Last updated: 25.01.2025

I, Bahareh Pakravesh, take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with statutory data protection regulations, in particular the General Data Protection Regulation (GDPR). With this privacy policy we inform you about how we process your personal data on our website.

1. Name and contact details of the controller and of the company data protection officer

This privacy information applies to data processing by the controller:

Practice name: BePure Naturheilpraxis Name: Bahareh Pakravesh Address: Am Sandtorpark 8 20457 Hamburg

Email: info@bepure.health Phone: 040 / 35771357 Mobile: 0170 / 2090866

Tax number: 94612558079

1. Collection and storage of personal data, and the nature and purpose of its use

When you access my website www.bepure.health, the browser used on your device automatically sends information to the server of our website. This information is stored temporarily in what is known as a log file. The following information is recorded without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer

• Date and time of access

• Name and URL of the file retrieved

• Website from which access originates (referrer URL)

• Browser used and, where applicable, the operating system of your computer as well as the name of your access provider

The data listed above is processed by me for the following purposes:

• Ensuring a smooth connection to the website

• Ensuring convenient use of our website

• Evaluating system security and stability

• Further administrative purposes

The legal basis for this data processing is Art. 6(1)(1)(f) GDPR. My legitimate interest follows from the purposes for data collection listed above. Under no circumstances do I use the collected data for the purpose of drawing conclusions about you as an individual.

1. Disclosure of data

Your personal data is not transferred to third parties for purposes other than those set out below and under sections 4 and 5. I only disclose your personal data to third parties if:

• you have given your express consent to do so in accordance with Art. 6(1)(1)(a) GDPR

• the disclosure is necessary under Art. 6(1)(1)(f) GDPR for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data

• there is a legal obligation for the disclosure under Art. 6(1)(1)(c) GDPR, or

• this is legally permissible and necessary under Art. 6(1)(1)(b) GDPR for the performance of contractual relationships with you

1. Use of Google Maps

This website uses an online map service from the following provider: Google Maps (API) by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Google Maps is a web service for displaying interactive maps in order to present geographical information visually. Through the use of this service, my location is displayed to you and finding your way here is made easier.

As soon as you access the subpages in which the Google Maps map is embedded, information about your use of my website (such as your IP address) is transmitted to Google servers and stored there; this may also involve transmission to the servers of Google LLC in the USA. This happens regardless of whether Google provides a user account through which you are logged in, or whether a user account exists. If you are logged in to Google, your data is assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates it.

Collection, storage and evaluation take place in accordance with Art. 6(1)(f) GDPR on the basis of Google's legitimate interest in displaying personalised advertising, market research and/or the needs-based design of Google websites. You have a right to object to the creation of these user profiles, although you must contact Google to exercise it. If you do not agree to the future transmission of your data to Google as part of the use of Google Maps, it is also possible to deactivate the Google Maps web service entirely by switching off the JavaScript application in your browser. Google Maps, and therefore the map display on this website, can then no longer be used.

Where legally required, I have obtained your consent to the processing of your data as described above in accordance with Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. To exercise your withdrawal, please follow the option for objecting described above.

1. Newsletter

On my website, users are given the option of subscribing to the newsletter for my practice. Which personal data is transmitted to the controller when the newsletter is ordered is set out in the input form.

I inform my patients and interested parties at regular intervals by means of a newsletter about the services offered by my practice. As a rule, the newsletter of my practice can only be received by the data subject if (1) the data subject has a valid email address and (2) the data subject registers for the newsletter. For legal reasons, a confirmation email is sent using the double opt-in procedure to the email address first entered by a data subject for the newsletter. This confirmation email serves to verify whether the owner of the email address, as the data subject, has authorised receipt of the newsletter.

When registering for the newsletter, we also store the IP address of the computer system used by the data subject at the time of registration, as assigned by the internet service provider (ISP), as well as the date and time of registration. The collection of this data is necessary in order to be able to trace any (possible) misuse of a data subject's email address at a later point in time, and therefore serves the legal protection of the controller.

