Privacy Policy
1. Data Controller
The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:
DR GRŪN
Dr. med. Natalie Maureen Grün
Knaackstraße 30, 10405 Berlin
Germany
Telephone: +49 (0)30 56594641
Email: hello@dr-grun.com
Website: https://www.dr-grun.com
A Data Protection Officer has not been appointed, as the statutory requirements under Article 37 GDPR are currently not fulfilled.
2. General Information on Data Processing
This Privacy Policy provides information about the nature, scope and purposes of the processing of personal data in connection with the use of this website.
Personal data is processed exclusively in accordance with the applicable data protection legislation, in particular the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG), and any other applicable statutory data protection provisions.
For the purposes of this Privacy Policy, "personal data" means any information relating to an identified or identifiable natural person within the meaning of Article 4(1) GDPR.
Where the processing of personal data is based on your consent pursuant to Article 6(1)(a) GDPR, you may withdraw your consent at any time with effect for the future. The withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.
3. Website Hosting
This website is hosted by Squarespace, Inc. The hosting provider processes personal data on our behalf to ensure the secure, stable and efficient provision of this website.
When you visit this website, Squarespace automatically processes certain technical information required for the operation and security of the website. This information may be stored in server log files and may include, in particular:
- IP address
- Date and time of access
- Browser type and browser version
- Operating system
- Referrer URL
- Requested pages and files
- HTTP status code
- Amount of data transferred
The processing of this data is necessary to ensure the technical functionality, stability, security and integrity of the website, to detect and prevent misuse, and to maintain the availability of the online services.
The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and technically error-free operation of this website.
Further information regarding Squarespace's processing of personal data can be found in Squarespace’s Privacy Policy.
4. Contacting Us
If you contact us by email or via the contact form available on this website, we process the personal data you voluntarily provide for the purpose of handling and responding to your enquiry.
Depending on the nature of your request, the personal data processed may include:
- Name
- Email address
- Telephone number (where provided)
- Content of your enquiry
- Any additional information you voluntarily provide
The processing of your personal data is carried out for the purpose of responding to your enquiry, communicating with you and, where applicable, taking steps prior to entering into a contractual relationship.
Legal basis:
- Article 6(1)(b) GDPR, where the enquiry relates to the initiation or performance of a
contractual relationship.
- Article 6(1)(f) GDPR, where the processing is based on our legitimate interest in responding to general enquiries and communicating with website visitors.
Your personal data will be deleted once your enquiry has been fully processed, unless statutory retention obligations or other legal obligations require longer storage.
Alternatively, you may also contact us by telephone using the contact details provided on this website.
5. Online Appointment Booking via Doctolib
This website provides the option to book appointments online via the external appointment booking platform Doctolib.
By clicking the appointment booking link or button, you leave this website and are redirected to the website of Doctolib GmbH. From this point onwards, the processing of personal data is carried out by Doctolib under its own responsibility in accordance with its applicable Privacy Policy.
If you book an appointment via Doctolib, the following personal data may be processed, in particular:
- Name
- Contact details
- Appointment details
The processing of this data serves the purpose of organising and managing medical appointments, facilitating communication in connection with your appointment and, where applicable, taking steps prior to entering into a treatment contract.
Legal basis:
- Article 6(1)(b) GDPR.
Further information regarding the processing of personal data by Doctolib can be found in Doctolib’s Privacy Policy.
6. Digital Patient Intake, Medical Documentation and Practice Management
Following the booking of an appointment via Doctolib, patients may receive a secure link to the digital patient platform Nelly. Nelly is used for digital patient registration, completion of medical questionnaires, electronic consent forms, treatment-related documentation and internal practice administration.
Depending on the services used and the information voluntarily provided by the patient, the following categories of personal data may be processed:
- Personal identification data
- Contact details
- Appointment information
- Medical history
- Health data
- Medical questionnaires
- Electronic consent forms
- Treatment-related information
- Medical documentation
- Billing-related information, where applicable
The processing of this data is carried out exclusively for the preparation, organisation, performance, documentation and follow-up of medical treatment and related administrative processes. Health data constitutes a special category of personal data within the meaning of Article 9 GDPR.
