Mandatory information under the German Digital Services Act (DDG) and information on the processing of personal data under the General Data Protection Regulation (GDPR).
This English text is a courtesy translation; the legally binding version is the German one.
The professional regulations can be viewed on the website of the State Chamber of Physicians of Baden-Württemberg.
As medical treatments, the practice's services are largely exempt from VAT pursuant to § 4 No. 14 of the German VAT Act. A VAT identification number is not available.
Dr. med. Sebastian Romann, address as above
The European Commission provides a platform for online dispute resolution (ODR): ec.europa.eu/consumers/odr. We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.
As a service provider, we are responsible for our own content on these pages under the general laws. However, we are not obliged to monitor transmitted or stored third-party information. The content of this website serves general information purposes and does not replace individual medical advice.
Our website may contain links to external third-party websites over whose content we have no influence. The respective provider is always responsible for the content of those external sites.
The content and works created by the practice on these pages are subject to German copyright law. Third-party contributions are marked as such.
The protection of your personal data is of particular concern to us. As a medical practice, we process specially protected health data and are additionally bound by medical confidentiality (§ 203 of the German Criminal Code). We process your data exclusively on the basis of the statutory provisions (GDPR, German Federal Data Protection Act).
The appointment of a data protection officer is not currently a statutory requirement for the practice (no extensive processing of special categories of personal data as a core activity within the meaning of Art. 37(1)(c) GDPR; fewer than 20 people continuously involved in the processing of personal data pursuant to § 38 BDSG).
We process personal data for the following purposes:
When you send us an enquiry via the contact form, your details (name, contact data, request) are stored for the purpose of processing it. Please do not transmit sensitive health data via the form. We do not share this data without your consent and delete it once processing is complete and no retention obligations apply.
Borealys GmbH provides the medical practice with an online appointment calendar web app via its private practice software Pixelmedics. This software is installed locally on the practice’s own server. The booking app is accessed via a subdomain of the practice website’s domain. All customer and patient data are stored exclusively locally on the practice’s server. The medical practice is fully responsible for the confidentiality, protection and lawful use of these data. Pixelmedics has no access to the stored data (except in the event of a support intervention) and assumes no responsibility for the management or processing of the data by the medical practice. All online operations within the booking process take place via encrypted connections in order to ensure the security of data transmission and to prevent unauthorised access. The medical practice is required to ensure compliance with all data protection requirements, in particular under the General Data Protection Regulation (GDPR).
The booking system is available at onlinetermine.kardiometabolik.de. As part of the booking we process the details you enter (in particular name, contact details, requested appointment and, where applicable, the reason for the appointment) solely to arrange and carry out the appointment. The legal basis is Art. 6(1)(b) GDPR; where you provide information about your health, additionally Art. 9(2)(h) GDPR in conjunction with § 22 BDSG. Use of online booking is voluntary; you can always make appointments by phone or e-mail instead. (The German version of this privacy policy is authoritative.)
This website is hosted by Infomaniak Network AG, Rue Eugène Marziano 25, 1227 Les Acacias (Geneva, Switzerland). When the site is accessed, technical access data (IP address, date/time, page accessed, browser type) is automatically processed in server log files. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). A data processing agreement under Art. 28 GDPR is in place with the hosting provider.
The fonts used on this website (Cormorant Garamond, Inter) are hosted locally on our server. When the page is accessed, no connection to Google or other third-party servers is established; no personal data is transferred to third parties in this respect.
Your data is only disclosed where this is permitted or required by law — for example to co-treating or referring physicians (with your consent), to laboratories, to a private medical billing service (if such a service is engaged) or due to a legal obligation. Because our hosting provider is located in Switzerland, a transfer of data to a third country takes place. Switzerland benefits from an adequacy decision by the European Commission (Art. 45 GDPR), meaning it is recognised as offering a level of data protection comparable to that of the EU, so no additional safeguards are required. No further transfer to other third countries takes place.
Patient data is stored in accordance with medical and statutory retention periods — medical records generally for at least 10 years after the end of treatment (§ 630f of the German Civil Code), and longer in certain cases. The data is then deleted unless further obligations apply.
Under the GDPR you have the following rights:
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, baden-wuerttemberg.datenschutz.de.
We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Data transmission on this website is encrypted (TLS/SSL).
Version of this privacy policy: September 2026. We will update it where changes in processing or the legal situation require.