Privacy policy
Information about the processing of personal data when visiting this website and contacting the practice.
1. Controller
The controller responsible for processing personal data on this website is the Internal Medicine Primary Care Practice Dr. medic. Tsai, Chen-Wei, practice owner Dr. medic. Tsai, Chen-Wei, Zschopauer Straße 105, 09126 Chemnitz, Germany. You can contact the practice by telephone at 0371 643895, by fax at 0371 694434 or by email at gesund@praxis-tsai.de.
No data protection officer has been appointed. Privacy enquiries can be sent directly to the contact details above.
2. Website access, hosting and email service
Each time you access the website, your browser transmits technically necessary connection data to the web server. This may include your IP address, the date and time, the page or file requested, the referring page, browser type and version, operating system, transferred data volume and HTTP status code.
Processing is necessary to deliver the website, ensure stability and security and detect technical faults or misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, acting on our behalf. According to STRATO, complete IP addresses are stored for no more than seven days for attack detection and defence. Access logs available to the hosting customer contain anonymised IP addresses and are available for the previous six weeks. Data may be retained for longer where required to investigate a specific security incident.
The practice mailbox and delivery of messages submitted through the contact form use services provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes connection, communication and message content data required for email transmission and mailbox operation on our behalf. Depending on the communication, the legal basis is Article 6(1)(b) or (f) GDPR and, for necessary health data, additionally Article 9(2)(h) GDPR.
3. Encrypted transmission
This website is delivered through an encrypted HTTPS connection. This protects data in transit between your browser and the web server against unauthorised reading. Ordinary email is not end-to-end encrypted. Please do not send medical documents, reports or other particularly sensitive health information by email or through the contact form.
4. Contact form
When you use the contact form, we process your first and last name, email address, message and, optionally, telephone number. Required fields are marked. The checkbox merely documents that you have received the privacy information; it is not consent to data processing.
The data are transferred through our own interface on the STRATO web server to the practice mailbox hosted by IONOS. They are not disclosed for advertising. For enquiries concerning the initiation or performance of a treatment relationship, the legal basis is Article 6(1)(b) GDPR. Other organisational enquiries are processed under Article 6(1)(f) GDPR based on our legitimate interest in responding. If health data are sent despite our warning and are required for health care, Article 9(2)(h) GDPR applies together with the rules governing medical treatment and professional secrecy.
To limit automated or abusive submissions, the IP address is converted into a pseudonymised verification value for a 15-minute window. The value and submission times are stored. Expired entries are disregarded and obsolete technical files are removed during subsequent submissions. The legal basis is Article 6(1)(f) GDPR and our interest in protecting the form and mailbox.
Ordinary enquiries remain in the mailbox for as long as required for handling and reasonable follow-up. There is no automatic deletion. Messages are deleted manually once the purpose has ended, unless statutory retention duties or legitimate reasons require continued storage. If a message becomes part of the medical record, statutory and professional retention periods apply. Data required for legal claims may be retained until the relevant limitation period expires.
5. Contact by email or telephone
When you contact us by email or telephone, we process the contact details and message content you provide to the extent required to respond. The same legal bases and deletion criteria as for the contact form apply. The website does not record telephone calls.
6. Privacy and accessibility settings
The website stores selected settings only in your browser’s local storage: the dated choice whether the external map may be loaded and your selected accessibility display options. These data are not transmitted to the practice and are not used to create usage profiles.
The map selection expires after 180 days. Accessibility settings remain until you reset them or clear local browser storage. Storage is required to retain functions you explicitly requested. Article 6(1)(f) GDPR is the legal basis for any processing of personal data. Access to local storage is permitted under Section 25(2)(2) TDDDG where strictly necessary for the requested function.
The website uses no audience measurement, marketing trackers or externally loaded fonts.
7. OpenStreetMap
An interactive map supplied by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, can be loaded on the directions page. It remains blocked until you allow external maps. Only then does your browser connect to the Foundation and its technical providers.
In particular, your IP address, browser and device information, operating system, referring page, time and requested map data are transmitted. The map displays only the fixed practice location and does not request your device location. According to the Foundation, tiles are also delivered through Fastly’s global network.
Loading takes place only with your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw consent for the future through the cookie settings in the footer. The map will then no longer load. Processing before withdrawal remains lawful. The European Commission has adopted an adequacy decision for the United Kingdom.
8. Online booking through arzt-direkt
Appointment buttons link to the external arzt-direkt service operated by zollsoft GmbH, Ernst-Haeckel-Platz 5/6, 07745 Jena, Germany. No arzt-direkt booking form is embedded in this website. A connection is established only when you follow the link.
After access, zollsoft initially processes the connection and usage data required to provide the platform. When you book, the personal, contact, appointment and, where applicable, health data you enter are processed to initiate and perform the treatment relationship and made available to the practice. The legal bases are Article 6(1)(b) and, for health data, Article 9(2)(h) GDPR. For booking functions, zollsoft acts as the practice’s processor. It is independently responsible for its own processing as described in its privacy policy.
9. External links
The website also links to Google Maps route planning, the Verkehrsverbund Mittelsachsen journey planner and public or professional information websites. Merely visiting this website does not transmit data to those providers. Data are transmitted only after you select an external link and leave this website. The respective provider is responsible for subsequent processing under its own privacy policy.
10. Recipients and transfers to third countries
Within the practice, only persons who need personal data for their duties receive access. Technical recipients may include the processors and providers named above. We otherwise disclose data only where required by law, based on consent or permitted by another legal basis.
We transfer data outside the European Union or European Economic Area only where the requirements of Articles 44 et seq. GDPR are met. The OpenStreetMap section provides additional information for the voluntarily loaded map.
11. Your rights
Subject to the statutory requirements, you have rights of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18 and data portability under Article 20. Consent can be withdrawn at any time for the future without affecting the lawfulness of prior processing.
Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object for reasons arising from your particular situation under Article 21. We then cease processing unless compelling legitimate grounds or the establishment, exercise or defence of legal claims require it. Contact the practice using the details in section 1. We may request information needed to confirm your identity.
12. Right to lodge a complaint
Under Article 77 GDPR you may lodge a complaint with a data protection supervisory authority. The authority particularly responsible for the practice is the Saxon Data Protection and Transparency Commissioner, Postfach 11 01 32, 01330 Dresden, visitor address Maternistraße 17, 01067 Dresden, telephone +49 351 85471-101, email post@sdtb.sachsen.de.
13. Requirement to provide data and automated decisions
You do not actively provide data merely by visiting, although technical connection data are necessary to deliver the website. Only fields marked as required are necessary in the contact form; without them the enquiry cannot be sent and handled. A telephone number is optional.
No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place on this website.