The personal data collected as part of a newsletter registration is used exclusively for sending my newsletter. Furthermore, subscribers to the newsletter may be informed by email if this is necessary for the operation of the newsletter service or a related registration, as could be the case in the event of changes to the newsletter offering or changes to the technical circumstances. The personal data collected as part of the newsletter service is not passed on to third parties. The subscription to my newsletter may be cancelled by the data subject at any time. The consent to the storage of personal data which the data subject has given us for sending the newsletter may be withdrawn at any time. For the purpose of withdrawing consent, a corresponding link is included in every newsletter. It is also possible to withdraw consent at any time directly with the controller named in this privacy policy.

To protect against spam and misuse we use Cloudflare Turnstile. This service is GDPR-compliant and checks anonymously whether an access request comes from a human.

1. Website hosting and technical service providers

Website hosting by Wix: Our website is hosted with: Wix.com Ltd. 40 Namal Tel Aviv St. Tel Aviv 6350671, Israel

Wix processes technical data on our behalf which is transmitted automatically when our website is visited. Further information on data processing by Wix can be found in the Wix privacy policy: https://de.wix.com/about/privacy

Legal basis: Art. 6(1)(f) GDPR (legitimate interests in providing the website)

International data transfer: Wix has locations outside the EU. The transfer takes place on the basis of the European Commission's standard contractual clauses.

1. Online appointment booking (Wix Bookings)

Booking system: For online appointment booking we use "Wix Bookings" from Wix.com Ltd.

Data processed when booking an appointment:

• First name and surname

• Email address

• Telephone number

• Preferred appointments and selected services

• Special requests or health information (if provided)

• Date and time of the booking

• Appointment history

Purposes of processing:

• Appointment scheduling and management

• Appointment reminders by email

• Patient care and communication

• Invoicing

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract)

• Art. 9(2)(h) GDPR (preventive healthcare) for health data

Retention period: 10 years in accordance with retention obligations under healthcare professional law

Reminder service: You receive automatic email reminders before your appointment. You can unsubscribe from these at any time.

1. Contact forms and payment processing

Contact form: You can contact us directly via our contact form.

Data processed:

• First name and surname

• Email address

• Telephone number (optional)

• Message content

• Time of contact

Purpose: Handling your enquiry and communication Legal basis: Art. 6(1)(f) GDPR (legitimate interests) Retention period: 2 years after the end of the communication

Payment processing (Wix Payments): For chargeable services we process payment data via "Old Wix Forms and Payments".

Payment data processed:

• Name and billing address

• Email address

• Selected payment method

• Transaction details

• Invoice history

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract)

• Art. 6(1)(c) GDPR (retention obligation under tax law)

Retention period: 10 years in accordance with tax regulations

Data security: All payment data is transmitted in encrypted form and processed securely at Wix.

1. Online shop (Wix Stores)

E-commerce functions: Via "Wix Stores" we offer products and services for purchase online.

Data processed:

• Customer account information

• Order and purchase history

• Product and service preferences

• Delivery addresses

• Payment information

Purposes:

• Order processing

• Customer support

• Product recommendations

• Invoicing and accounting

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Retention period: 10 years for tax-relevant data, 3 years for customer data

1. Additional Wix functions

Blog function (Wix Blog): Our blog is provided via "Wix Blog". When reading it, only technical data is processed (see section 6).

Multilingual content (Wix Multilingual): For multilingual content we use "Wix Multilingual". Your language preference is stored in order to display the website to you in the language you want.

Website search (Wix Site Search): The search function allows you to find content on our website. Search queries are processed temporarily in order to deliver search results.

Members area (Wix Members Area): If you register for a members area:

• Username and password

• Profile data

• Activity history in the members area

Legal basis: Art. 6(1)(f) GDPR (legitimate interests)

1. Video consultations (Zoom integration)

Online consultations: For online consultations we use Zoom Video Communications Inc., 55 Almaden Blvd, 6th Floor, San Jose, CA 95113, USA.

Data processed:

• Name and email address

• Video and audio data during the session

• Chat messages (if used)

• Connection data and quality

Purpose: Conducting online consultations and advisory sessions

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract)

• Art. 9(2)(h) GDPR (preventive healthcare)

International data transfer: Zoom is a US company. Data transfer takes place on the basis of standard contractual clauses.

Recordings: Sessions are generally not recorded. If a recording is exceptionally necessary, you will be asked in advance for your express consent.

