisational measures are in place to protect personal data against loss, manipulation and unauthorised access. These measures are reviewed on an ongoing basis in line with technical developments.
16. Data protection officer
This practice is currently under no statutory obligation to appoint a data protection officer under § 38 BDSG.
17. Changes to this notice
This privacy notice will be updated whenever legal requirements or the technical services actually in use change.
Last updated: September 2026