Data Protection
This privacy notice explains the processing of personal data when visiting our website and via the contact channels described below. There is also detailed information regarding the AI telephone assistant “Luna,” linked below.
As of: September 21, 2026
Data Controller
Dr. Stefan Schmid, freelance dentist
diadentis · Dental Practice Dr. Stefan Schmid
Rellinghauser Straße 304
45136 Essen
Phone: 0201 25 794
Email: info@diadentis.de
You can also use these contact details to reach Dr. Stefan Schmid regarding data protection questions, to withdraw consent, or to exercise your rights. The following information applies to our website and the described contact channels; This does not affect separate patient information regarding dental treatment.
Website Operation by IONOS
Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. When the website is accessed, the hosting service processes technically necessary connection and access data: specifically, the requested page or file, access time, technical response status, information regarding the browser and operating system, the previously visited page (if applicable), and IP-related connection details. The website cannot be delivered to your device without this necessary connection data.
This processing serves the purpose of delivering the website, troubleshooting, and protecting against misuse and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable operation of the website. Recipients include IONOS as the hosting data processor, as well as the infrastructure, operations, and security service providers engaged for technical operations.
IONOS retains web server logs for the product we use for a maximum of eight weeks. The logs are replaced as part of the standard rotation process. Investigating a specific security incident may require separate retention limited to the resolution of that incident. An abbreviated IP address does not mean that all log data is anonymous: requested addresses, timestamps, or additional information from upstream servers can also be linked to an individual. Further information: IONOS on web server logs.
Website security check with SiteLock: For diadentis.de, we use the “Site Scan + Repair” service provided by IONOS. This cloud-based security service scans website content and technical components for malware and vulnerabilities; the repair function automatically eliminates detected threats. Where personal data is required for security purposes in this context, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and its visitors from malicious interference. IONOS engages SiteLock LLC, 8701 East Hartford Drive, Suite 200, Scottsdale, AZ 85255, USA, as a sub-processor for this purpose. The IONOS contract annex cites EU Standard Contractual Clauses as the safeguard for data transfers to this service provider. You can request information and a copy of the safeguards relevant to the transfer using the contact details provided above. Further details can be found in the IONOS documentation on data processing and the description of Site Scan + Repair. The security service is separate from the visitor statistics.
Log-based analysis with IONOS WebAnalytics
IONOS WebAnalytics processes access data generated during web hosting into statistics—for example, regarding requested pages, visitor numbers, referral sources, and technical device or browser groups. This allows us to assess the usage and technical quality of our service. This server-side analysis is separate from Google Analytics. It is based on server data generated during access requests and, in this log-based form, does not require an additional statistics cookie on your device.
The legal basis for this processing—which is limited to usage and quality analysis—is Art. 6(1)(f) GDPR. IONOS specifies a retention period of eight weeks for the underlying visitor data in its web hosting product information. Further details regarding the analysis can be found in the product information for IONOS WebAnalytics. You may object to processing based on legitimate interests under the conditions described below.
Your cookie and privacy choices
We use Complianz to manage your choices regarding optional services. You can retain necessary functions, allow an optional category, or change your selection later. Optional categories are not pre-selected. Use of our website and personal contact channels does not require consent to visitor statistics.
Your choices are stored in technically necessary cookies on your device. This storage serves to respect your decision so that you are not asked again each time you load a page. It is required under Section 25(2) No. 2 of the TDDDG for the consent management service you have requested. Where personal data is processed in this context to fulfill our obligations regarding consent and record-keeping, Article 6(1)(c) in conjunction with Article 5(2) and Article 7(1) of the GDPR applies. In the current configuration, we do not maintain an additional, separate server-side consent log via Complianz.
You can access your selection again via “Privacy Settings” and the Cookie Policy. There, you will also find the names, purposes, and durations of the cookies used. A withdrawal of consent applies to the future; it does not retroactively invalidate processing that took place prior to the withdrawal. If you delete the saved selection in your browser, the website may ask for your decision again.
