Privacy Policy

1. Data controller and contact

The data controller is Caner Yılmaz, Theraist Physiotherapie, Fohrenburgstraße 4, 3rd floor, 6700 Bludenz, Austria.

For privacy questions and to exercise your rights: office@theraist.at, phone +43 664 1122464.

2. What happens when you visit the website?

Required connection data may include your IP address, access time, requested page, browser and device information, and error or security events. This supports website delivery, troubleshooting and protection against misuse.

Vercel hosts and serves the website; Sanity manages public content and images. These are technical infrastructure services, not patient-record systems. Loading the website or images may involve necessary connection data. Contact enquiries and patient documents are not stored in Sanity.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure, reliably available website. Technical logs are retained as needed for operation and security checks. Investigating a specific security incident may require longer retention.

3. What information is needed for an enquiry?

You can choose to contact us by phone or the external WhatsApp link. The website has no name, email or message fields and does not accept form enquiries. When you contact us, we process the contact details and administrative information you provide as needed to respond.

We answer general questions and discuss appointment preferences. Contacting us does not confirm an appointment. Emails sent directly to office@theraist.at, including privacy requests, are processed in the practice mailbox for the relevant communication purpose.

The legal basis for service-related enquiries is Article 6(1)(b) GDPR. For other general questions it is Article 6(1)(f) GDPR; our legitimate interest is responding to your message. We handle privacy rights requests to fulfil our legal duties under Article 6(1)(c) GDPR. You do not have to provide contact details merely to visit the website; responding to an enquiry requires a suitable way to contact you. WhatsApp is optional; you can call us instead.

4. Protecting health information

Health information, X-rays and medical reports require special protection. This website provides neither uploads nor a patient-record system for these documents. You can discuss an appropriate way to share medical documents with the practice; they are not passed to site search or Analytics.

Treatment-related health information is processed separately from general administrative correspondence, subject to the applicable processing requirements and statutory retention periods.

5. Which services process the email?

Zoho Mail processes emails sent directly to office@theraist.at for delivery and storage in the practice mailbox and for handling our correspondence. Zoho provider information: https://www.zoho.com/privacy.html

Our Zoho Mail practice account uses the EU (European Union) region. This does not guarantee that all services involved, their technical logs and backups process data exclusively in the EU.

Zoho Mail describes an additional server-side recovery period of 30 days after a message is removed from the trash. This technical period is not the practice's six-month retention period. Any separate archives follow their own rules. Provider information: https://www.zoho.com/mail/help/data-deletion-policy.html

6. Technical security

Technical logs needed for secure delivery and troubleshooting are explained in section 2. The website has no contact form or form-related spam counters. Technical infrastructure, practice correspondence and optional Analytics measurement are processed for separate purposes.

7. What does the six-month period mean?

General enquiries and related correspondence in the practice mailbox are deleted no later than six calendar months after the matter is concluded. The period starts on the date of the last substantive action that closes the enquiry; routine access or a website visit does not restart it. Data is deleted earlier if retention is no longer needed.

This covers administrative enquiries, not all patient records, invoices or treatment documents. Necessary statutory retention duties or specific legal claims may justify longer periods; exceptions are limited to the documents needed.

The practice tracks deadlines manually and carries out deletion manually. This covers the relevant received and sent messages and unnecessary copies managed by the practice; these messages are also removed from the trash. Provider backups and technical data have their own deletion cycles. We do not promise that all copies held by every provider automatically disappear on the same day.

8. Who receives data and are there international transfers?

Recipients are the practice staff responsible, Vercel and Sanity for technical website services, and Zoho Mail for directly sent emails. If you use WhatsApp, WhatsApp processes data for its service; with your Analytics consent, Google processes data for measurement. Transmission is not publication of your message.

These international services may process data outside the European Economic Area, particularly in the United States. The providers' published transfer terms describe safeguards including EU Standard Contractual Clauses. Request information about the transfers relevant to your data and a copy of the applicable safeguards at office@theraist.at. An EU account or European hosting location alone does not guarantee exclusively European processing.

Provider information: https://vercel.com/legal/dpa ; https://www.sanity.io/legal/dpa ; https://www.zoho.com/privacy.html ; https://www.whatsapp.com/legal/privacy-policy-eea ; https://business.safety.google/adsprocessorterms/ .

9. Cookies, Google Analytics and site search

We use Google Analytics 4 only with your optional consent to improve our website. We measure general page groups, interface language and clicks on telephone or WhatsApp links. A click confirms neither a conversation nor an appointment. The provider is Google; information about data processing: https://support.google.com/analytics/answer/6004245 .

The Google measurement tag and Analytics cookies are not loaded before you consent; rejecting them does not prevent you from using the website. The legal basis is your consent under GDPR Article 6(1)(a) and, for cookies and access to your device, section 165(3) of Austria's TKG 2021. You can change your choice or withdraw consent through the website's cookie settings. Withdrawal stops future measurement; it does not automatically erase data previously processed lawfully.

After consent, Google processes pseudonymous cookie identifiers and technical connection data; requests provide Google with your IP address. Measurement is not completely anonymous. Names, email addresses, telephone numbers, WhatsApp messages, X-rays and search terms are not sent to Analytics. We use general page groups instead of detailed health-related article or service titles and actual URLs; query parameters, URL fragments and referrer information are not added. Google Signals, personalised advertising and automatic form or search measurement are not used.

Our Analytics account is configured to retain user-level and event-level data for two months; this is not a uniform deletion deadline for all aggregated reports. Analytics cookies last no more than 180 days; your browser may shorten this. Your acceptance or rejection choice is stored on your device with the policy version for no more than 180 days. These periods are separate from the clinic's six-month period for administrative correspondence.

Google may process data outside the European Economic Area, including in the United States. Processing exclusively within the EU is not guaranteed. Transfer safeguards and data processing terms: https://business.safety.google/adsprocessorterms/ . You can request information about applicable safeguards and copies of the relevant texts at office@theraist.at.

Font files are served with the website; your browser does not need to contact Google Fonts. Search suggestions are calculated in your browser while you type. Submitting a search without a matching result may pass the term to the conditions overview as the URL parameter q, where it may appear in browser history or technical access logs. Do not enter identifying or personal medical information in site search.

10. Phone, WhatsApp and external links

The phone link opens your device's calling function. WhatsApp is an optional external link, not an automatically loaded chat widget; you can call us instead. WhatsApp Ireland Limited provides the service for users in the European Region. Opening it or sending a message also involves WhatsApp's privacy information.

Google Maps is provided as an external link, not an embedded interactive map. Social media links also open external services. These providers may process their own connection and usage data when you visit.

11. What rights do you have?

Subject to the GDPR's conditions, you have rights of access, correction, erasure, restriction and data portability. You may object to legitimate-interest processing on grounds relating to your situation. Consent may be withdrawn for future processing without affecting earlier lawful processing.

Contact office@theraist.at. Provide only the details needed to identify your request; proportionate identity verification may be needed if there are reasonable doubts. Legal exceptions may limit erasure. We respond to rights requests without delay, within one month. Complexity or request volume may require up to two extra months; we explain any extension within the first month.

You may complain to a supervisory authority, particularly the Austrian Datenschutzbehörde: https://dsb.gv.at . The authority where you normally live or work is also an option. We do not make automated individual decisions with legal or similarly significant effects.

For any questions, suggestions or complaints, you can reach us by phone at +43 664 1122464 or by email at office@theraist.at.