Dr. Look
Book a consultation

Privacy policy

We use your data only to answer you and to plan your treatment. This page explains what is processed, why, and what your rights are. Draft for the legal review before publication.

Controller

Dr. Look by Levent Kanal, [K8: legal entity and address as in the imprint]. E-mail: info@drlook.eu. See the imprint.

Data protection officer: [K8: name and contact, if one is appointed — not mandatory for most practices]

1. Visiting the website

When you open a page, the web server records technical data (IP address, time, page requested, browser type) in a log file. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and stable website. Log files are deleted after [K8: retention period, e.g. 7 days]. Hosting: [K8: hosting provider name and location; data processing agreement].

Cookies: on your first visit a cookie banner asks for your choice. Your choice itself is stored in your browser for 12 months (necessary). Statistics and marketing cookies are set only with your consent; we currently use no analytics service and show no advertising. You can change or withdraw your choice at any time under "Cookie settings" in the footer. [K8: update if GA4/GTM is activated later — the banner already has the Statistics category]

2. Contact form, WhatsApp, phone and e-mail

If you contact us, we process the data you provide: name, e-mail address, phone number with country code, where you are coming from, and your message. Purpose: to answer your question and, if you wish, to prepare a consultation. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) and, for health information you choose to include, your consent, Art. 9(2)(a) GDPR. You may describe your situation in general terms; you do not need to send prescriptions or medical records. We delete enquiries once they are answered and no treatment follows, at the latest after [K8: retention period, e.g. 6 months]; treatment records are kept according to medical retention duties (10 years).

Form messages are transmitted encrypted (TLS) and sent to [K8: recipient mailbox / form service, e.g. server-side mail script — no third-party form service].

WhatsApp. If you write to us on WhatsApp, WhatsApp Ireland Ltd. and Meta Platforms Inc. (USA) process your metadata; messages are end-to-end encrypted. Use WhatsApp only if you agree to this; the contact form and e-mail are alternatives. Data transfer to the USA is based on the EU-US Data Privacy Framework and standard contractual clauses.

3. "Which treatment fits me?"

The five-question finder runs entirely in your browser. Your answers are neither stored nor sent to us. Only if you press "Ask Dr. Kanal" is a summary written into the contact form, which you then send yourself.

4. Videos (YouTube)

Videos on this website are embedded from YouTube (Google Ireland Ltd.) in the extended data-protection mode ("youtube-nocookie.com"). When a video loads, your IP address is transmitted to Google. Videos in the lightbox load only when you click. Videos in the lightbox load only if you allow the "Marketing" category in the cookie banner or confirm when you press play. [K8: Muted background clips in some sections currently load from YouTube on page load (without consent) — self-host these clips and the preview images before publication, or gate them behind the banner] Google's privacy policy: policies.google.com/privacy.

5. Maps

The location maps are static images stored on our server (map data © OpenStreetMap contributors); no data is sent to OpenStreetMap when you view them. "Directions" links open Google Maps in a new window; from that point Google's privacy policy applies. The travel map ("From abroad") is drawn on our server without third-party services.

6. Fonts

[K8: Fonts are currently loaded from fonts.googleapis.com, which transmits your IP address to Google — self-host the fonts before publication (recommended) or add this paragraph with legal basis Art. 6(1)(f) and Google's privacy link]

7. Social media links

Links to Instagram, Facebook, YouTube and LinkedIn are plain links; no plugin loads and no data is transmitted until you click.

8. Your rights

  • Access to your data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21).
  • Withdrawal of consent at any time with effect for the future (Art. 7(3)).
  • Complaint to a supervisory authority: [K8: competent authority for the legal seat, e.g. Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden].

To exercise your rights, write to the address in the imprint or to info@drlook.eu.

9. Changes

We update this policy when the website or the law changes. Status: [K8: date of legal review].