1. An overview of data protection

Privacy Policy

Neuro Praxis Düsseldorf

Last updated: 16 October 2026

1. Data Controller

The entity responsible for processing personal data in connection with our website, patient communications, and medical and organisational activities is:

Neuro Praxis Düsseldorf
Prof. Dr. med. Christina Haubrich
Reichsstraße 59
im Pradus am Kaiserteich
40217 Düsseldorf
Germany

Telephone: +49 211 229 575 59
Email: info@neuro-praxis-dus.de

2. General Information on Data Protection

The responsible handling of personal information, particularly health data, is an essential part of our medical care.

We process personal data exclusively in accordance with applicable legal provisions, particularly the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the professional regulations governing our medical activities.

Our practice follows a comprehensive, digitally supported approach to patient care. For this purpose, we use modern practice management software, digital communication and documentation systems, and selected artificial intelligence (AI) applications.

These technologies support our staff in organising, preparing and documenting medical services.

Medical responsibility remains with our physicians at all times. Diagnoses, assessment of findings, treatment decisions and the selection of diagnostic procedures are not made by automated systems.

We adhere in particular to the principles of purpose limitation, data minimisation, confidentiality and storage limitation.

3. Data Protection Officer

We have appointed an external Data Protection Officer:

IITR Datenschutz GmbH
Dr. Sebastian Kraska
Marienplatz 2
80331 Munich
Germany

Email: email@iitr.de

You may contact our Data Protection Officer or our practice directly with any questions concerning data protection.

4. Your Rights as a Data Subject

Subject to the applicable legal requirements, you have the following rights in particular:

• The right to access your personal data pursuant to Article 15 GDPR
• The right to rectification of inaccurate or incomplete data pursuant to Article 16 GDPR
• The right to erasure of personal data pursuant to Article 17 GDPR
• The right to restriction of processing pursuant to Article 18 GDPR
• The right to data portability pursuant to Article 20 GDPR
• The right to object to certain processing activities pursuant to Article 21 GDPR
• The right to withdraw consent at any time with effect for the future pursuant to Article 7(3) GDPR

Where statutory documentation and retention obligations apply, these may prevent the complete erasure of personal data.

You also have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority primarily responsible for our practice is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Germany.

5. Website Hosting and Technical Provision

Our website is hosted by IONOS SE.

When you visit our website, technically necessary information may be processed, including:

• IP address of the accessing device
• Date and time of access
• Browser type and operating system
• Requested web pages
• Referrer URL
• Technical connection information

This processing serves to provide our website, maintain system security, analyse technical errors and protect against unauthorised access.

The legal basis is Article 6(1)(f) GDPR.

6. Cookies and Similar Technologies

Our website uses technically necessary cookies and, where applicable, similar storage technologies insofar as these are required for secure and functional operation.

According to our current configuration, we do not use our own analytics or marketing cookies.

For storage and access operations that are strictly necessary, Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies.

Where personal data are subsequently processed, the legal basis is Article 6(1)(f) GDPR, where applicable.

If technologies requiring consent are introduced in the future, they will only be used after the relevant consent has been obtained.

7. Contact and Patient Communication

When you contact our practice, we process the information necessary to handle your enquiry and, where applicable, to prepare or provide your medical treatment.

This includes communication via:

• Telephone
• Email
• Online reception
• Patient portals
• Appointment booking systems
• Video consultations

Depending on the nature of the enquiry, contact details, personal information, appointment details and health information may be processed.

Processing is based in particular on Article 6(1)(b) GDPR in conjunction with Article 9(2)(h) GDPR, insofar as this is necessary for medical care.

Where processing is based on separate consent, Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR apply.

8. AI-Powered Telephone Assistant MIKA

To improve our telephone accessibility and support practice organisation, we use the AI-powered telephone assistant MIKA.

The technical service is provided through the Placetel communications platform.

During telephone enquiries, MIKA may receive, structure and forward information about your request to our practice team.

This may include contact details, appointment requests and the reason for your call.

The system serves an organisational support function and does not replace medical advice.