Legal basis:
- Article 6(1)(b) GDPR
- Article 9(2)(h) GDPR
- Section 22(1)(1)(b) BDSG
Further information regarding the processing of personal data by Nelly is available in Nelly’s Privacy Policy.
7. Laboratory Diagnostics
Where medically indicated, we may cooperate with external accredited medical laboratories, including IMD Laboratory Berlin, for the purpose of performing laboratory diagnostics. Where necessary for the provision of medical care, personal data and special categories of personal data, including health data, may be transferred to the respective laboratory to the extent required for the requested diagnostic services.
The processing and transfer of such data are carried out exclusively for the purposes of medical diagnostics, treatment, treatment planning and the provision of healthcare services.
Legal basis:
- Article 6(1)(b) GDPR
- Article 9(2)(h) GDPR
8. Cookies and Consent Management
This website uses cookies and similar technologies (collectively referred to as “cookies” to ensure the secure operation of the website, provide essential website functions and, subject to your consent, analyse the use of the website.
Cookies are small text files that are stored on your device by your web browser. They enable the recognition of your browser, the storage of certain preferences and the provision of specific website functionalities.
Some cookies are technically necessary for the operation of the website and cannot be disabled through the cookie settings. Other cookies, including analytics cookies, are only used if you have provided your explicit consent.
Your cookie preferences are managed through the Squarespace Cookie Banner, which allows you to:
- accept all cookies,
- reject non-essential cookies, or
- customise your individual cookie preferences.
You may withdraw or modify your consent at any time with effect for the future by adjusting your cookie preferences.
Legal basis:
- Article 6(1)(a) GDPR (consent)
- Article 6(1)(f) GDPR (legitimate interest for technically necessary cookies)
- Section 25(1) and Section 25(2) TDDDG
9. Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics enables us to analyse the use of this website in order to evaluate website performance, improve user experience and optimise our online presence. Google Analytics is activated only after you have provided your explicit consent via the Squarespace Cookie Banner. If consent is not granted, Google Analytics will not be activated. Depending on your use of the website, Google Analytics may process the following categories of personal data:
- IP address (processed in accordance with Google Analytics 4 functionality)
- Device information
- Browser type and browser settings
- Operating system
- Website usage data
- Pages visited
- Date and time of access
- Referrer URL
- Approximate geographic location
- Events and interactions on the website
The current configuration of Google Analytics on this website is as follows:
- Google Signals is disabled.
- User-ID functionality is not used.
- The retention period for user-related data is limited to 2 months.
- The option to reset the retention period upon new user activity is disabled.
Personal data collected through Google Analytics may be processed by Google in accordance with its applicable privacy documentation. Where personal data is transferred outside the European Economic Area (EEA), the safeguards described in Section 10 (“International Data Transfers”) apply. You may withdraw your consent at any time with effect for the future by changing your cookie preferences.
Legal basis:
- Article 6(1)(a) GDPR
- Section 25(1) TDDDG
Further information regarding Google's processing of personal data is available in Google’s Privacy Policy.
10. International Data Transfers
Certain service providers engaged in connection with this website may process personal data outside the European Economic Area (EEA) or permit access to personal data from countries outside the EEA.
Where such transfers take place, they are carried out only where an adequate level of data protection is ensured in accordance with Chapter V GDPR. Depending on the individual service provider, appropriate safeguards may include:
- an adequacy decision adopted by the European Commission pursuant to Article 45 GDPR;
- the EU Standard Contractual Clauses (SCCs) pursuant to Article 46 GDPR; or
- any other safeguard recognised under applicable data protection legislation.
Where applicable, further information regarding international data transfers is available in the privacy policies of the respective service providers.
