Privacy policy
1. Controller
Alen Gruber (Prvi termin) Mohrengasse 1 90402 Nuernberg Deutschland E-mail: privacy@prvitermin.com
2. Data we process
When you visit the site: IP address, time, page requested, browser type (server logs for security and troubleshooting). With an appointment request: name, e-mail, phone, preferred date, payment type and your message. The message and the chosen service may be health data. We process it only to forward your request to the clinic you chose, and only with your explicit consent (Art. 9(2)(a) GDPR), which you give in the form. When registering: name, e-mail, password (stored encrypted only), account type, phone (optional). When signing in with Google: see section 4. With a review: rating, text and a display name you choose. Via the contact form: name, e-mail and your message, to answer your enquiry (Art. 6(1)(b) or (f) GDPR). For clinics: billing and payment data; card data is processed by Stripe only.
3. Purposes and legal bases
Operating and securing the website, protection against abuse and bots: legitimate interest (Art. 6(1)(f) GDPR). Forwarding your appointment request and notifying you of the clinic's reply: consent (Art. 6(1)(a), Art. 9(2)(a) GDPR) and carrying out your request (Art. 6(1)(b) GDPR). User account and sign-in: contract (Art. 6(1)(b) GDPR). Appointment alerts and review invitations: consent, withdrawable with one click in every e-mail. Publishing reviews: consent. Invoices and accounting for clinics: legal obligation (Art. 6(1)(c) GDPR).
4. Sign in with Google
You can choose to sign in with your Google account. You are then redirected to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). After your approval Google sends us your name, e-mail address, whether it is verified, and a Google identifier. We do not receive your Google password or any other data from your Google account. Legal basis: Art. 6(1)(b) GDPR. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Google privacy policy: policies.google.com/privacy. You can remove the connection at any time in your Google account (third-party apps).
5. Recipients and service providers
The clinic you send your request to; once received, it is an independent controller of your data. Hosting and e-mail delivery: hosting provider with servers in Germany (processor, Art. 28 GDPR). Bot protection in forms: Cloudflare Turnstile (Cloudflare, Inc., USA; certified under the EU-US Data Privacy Framework). Turnstile checks technical browser characteristics on submission, sets no advertising cookies and only serves to block automated requests. Clinic payments: Stripe Payments Europe Ltd., Ireland. Sign in with Google: see section 4. Fonts are loaded from our own server, not from third parties. Map links lead to OpenStreetMap only after you click them. We do not sell data or use it for advertising.
6. Retention
Appointment requests and related messages: 12 months after the last status change, then anonymised. Account data: as long as the account exists, then deleted within 30 days. Reviews: as long as they are published. Contact form messages: 12 months. IP addresses with requests: 30 days. Invoices and accounting records: according to statutory retention periods. Server logs: 30 days at most.
7. Cookies and consent
We set necessary cookies without consent because the site does not work without them (§ 25(2) TDDDG, Art. 6(1)(f) GDPR): a session cookie for sign-in and language (2 hours after your last visit), XSRF-TOKEN against form misuse (2 hours), remember_web only with “Remember me” or sign-in with Google (up to 400 days or until you log out) and prvitermin_consent with your cookie choice (12 months). We set optional cookies (statistics, marketing) only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). We currently use no such services. If we introduce one, we will name it here and ask you again. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. Write to privacy@prvitermin.com. You may lodge a complaint with a supervisory authority, in particular the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, or the authority in your country of residence (in Croatia: AZOP, azop.hr).
9. Obligation to provide data
For an appointment request we need your name and e-mail address, otherwise we cannot forward it. All other details are voluntary. No automated decision-making takes place.
10. Changes
We update this policy when our service or the law changes. The version published on this page applies. Last updated: October 2026.