As automated speech recognition systems may incorrectly capture or misunderstand information, medically relevant enquiries are subsequently handled by qualified members of our practice team.

MIKA does not establish diagnoses, make treatment decisions or independently perform medical assessments.

The legal basis is Article 6(1)(b) GDPR and, where processing of health data is necessary, Article 9(2)(h) GDPR.

9. Medical Documentation Support Using Heidi Health

We use Heidi Health software where appropriate to support medical documentation and the structured preparation of medical information.

The application may be used in particular to structure medical conversations and existing medical records and to prepare drafts of medical documentation and summaries.

All content generated in this way is subject to professional review by members of our practice team.

Heidi Health does not assume independent responsibility for medical decisions.

In particular, diagnoses, treatment decisions and the selection of medical procedures are not determined conclusively by the software.

The software is used in accordance with applicable European data protection requirements.

The legal bases are Article 6(1)(b) GDPR and Article 9(2)(h) GDPR and, where required in individual cases, separate consent.

10. Individual Medical Intake Preparation Using Previza

10.1 Purpose and Functionality

We offer selected patients the opportunity to prepare their medical intake particularly thoroughly and individually through an AI-assisted, interactive preparatory conversation.

For this purpose, we use the Previza platform provided by:

IMG PRINTING PROD SRL
Strada Blănari No. 9
030061 Bucharest
Romania

The conversation is individually prepared by our practice team. It is based on the medical information and previous medical reports already provided to us.

Within our existing documentation processes, we first prepare a medically relevant summary from which direct identifying information has been removed.

This summary forms the basis for a conversation tailored to the patient's individual medical history.

The AI asks supplementary questions about symptoms, complaints, previous examinations and relevant medical circumstances.

After completion, the system generates a structured conversation summary for our practice.

This summary is reviewed by our physicians. We then contact you personally to clarify any outstanding questions and agree on the next steps.

The procedure is used exclusively to prepare medical services. No automated diagnoses or treatment decisions are made.

10.2 Pseudonymisation and Data Minimisation

We have designed the procedure so that the conversational system receives as little directly identifying information as possible.

Complete original medical reports are not transferred to Previza.

Instead, the system receives an individually prepared summary created by our practice, from which direct identifying information has been removed.

In particular, the following information is processed:

• An internal reference number assigned by our practice
• Age information or year of birth
• Sex
• Medically relevant information prepared for the conversation
• Symptoms, complaints and other health information voluntarily provided during the conversation
• Technically necessary session information

Our practice does not include names, postal addresses, contact details or full dates of birth in the conversation preparation.

The AI system does not request such identifying information and asks patients not to enter it voluntarily.

If directly identifying information is nevertheless provided, the system is instructed, where technically feasible, not to repeat it and not to include it in the final summary.

However, it is not technically possible to guarantee that such information can never be entered.

The conversation is matched to the respective patient record exclusively by our practice using the internal reference number.

The processing is therefore pseudonymised. Despite the removal of direct identifiers, the information remains protected health data under applicable data protection law.

10.3 Voluntary Participation and Legal Basis

Participation in the AI-assisted preparatory conversation is entirely voluntary.

Before the conversation begins, the necessary privacy information is provided and explicit consent to the processing of health data is obtained.

The legal bases are Article 6(1)(a) GDPR and Article 9(2)(a) GDPR.

Consent may be withdrawn at any time with effect for the future.

Declining to participate or withdrawing consent will not adversely affect your ability to receive medical treatment at our practice. Medical intake can also take place through conventional procedures.

10.4 Technical Service Providers and Processing Locations

Previza processes the information as our data processor on the basis of a data processing agreement pursuant to Article 28 GDPR.

The following subprocessors are used in particular for technical service provision:

Netlify, Inc., USA

Hosting of the web application and provision of technical server functions. The server functions used to process medical content are located in Frankfurt am Main, Germany.

Supabase Pte. Ltd., Singapore

Technical database services. The database is operated in the Paris region of the European Union.

Amazon Web Services EMEA SARL, Luxembourg

Provision of the AI model through Amazon Bedrock and technical notification services.

