Privacy policy

As of: November 2026 · Website: www.beyondpraxis.de (Beyond Med Leipzig)

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. For detailed information, see the sections below.

Data collection on this website

Who is responsible?
Data processing on this website is carried out by the website operator. Contact details can be found in the “Responsible body” section.

How do we collect your data?
Some of your data is collected because you provide it to us (e.g. via the contact form, by email or by phone). Other data is collected automatically or with your consent by our IT systems and the services we use when you visit the website (e.g. technical log data).

What do we use your data for?
Some of the data is collected to ensure that the website is provided error-free. Other data can be used to analyze user behavior, to organize appointments, to answer inquiries or - with appropriate consent - for marketing purposes.

What rights do you have?
You have the right at any time to receive free information about the origin, recipient and purpose of your stored personal data as well as, among other things. to correction, deletion, restriction of processing, data portability and objection. You can revoke your consent at any time with future effect. You also have the right to lodge a complaint with the responsible supervisory authority.

Analysis and marketing tools

This website uses no analytics or marketing tools (e.g. no Meta Pixel, no Google Analytics). No cookies are set; a cookie banner is therefore not required. For details, see section 4.

2. Hosting and content delivery

Self-hosted website (Netlify)

Our website is as static website via Netlify, Inc. (2325 3rd Street, Suite 296, San Francisco, CA 94107, USA) and delivered by us under our own responsibility. It is no longer hosted on the Wix platform.

Netlify provides the infrastructure for hosting, delivery (CDN) and TLS encryption. When accessed, the website files are delivered from Netlify servers or the global CDN. Netlify is based in the USA; A data transfer to a third country cannot therefore be ruled out. We have concluded the standard contractual clauses approved by the EU Commission (Art. 46 Para. 2 lit. c GDPR) with Netlify or rely on equivalent guarantees from the provider.

When you access the website, technically necessary connection data is processed, in particular IP address, date and time of access, pages/URLs accessed, referrer URL, browser type and version, operating system and device information. This data is stored in server log files and is used to ensure the provision, security and stability of the website.

The legal basis is Article 6 (1) (f) GDPR (legitimate interest in a secure and functional website). The log data is only stored for as long as necessary for the respective purpose and then deleted or anonymized.

If the hosting provider processes personal data on our behalf, this is done on the basis of an order processing contract in accordance with Art. 28 GDPR.

3. General information and mandatory information

Data protection

The operators of these sites take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (in particular GDPR, BDSG, TDDDG) and this data protection declaration.

We would like to point out that data transmission over the Internet (e.g. when communicating via email) can have security gaps. Complete protection of data from access by third parties is not possible.

Responsible body

The responsible body for data processing on this website is:

Beyond Med Leipzig
Internal medicine private practice
Dr. med. Hartmut Köppen
Specialist in internal medicine
Burgplatz 2
04109 Leipzig
Germany
Phone: +49 (0)341 96273770
E-mail: my@beyondpraxis.de

The responsible body is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

Storage period

Unless a specific storage period is specified in this data protection declaration, your personal data will remain with us until the purpose for data processing no longer applies. If you make a legitimate request for deletion or revoke your consent, your data will be deleted unless we have other legally permissible reasons for storage (e.g. tax, commercial or professional law retention periods); In the latter case, the deletion takes place after these reasons no longer apply.

Special retention periods apply to medical documentation (usually 10 years after completion of treatment, longer in individual cases). These deadlines apply to the practice and not generally to website log data.

Legal basis for data processing

If you have consented to data processing, we will process your personal data on the basis of Article 6 Paragraph 1 Letter a GDPR or Article 9 Paragraph 2 Letter a GDPR, provided that special categories of personal data (e.g. health data) are processed. In the case of express consent to the transfer to third countries, additional Art. 49 Para. 1 lit. a GDPR.

If you have consented to the storage of cookies or access to information on your device, processing will also be carried out on the basis of Section 25 Paragraph 1 TDDDG. Consent can be revoked at any time.

If your data is necessary to fulfill the contract or to carry out pre-contractual measures, we process it on the basis of Art. 6 Para. 1 lit. b GDPR. If there is a legal obligation, Article 6 Paragraph 1 Letter c GDPR. Furthermore, processing may be based on our legitimate interest in accordance with Article 6 Paragraph 1 Letter f of the GDPR. The relevant legal basis is stated in the following sections.