11. Data Security
We implement appropriate technical and organisational measures (TOMs) in accordance with Article 32 GDPR to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
These measures are designed to ensure a level of security appropriate to the risk associated with the processing of personal data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, as well as the likelihood and severity of potential risks to the rights and freedoms of natural persons.
This website uses SSL/TLS encryption to protect the transmission of confidential information. An encrypted connection can be recognised by the “https://” prefix in the browser address bar and the padlock symbol displayed by your browser.
Despite the implementation of appropriate security measures, the transmission of data over the internet cannot be guaranteed to be completely secure. We therefore recommend that confidential information is transmitted only via secure communication channels.
12. External Links to Third-Party Websites and Services
This website contains links to external websites and third-party services. These links are provided solely for your convenience and to facilitate access to external services.
The external links currently include, in particular:
- Instagram
- Doctolib (online appointment booking)
When you visit this website, no personal data is transmitted to these third-party providers merely by displaying these links. Only by actively clicking on an external link will you leave this website and establish a direct connection to the respective third-party website. From this point onwards, the processing of personal data is carried out solely under the responsibility of the respective provider.
We have no influence over the processing of personal data by third-party providers. For further information regarding the processing of personal data by these providers, please refer to their respective Privacy Policies.
13. Recipients of Personal Data
Personal data will only be disclosed to third parties where this is necessary for the purposes described in this Privacy Policy, where required or permitted by applicable law, or where you have provided your consent.
Depending on the nature of the processing activity, recipients or categories of recipients may include, in particular:
- Squarespace, Inc. (website hosting and technical infrastructure)
- Google Ireland Limited (Google Analytics 4, subject to your consent)
- Doctolib GmbH (online appointment booking, appointment management, patient communication, electronic medical records, medical documentation and digital practice management)
- Nelly Solutions GmbH (digital patient registration, medical questionnaires, electronic consent forms, digital document management and administrative processes)
- IMD Laboratory Berlin or other accredited medical laboratories (where medically indicated)
- IT service providers supporting the operation and security of our IT systems
- Tax advisers, accountants and other professional advisers, where required
- Public authorities, courts or other public bodies where disclosure is required or permitted by applicable law Personal data is disclosed only to the extent necessary for the respective purpose and in accordance with the applicable legal requirements.
14. Data Retention
Personal data is stored only for as long as necessary to fulfil the purposes for which it was collected or as long as required by applicable statutory retention periods. Where no statutory retention period applies, personal data will be deleted or anonymised once the respective purpose of processing has ceased to exist and no other legal basis for further storage applies.
Medical records and other treatment-related documentation are retained in accordance with the applicable statutory retention obligations. As a general rule, medical treatment records are retained for at least ten (10) years following the completion of treatment, unless longer retention periods are required by law in individual cases.
This includes, in particular, the statutory retention obligations pursuant to Section 630f German Civil Code (Bürgerliches Gesetzbuch – BGB) and the applicable professional regulations governing medical practitioners.
15. Your Rights
Under the applicable data protection laws, in particular the GDPR, you have the following rights with regard to the processing of your personal data:
- Right of access to your personal data (Article 15 GDPR)
- Right to rectification of inaccurate or incomplete personal data (Article 16 GDPR)
- Right to erasure ("right to be forgotten"), where the legal requirements are met (Article 17 GDPR)
- Right to restriction of processing (Article 18 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to object to the processing of your personal data under the conditions set out in Article 21 GDPR
- Right to withdraw your consent at any time with effect for the future, where processing is based on your consent (Article 7(3) GDPR)
The withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal. Requests concerning the exercise of your data protection rights may be submitted using the contact details provided in Section 1 of this Privacy Policy.
16. Right to Lodge a Complaint
If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. Without prejudice to any other administrative or judicial remedy, the competent supervisory authority for our practice is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
17. Updates to this Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes in legal requirements, regulatory guidance, technical developments, or changes to our data processing activities. The version of the Privacy Policy published on this website shall be the version currently in force. We therefore recommend that you review this Privacy Policy periodically to stay informed about how we process and protect your personal data.
Last updated: July 2026