AI processing takes place in EU data centre regions.

These companies are involved in the technical processing of information. Under the agreed system configuration, health information is processed in data centres located within the European Union.

Limited access by service providers from third countries may be possible for technical operations, support and security purposes.

Where such access constitutes an international transfer of personal data, the applicable safeguards are used, particularly relevant adequacy decisions of the European Commission or EU Standard Contractual Clauses pursuant to Article 46 GDPR.

10.5 Technical Security Measures

Various technical and organisational measures are implemented to protect health data.

These include in particular:

• Encrypted data transmission via TLS/HTTPS
• Encrypted data storage
• Additional application-level encryption of completed conversation summaries using AES-256-GCM
• Individual protected session access
• Limited retention periods
• Access restrictions for authorised personnel
• Separate management of reference numbers and patient identities

The Previza platform does not itself store or log the participating patient's IP address.

The hosting provider processes IP addresses only insofar as technically necessary to provide the application.

IP addresses, technical device identifiers and conversation content are not combined or disclosed to subprocessors in a manner that would unnecessarily enable patient identification.

Conversation content is not used to train AI models.

10.6 Retention Periods and Deletion

The processing of health information by Previza is limited in time.

In particular, the following storage and deletion periods apply:

Conversation history: The ongoing conversation is generally retained only in the memory of the open browser tab. Information necessary to generate responses is temporarily transmitted to server functions.

AI responses: Temporarily stored responses are deleted after no more than one hour.

Medical conversation preparation: This information is deleted after the final conversation summary has been generated and stored. If the session is not completed, deletion takes place no later than 14 days afterwards.

Conversation summary: This is generally deleted no later than seven days after its creation. Once our practice confirms that the summary has been added to the patient's medical record, deletion takes place within 24 hours. The automated technical deletion process may require up to one additional hour.

After the summary has been transferred to our patient records, the statutory documentation and retention obligations applicable to medical records apply.

Certain administrative information that does not contain conversation content may continue to be processed for session administration and billing.

10.7 Medical Review and Personal Care

Previza is used exclusively to collect and structure medical information.

The system is not a medical diagnostic or triage tool and does not replace medical examinations or consultations.

The generated conversation summaries are reviewed by our physicians.

Outstanding medical questions and further diagnostic or therapeutic planning are clarified personally.

No solely automated decision-making within the meaning of Article 22 GDPR takes place.

11. Online Reception and Patient Portal

We use the online reception service provided by Docmedico GmbH for digital communication with our practice.

Provider:

Docmedico GmbH
Ehrengutstraße 7
80469 Munich
Germany

The online reception service can be used in particular for:

• Appointment requests
• Organisational enquiries
• Submission of medical documents and previous reports
• Prescription requests
• Referral and medication enquiries
• Other messages to our practice team

Depending on the use of the service, personal data and, where applicable, health data may be processed.

The service is provided through a corresponding link or an integrated application on our website.

Under the existing configuration, integration takes place only after the appropriate consent to use the service has been given.

Further details concerning data processing by Docmedico can be found in the provider's privacy information.

12. Electronic Patient Records and medatixx Practice Software

We use systems provided by medatixx GmbH & Co. KG for medical care, practice organisation and documentation.

The following information may be processed in particular:

• Patient identification data
• Contact details
• Health data and diagnoses
• Previous medical reports
• Examination results
• Medication information
• Medical letters and reports
• Appointment and organisational data
• Billing-related information

Processing serves the purposes of providing medical treatment, organising our practice and fulfilling statutory documentation and retention obligations.

The legal bases are, in particular, Article 6(1)(b) GDPR and Article 9(2)(h) GDPR. Where statutory obligations must be fulfilled, Article 6(1)(c) GDPR may also apply.

13. Online Appointment Booking

For online appointment scheduling, we use the x.webtermin service provided by medatixx GmbH & Co. KG.

The information necessary for appointment management is processed.

This may include contact details, appointment preferences and organisational information.

Further information on the provider's data protection practices is available at:

https://medatixx.de/datenschutz

14. Video Consultations

We offer video consultations in medically appropriate cases.