Recipients of personal data

As part of the operation of the website and practice activities, personal data may be transmitted to the following categories of recipients:

• Hosting provider Netlify and technically involved subcontractors/CDN
• Online appointment platform (Doctolib) if you use the appointment booking link
• IT, communications and, if applicable, email service providers
• Authorities and chambers, insofar as we are legally obliged
• Laboratories, cooperation partners and other service providers as part of medical treatment (separately and only if necessary)

Data will only be passed on if this is necessary to fulfill the contract, if we are legally obliged to do so, if there is a legitimate interest or if there is another legal basis (e.g. consent). Corresponding contracts are concluded with processors.

Withdrawal of your consent

Many data processing operations are only possible with your express consent. You can revoke your consent at any time (e.g. by sending us an email). The lawfulness of the processing carried out until the revocation remains unaffected.

Right to object (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6 ABS. 1 LITER. E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE TERMS. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE AFFECTED DATA UNLESS WE CAN PROOF COMPULSORY REASONS DESIGNABLE FOR PROTECTION WHICH OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOM, OR THE PROCESSING IS FOR THE ASSERTMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS (ART. 21 Para. 1 GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO PROCESSING FOR THE PURPOSE OF SUCH ADVERTISING AT ANY TIME; THIS ALSO APPLIES TO PROFILING TO THE EXTENT IT IS CONNECTED WITH SUCH DIRECT ADVERTISING (ART. 21 (2) GDPR).

Right to lodge a complaint with the supervisory authority

In the event of data protection violations, those affected have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged violation. The local supervisory authority responsible for us is:

Saxon data protection officer
Devrientstrasse 5
01067 Dresden
www.datenschutz.sachsen.de

Right to data portability

You have the right to have data that we process automatically based on your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request direct transfer to another person responsible, this will only be done if it is technically feasible.

Information, correction, deletion and restriction

Within the framework of the applicable legal provisions, you have the right to free information at any time about your stored personal data, its origin and recipient and the purpose of data processing as well as, if necessary, the right to correct or delete this data. You also have the right to restrict processing under the conditions of the GDPR. You can contact us at any time about this or if you have any further questions about data protection.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the browser address bar changing from “http://” to “https://” and by the lock symbol in the browser bar.

4. Cookies and local storage

No cookies, no tracking

Our website sets no cookies and does not use any analytics, statistics or marketing technologies. Consent (a cookie banner) is therefore not required.

Local storage of the language selection

If you select a language using the DE/EN switch, we store this choice locally in your browser (local storage, key beyond-lang) so that the website is displayed in your chosen language on all pages. The information does not leave your device. This storage is strictly necessary for the service you have expressly requested (Section 25(2) No. 2 TDDDG); the legal basis is Art. 6(1)(f) GDPR. You can delete it at any time in your browser settings.

5. Data collection on this website

Server log files

The hosting provider automatically collects and stores information in server log files that your browser or device transmits when you access it. This may include: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of server request and IP address.

We do not combine this data with other data sources. The legal basis is Article 6 Paragraph 1 Letter f GDPR.

Contact form

If you send us a message via the contact form on the website, your details are processed to handle your enquiry. Your form entries are stored via the form function of our hosting provider Netlify, Inc. (Netlify Forms); Netlify notifies us of each enquiry by email to our practice mailbox. No other form service is used. Netlify may also process data outside the European Union, in particular in the USA.

Depending on the form, the following can be processed in particular:

• First name Last Name
• E-mail address
• Telephone number
• Message / free text
• Information on your insurance status (e.g. privately insured / self-paying)
• If necessary, consent to contact us by telephone

The processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as your request is related to the initiation or fulfillment of a treatment contract; otherwise on Art. 6 Para. 1 lit. f GDPR (legitimate interest in effective processing) or – if requested – Art. 6 Para. 1 lit. a GDPR.

A notice: Please do not submit sensitive medical details (e.g. detailed medical histories, findings, diagnoses) via the website form unless expressly and securely provided for. Telephone, email and online appointment booking are available for medical concerns and appointments.

The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent or the purpose no longer applies. Mandatory legal provisions – in particular retention periods – remain unaffected.

Inquiries by email, telephone or fax

If you contact us by email, telephone or fax, your request including all resulting personal data (name, request, contact details) will be stored and processed by us for the purpose of processing. We will not pass on this data without your consent unless this is necessary for processing or required by law.