Retention period: Connection data is deleted after the session. Appointments and participant data are stored in accordance with the retention periods under healthcare professional law.

Further information can be found in the Zoom privacy policy: https://zoom.us/privacy

1. Accessibility and design tools

Contrast Checker: To improve the accessibility of our website we use contrast checking tools. These do not process any personal data.

Checkout requirements (Wix Checkout Requirements): This tool helps with the optimal design of the ordering process and processes anonymised usage data to improve the user experience.

1. Cookies and tracking technologies

Our website uses only technically necessary cookies:

Wix cookies:

• Session cookies for website functionality

• Cookies for appointment bookings and the members area

• Language settings (Multilingual)

• Shopping cart functions (Wix Stores)

• Security cookies

Google Maps cookies: As already described under section 4.

No marketing cookies: We do not use any marketing, tracking or analytics cookies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interests)

1. Retention periods – overview

• Website logs: In accordance with Wix policies

• Newsletter registration: Until unsubscription + 6 months

• Contact form data: 2 years after last contact

• Appointment bookings: 10 years (healthcare professional law)

• Patient data: 10 years (healthcare professional law)

• Payment data: 10 years (tax law)

• Shop orders: 10 years (tax law)

• Customer account data: 3 years after last activity

• Zoom session data: Immediately after the end of the session

• Members area: Until account deletion

1. Rights of data subjects

You have the right:

• to request information about your personal data processed by me in accordance with Art. 15 GDPR. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it was not collected by me, as well as the existence of automated decision-making including profiling and, where applicable, meaningful information about its details

• to request the immediate rectification of inaccurate personal data stored by me, or the completion of your personal data, in accordance with Art. 16 GDPR

• to request the erasure of your personal data stored by me in accordance with Art. 17 GDPR, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims

• to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR, where the accuracy of the data is contested by you, the processing is unlawful but you object to erasure, we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing in accordance with Art. 21 GDPR

• to receive your personal data which you have provided to me in a structured, commonly used and machine-readable format, or to request its transmission to another controller, in accordance with Art. 20 GDPR

• to withdraw your consent, once given, at any time in accordance with Art. 7(3) GDPR. The consequence of this is that I may no longer continue the data processing based on that consent in the future, and

• to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you may contact the supervisory authority of your usual place of residence or work, or of my place of business

Competent supervisory authorities:

The Federal Commissioner for Data Protection and Freedom of Information Graurheindorfer Str. 153 53117 Bonn, Germany Phone: +49 (0)228 997799-0 Email: poststelle@bfdi.bund.de

The Hamburg Commissioner for Data Protection and Freedom of Information Ludwig-Erhard-Str. 22, 7th floor 20459 Hamburg Phone: 040 / 428 54-4040 Email: mailbox@datenschutz.hamburg.de

1. Right to object

Where your personal data is processed on the basis of legitimate interests in accordance with Art. 6(1)(1)(f) GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, where there are grounds arising from your particular situation or where the objection is directed against direct marketing. In the latter case you have a general right to object, which I will implement without you having to state a particular situation. If you wish to exercise your right of withdrawal or objection, an email to info@bepure.health is sufficient.

1. Data security

Within the website visit I use the widely used SSL (Secure Socket Layer) procedure in combination with the highest level of encryption supported by your browser. As a rule this is 256-bit encryption. If your browser does not support 256-bit encryption, I use 128-bit v3 technology instead. You can tell whether an individual page of my website is transmitted in encrypted form by the closed display of the key or padlock symbol in the lower status bar of your browser.

Please note: as is well known, data transmission on the internet (for example when communicating by email or using open Wi-Fi networks) has security vulnerabilities. If you wish to send me content that is confidential or requires protection, I recommend that you contact me by telephone first. Depending on the nature and content of the information, I will recommend a suitable means of transmission. I otherwise use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties. My security measures are continuously kept up to date in line with technological developments.

1. Currency of and changes to this privacy policy

This privacy policy is currently valid and is dated 01.01.2025. As my website and the services offered through it develop further, or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed and printed by you at any time on the website at www.bepure.health.

Contact for data protection enquiries For questions about data protection you can reach us at info@bepure.health.