Google Analytics only with your consent
If you enable “Statistics” in the privacy settings, we use Google Analytics 4 to analyze the use of our website and contact options, as well as general visitor sources. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the analytics data on our behalf as a data processor. Without this consent, the Google tag is not loaded, and no so-called cookie-less measurement ping is sent. You can use the website and the appointment scheduling feature regardless of this decision.
Once you have given your consent, we track general page views as well as clicks on the appointment button, phone numbers, email contact links, and links to review profiles. For contact clicks, we also record the general area of the website: header, mobile navigation, main content, or footer. A click on the appointment button does not constitute a completed appointment booking; actual completed bookings are not currently reported to Google Analytics.
Page addresses and page titles are replaced with standardized, neutral values. Furthermore, the full address of the previously visited website is not transmitted to Google. Where identifiable following your consent, our implementation locally derives a general indication of the traffic source—such as Google, Bing, Facebook, Instagram, ChatGPT, Perplexity, or another external referral. Additionally, predefined, neutral campaign identifiers associated with our practice profiles may be analyzed. Unknown campaigns are recorded simply as an unassigned category. We do not create any additional browser storage of our own for this source attribution. If source information is missing or consent is granted only after navigating to another page, the original source may remain unknown.
Specific treatment pages, search terms, full referral URLs, arbitrary URL parameters, ad click IDs, link destinations, contact details, form contents, and data from the Dr. Flex dialog are not transmitted as distinct analytics parameters. General page counts do not include the name of the specific treatment viewed. Automatic page/history tracking and enhanced measurements remain disabled. Google Signals, ad personalization, and data transmission for advertising purposes also remain disabled. No individual health or treatment pathways are analyzed.
The connection to Google nonetheless transmits technical data. Analytics uses random cookie and session IDs and may supplement this with technical event information. Consequently, the data is not automatically anonymous. According to Google product information, IP addresses of individuals in the EU are discarded prior to logging. This does not mean that Google does not receive an IP address when the connection is established, nor does it mean that all subsequent processing takes place within the EU.
The basis for the optional storage of information on and access to information from your device is your consent pursuant to Section 25 (1) TDDDG; the basis for the subsequent processing of personal data is Art. 6 (1) (a) GDPR. Consent is voluntary and may be revoked for the future via “Privacy Settings” or the Cookie Policy. Upon revocation, our integration ceases further measurement and removes the analytics cookies it had set. Revocation does not automatically delete data that has already been transmitted to Google. For any data protection-related inquiries, please contact info@diadentis.de.
Data retention and cookies
The retention period for user- and event-level analytics data is limited to two months; new activity does not reset this period. Standard reports that have already been aggregated are not affected by this setting to the same extent. Details are explained by Google regarding data retention.
Our implementation uses the proprietary cookies diadentis_live_ga to distinguish between browsers and diadentis_live_ga_JY8WJD6P9J for session status. They apply only to the specific website host accessed. The configured duration is 395 days from the time they are set or renewed by the Google tag; browsers may apply shorter limits. You can delete the cookies yourself at any time or withdraw your consent for statistics. The cookie duration is distinct from the two-month data retention period in Analytics.
Recipients and international processing
Recipients include Google Ireland Limited as well as affiliated companies and technical subcontractors for infrastructure, operations, and support. This includes potential processing in the USA. For transfers to appropriately certified US companies, Google relies on the adequacy decision regarding the EU-US Data Privacy Framework. For transfers not covered by an adequacy decision, Google utilizes EU Standard Contractual Clauses. These safeguards do not constitute a guarantee that identical data protection laws apply worldwide.
Further information and the option to request a copy of the relevant safeguards can be found in the Google information on data transfers. Additionally, the Google Data Processing Terms and the Google Privacy Policy apply. You may also contact us directly with questions regarding processing on our website.
Online appointment booking with Dr. Flex
‘Book an appointment’ opens the Dr. Flex booking interface. It loads only after your selection; simply visiting our site does not open it. Alternatively, you can arrange an appointment by telephone on 0201 25 794.
The service provider is Dr. Flex GmbH, Stresemannstraße 21, 10963 Berlin. Regarding the booking interface provided on our website, Dr. Flex processes booking data as a data processor on behalf of our practice in accordance with Art. 28 GDPR. Hosting, operational, and communication service providers are involved in the technical provision of the service.