Legal basis: Art. 6 Paragraph 1 Letter b GDPR for contract-related inquiries; otherwise Art. 6 Para. 1 lit. f GDPR or Art. 6 Para. 1 lit. a GDPR, provided consent is given. Storage period analogous to the contact form; Statutory retention periods remain unaffected.

6. Analytics tools and advertising

This website uses no analytics or advertising tools (e.g. no Meta Pixel, no Google Analytics, no Facebook/Instagram plugin).

Interactive home page graphics (shader library)

A subtle interactive background graphic can be loaded on the homepage. The JavaScript library required for this is completely from our website (via Netlify) – nothing is loaded separately from external CDNs. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in an appealing, modern presentation of the home page). This graphic is not loaded on subpages. If the “reduce motion” setting is enabled on your device, a calm background is shown instead of the animation.

7. External services and links

Online appointment booking via Doctolib

We link to the service on our website for online appointment booking Doctolib.

Provider: Doctolib GmbH, Mehringdamm 51, 10961 Berlin (or the company named in the Doctolib imprint).

If you click on the appointment booking link, you will leave our website and will be redirected to the Doctolib platform. Doctolib is responsible for data processing there (including registration/login, appointment management, health and insurance data if applicable) or processes data in accordance with the conditions there. Please note Doctolib's privacy policy and terms of use: doctolib.de/gesundheit/datenschutz-und-datensicherheit.

The legal basis for the forwarding and the associated technical transmission (e.g. referrer) is Article 6 Paragraph 1 Letter b GDPR (initiation of a treatment contract) or Article 6 Paragraph 1 Letter f GDPR (legitimate interest in a simple online appointment allocation). If Doctolib sets cookies, Doctolib's consent policy applies.

Instagram

Our website contains links to our Instagram profile (https://www.instagram.com/_beyondmedleipzig_/). When linking only, no Instagram plugins are loaded. If you follow the link, the Meta/Instagram data protection regulations apply. The legal basis for the link is Article 6 Paragraph 1 Letter f GDPR (interest in contemporary external communication).

Fonts (self-hosted)

Web fonts are used for uniform presentation from our own server delivered (Wix Madefor Text/Display as local font files). External font CDNs are no longer used. Legal basis: Article 6 Paragraph 1 Letter f GDPR.

No Google Maps / no YouTube embed (currently)

At the time of writing this privacy policy are on the website no embedded Google Maps maps and no YouTube/Vimeo videos are embedded. Should this change, this policy will be updated accordingly and – where necessary – consent will be obtained (e.g. via a consent banner).

8. Online self-tests

This website provides optional, interactive self-tests (e.g. on lifestyle topics or for non-binding orientation regarding the practice's information offerings). The tests are intended solely for general information and guidance. They do not represent a diagnosis, a risk calculation or an individual treatment recommendation and do not establish a doctor-patient relationship.

The answers you select will be evaluated exclusively locally in your browser. We provide the answers and results as part of the pure use of the website not stored, evaluated or transmitted to third parties on the server side. The test results will not be transmitted to the practice unless you inform us yourself (e.g. via contact form, email or in a personal conversation).

Technically, displaying and running the tests requires loading the associated website files (HTML, CSS, JavaScript); this generates the usual server log data (see above). The legal basis for providing the self-tests is Art. 6(1)(f) GDPR (legitimate interest in providing understandable, prevention-related information).

Please do not transmit unnecessarily detailed health data from self-tests via contact channels if this is not necessary for contact.

9. Special information on medical practice

This website serves to provide general information about the private practice Beyond Med as well as to contact you and organize appointments. The use of the website alone does not establish a doctor-patient relationship and does not replace personal medical advice, examination or treatment.

Personal health data in the context of medical treatment is processed in practice in accordance with professional and data protection regulations (in particular Art. 9 Para. 2 lit. h GDPR in conjunction with Section 22 Para. 1 No. 1 lit. b BDSG and the regulations on medical confidentiality). This processing is not the subject of pure website use and is carried out separately in the practice organization.

10. Currentness and changes to this data protection declaration

We reserve the right to adapt this data protection declaration so that it always complies with current legal requirements or to implement changes to our services in the data protection declaration (e.g. when introducing new services, forms or tracking tools). The new data protection declaration will then apply to your next visit.

As of: November 2026