The technical service is provided through corresponding systems of medatixx GmbH & Co. KG.

Connection and communication data necessary for the video consultation, as well as medical information shared during the consultation, may be processed.

Processing is carried out for the purposes of medical consultation and treatment.

The legal bases are, in particular, Article 6(1)(b) GDPR and Article 9(2)(h) GDPR.

15. General Principles for the Use of Artificial Intelligence

We use selected AI applications to support our medical and organisational processes.

Areas of application include in particular:

• Patient communication
• Medical documentation
• Structuring medical information
• Individual preparation of medical intake conversations
• Practice organisation

The applications are used for supportive purposes only.

Information generated by AI systems is reviewed by qualified members of our team according to its medical relevance.

AI systems may produce errors or present incomplete or inaccurate information. They therefore do not make binding medical decisions.

Diagnoses, treatment decisions and final medical assessments remain entirely the responsibility of our physicians.

No solely automated decision-making within the meaning of Article 22 GDPR takes place.

16. Recipients of Personal Data

In the course of providing medical care and organising our practice, personal data may be disclosed to external service providers or other recipients where necessary and legally permitted.

These include in particular:

• IONOS SE – Website hosting
• Placetel – Telephone infrastructure
• Docmedico GmbH – Digital patient communication
• Heidi Health – Medical documentation support
• IMG PRINTING PROD SRL (Previza) – AI-assisted medical intake preparation
• Netlify, Supabase and Amazon Web Services – Technical subprocessors of Previza
• medatixx GmbH & Co. KG – Practice management software, appointment scheduling and video consultations
• Contracted IT service providers
• Medical laboratories
• Other treating physicians
• Hospitals and other medical institutions
• Medical billing service providers
• Competent authorities where disclosure is required by law

Data are disclosed only where an appropriate legal basis exists.

Where a service provider processes personal data on our behalf, the legally required data processing agreements pursuant to Article 28 GDPR are concluded.

17. YouTube

Videos from the YouTube service may be embedded on our website.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

When embedded videos are used, personal and technical data may be processed by Google.

Further information about data processing is available at:

https://policies.google.com/privacy

Where consent is required for the integration of such videos, the relevant service is activated only after consent has been obtained.

18. Google Maps

Our website may contain maps provided by Google Maps.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

When the service is used, technical connection data may be transmitted to Google.

Further information is available at:

https://policies.google.com/privacy

Where consent is required to activate the map service, it is obtained before the relevant data transmission takes place.

19. International Patients and Multilingual Communication

We also provide medical care to patients from other countries.

Where appropriate, we offer English-language communication as well as digitally supported documentation and medical intake processes.

The technical and AI-based support systems described above may be used for these purposes.

Regardless of the language used, medical assessment and all diagnostic and therapeutic decisions remain the responsibility of our physicians.

The medical assessment documented in our patient records is authoritative for treatment.

20. Encryption and Data Transmission Security

Our website uses TLS encryption to secure data transmission between your device and our web server.

Depending on the relevant service, additional technical and organisational security measures are implemented for medical communication and documentation.

These include in particular access restrictions, authentication procedures and encrypted transmission channels.

Please note that the security of data transmission also depends on the devices, networks and communication channels used.

21. Retention of Personal Data

As a general principle, we retain personal data only for as long as necessary to fulfil the respective processing purpose or to comply with statutory obligations.

Medical records are subject in particular to statutory and professional retention requirements.

Where personal data are no longer required and no statutory retention obligations apply, they are deleted or anonymised in accordance with data protection requirements.

The specific deletion periods described in Section 10 of this Privacy Policy additionally apply to AI-assisted medical intake preparation.

22. Amendments to This Privacy Policy

We review this Privacy Policy regularly and update it in the event of material technical, organisational or legal changes.

This applies in particular when new digital services are introduced or significant changes are made to the systems used.

The current version published on our website shall apply.

Neuro Praxis Düsseldorf
Prof. Dr. med. Christina Haubrich
Reichsstraße 59
40217 Düsseldorf
Germany