Connection data, such as IP address and browser information, is generated when the interface loads. Our integration transmits a neutral appointment URL; the name of the treatment previously viewed is not passed to the booking interface as a page URL or referral URL. During the process, we handle the appointment details you select, as well as the identification and contact information requested therein. This may include your name, date of birth, email address, mobile number, insurance status, and details regarding the desired treatment. The fields actually offered are the ones that apply; information marked as required is necessary for the online booking process.
The purposes include selecting, booking, changing, or cancelling an appointment, as well as related communication. The legal basis is Art. 6(1)(b) GDPR regarding the appointment scheduling you have requested. Where health data must be processed for the provision of care, Article 9(2)(h) and Article 9(3) of the GDPR apply. The technical operation initiated at your request is based on Article 6(1)(f) of the GDPR. Section 25(2) No. 2 of the TDDDG applies to session storage that is strictly necessary for the requested booking function; this does not authorize additional, optional purposes.
Dr. Flex employs purpose-bound data storage: appointment and communication data are retained only as long as necessary for the requested booking functions, the processing of related inquiries, or the resolution of errors. Thereafter, the data are deleted or anonymized, unless statutory retention obligations dictate otherwise. Separate retention periods apply to any information transferred to our patient records. No booking content or booking identifiers are transmitted to our visitor statistics system.
Dr. Flex also utilizes service providers located outside the European Economic Area. For such data transfers, the provider cites adequacy decisions or EU Standard Contractual Clauses as safeguards. You can find information and contact details for obtaining a copy of these safeguards in the Dr. Flex Privacy Policy; you may also contact our practice directly regarding this matter.
Contact form for administrative inquiries
You can use our contact form to send us general administrative inquiries. Your email address is required so that we can reply to you; providing your name and a brief message is optional. Please do not submit diagnoses, test results, or other medical information. The form is not intended for emergencies or the transmission of medical records. An inquiry submitted via the form does not constitute a confirmed appointment booking.
Your input is transmitted to our web server via an HTTPS-secured connection and subsequently forwarded by email to our practice’s email inbox. The recipients are the staff members handling your inquiry as well as IONOS, our hosting and email service provider. For the form, we use “Contact Form 7” hosted on our own web space, without external CAPTCHA services, marketing integrations, or additional message archiving in the WordPress database. To protect against automated spam messages, we supplement the form with technical validation fields using the “WP Armour” plugin. These fields are generated via JavaScript and validated on our own web space. However, the message itself is stored in the practice’s email inbox, where it is processed. Data from the form is not transmitted to our visitor statistics system.
For general inquiries, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is responding to your message. If the inquiry concerns the initiation or performance of a treatment contract, Art. 6(1)(b) GDPR applies. We retain the correspondence for as long as is necessary to process the matter and handle any required follow-up questions. Statutory retention obligations or specific interests in maintaining records remain unaffected; not every administrative message becomes part of the medical record. Please coordinate a suitable transmission method with us for sensitive information. Standard email does not offer guaranteed end-to-end encryption. Alternatively, you can reach us by telephone. The contact details and data protection rights specified in this privacy policy also apply to inquiries made via this form.
Contact via email or by telephone
When you write to us or speak with our team by telephone, we process your contact details, the nature of your request, and the information required to handle it. Requests regarding appointments or treatment may involve health-related data. The information is derived from your message or conversation and, where necessary for identification purposes, from existing practice records. Recipients include the practice team handling your request and the email or telecommunications service providers engaged for transmission or storage. Email for our domain is received via IONOS.
Processing a request for an appointment or treatment is based on Art. 6(1)(b) GDPR; where health data is required, it is additionally based on Art. 9(2)(h) and Art. 9(3) GDPR. For other general inquiries, Art. 6(1)(f) GDPR applies, based on our legitimate interest in responding to your request. Not every instance of contact requires additional consent. However, consent given voluntarily is decisive insofar as we base a specific method of communication on it.
We retain correspondence for as long as is necessary for processing and any required follow-up questions. Existing statutory documentation obligations or specific interests in maintaining records may necessitate longer, purpose-bound retention. For treatment records, the statutory baseline retention period under Section 630f(3) of the German Civil Code (BGB) is ten years following the conclusion of treatment. This period does not apply across the board to every general email.
Standard email does not offer guaranteed end-to-end encryption. Please avoid sending detailed medical findings, X-rays, or other sensitive documents via this method; instead, please coordinate a suitable transmission method with us. Without the information necessary for your request, we may be unable to process it or clearly assign it to your file.
Luna AI telephone assistant by PraxiPal
Luna is our AI telephone assistant for administrative matters and appointment requests. The technical provider is PraxiPal GmbH (Scharnhorststraße 24, 10115 Berlin), acting as a data processor. At the start of the call, Luna states her role as an AI assistant and asks, “May I help you?” The configured call logic interprets a “Yes” response or the immediate statement of a request as consent to the AI-led conversation and documents this. Only recordings of conversations where consent has been documented are stored. Health data may be processed during this process.
Luna accesses patient data and appointments via the integration with solutio’s “charly” system; any changes made are limited to appointment management. Articles 6(1)(a) and 9(2)(a) of the GDPR apply to the AI-related content and recordings. Details regarding technical processing, recipients, proof of consent, and other legal bases can be found in the detailed privacy information regarding the AI telephone assistant.
The agreed standard retention periods distinguish between audio and transcripts (30 days), potentially erroneous processing operations pending final review (up to a maximum of one year), and metadata and summaries (generally ten years). The last-mentioned period is a contractual standard, not a general statutory obligation for all conversation data. Further deletion criteria, recipients, and contractual requirements regarding processing within the European Economic Area are explained in the linked information.
You can ask to be put through to the practice team. You can speak to us directly by telephone Monday to Wednesday from 08:00 to 16:00, Thursday from 08:00 to 15:00 and Friday from 08:00 to 13:00. Outside these hours, your request can be recorded in the system so that the practice can call you back; alternatively, call again during the team’s telephone hours. An immediate transfer or a callback at a specific time is not promised.
Fonts, media, and external links
Our website fonts, logo, and the practice images we have incorporated are served via our web hosting provider. No separate connection to an external font or image service is established for these files. For content within an external booking interface that you open, the respective provider’s terms and information also apply.
Links to review profiles, social networks, and other websites are not embedded platform widgets. The destination provider only receives the connection data required to access the site when you actually open such a link. At that point, that provider’s privacy policy also applies. An existing user account with the destination provider may enable the request to be linked to that account.
We publish identifiable patient voices and authorized patient images or videos based on documented consent pursuant to Art. 6(1)(a) GDPR and—in the case of health-related data—Art. 9(2)(a) GDPR. This may include the authorized image, voice, name or pseudonym, and the personal account/testimonial. You may withdraw your consent for the future using the contact details provided above. We will then remove the content in question from publications under our control, provided there are no overriding obligations preventing us from doing so. Records documenting the consent and information required for legal defense may need to be retained separately.
Retention and Your Rights
The following applies to the processing activities described in this statement: We process personal data only for the purposes specified in each case. Unless a specific retention period is stated for these processing activities, the deletion or restriction of data is determined by the completion of the matter at hand, existing statutory obligations, and the necessity of retaining specific evidence or preserving legal claims. The mere technical capability to store data does not constitute a valid reason for retention.
Subject to statutory requirements, you have the right to access, rectification, erasure, restriction of processing, and data portability. You may withdraw your consent at any time with effect for the future. To protect your data against unauthorized disclosure, we may require suitable proof of identity if we have reasonable doubts regarding your identity.
Right to object: If processing is based on legitimate interests pursuant to Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then cease processing the data in question unless there are compelling legitimate grounds for doing so or the processing is necessary for the establishment, exercise, or defense of legal claims.
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our practice is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf. Information and contact details: LDI NRW. In particular, you may also contact a supervisory authority at your place of residence, place of work, or the location of the alleged infringement.
We will update this information in the event of significant changes to the functions or processing activities described.