Privacy Notice
Website and patient privacy information
Privacy when visiting this website
Privacy on this website
When you visit this website, technical information may be processed to deliver and secure the site (for example, IP address, access time, requested page and browser information). Where applicable, the legal basis is Article 6(1)(f) GDPR. The actual hosting provider, log retention periods and recipients must be confirmed before publication.
External fonts and scripts
This website loads the Rubik font from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), the i18next translation library from unpkg.com, and a smooth-scrolling polyfill from unpkg.com. Connection data, including IP addresses, may be transmitted to these providers. The legal basis, any consent requirements and international transfers need verification before publication. Hosting these resources locally would be a more privacy-friendly option.
Language preference and local storage
The selected language is saved in the browser’s localStorage under the key “lng” so the preference is retained for future visits. This setting supports the requested language display and contains no medical information.
Contact and external links
When you contact me by email, I process the information you provide to respond to your request. External links, such as links to Instagram or the online booking system, lead to third-party services whose own privacy notices apply when you visit them.
Newsletter and contact form
The website contains a newsletter sign-up form marked in the HTML as a Netlify form. The form may process names, email addresses and optional information about how you found the practice. Before publication, confirm whether and how Netlify actually handles submissions, whether information is transferred to Mailchimp or another mailing provider, how valid consent and any required double opt-in are recorded, and the applicable retention periods. Subscription should take place only with express, informed consent.
Cookies and embedded content
A complete cookie or tracking inventory could not be established from the supplied source code. Some pages include external content, such as an embedded YouTube video on the blog. These integrations and any consent requirements (in particular under section 25 TDDDG) must be checked before publication. This is not a claim that the website uses no cookies.
Privacy Notice for Patients
Last updated: 13 October 2026 · Information pursuant to Article 13 GDPR
1. Data Controller
Christoph Wischnewski · HolisticTouch Heinrich-Heine-Str. 13 · 10179 Berlin, Germany info@holistictouch.org · +49 163 2895319 This notice applies to my independent practice as a non-medical practitioner (Heilpraktiker) at different treatment locations. I rent treatment rooms only and manage patient records myself.
2. Categories of Data and Purposes of Processing
I process names, contact details, appointment and communication data, medical history information, health data, clinical findings, treatment records, and billing and payment data. This is necessary for organising appointments, medical assessment, treatment, documentation, communication, billing and compliance with legal obligations. I store patient records locally on my computer and back them up locally, for example on an external hard drive. I prepare invoices using LibreOffice.
3. Legal Bases
For appointments, the treatment contract and billing: Article 6(1)(b) GDPR; for legal obligations: Article 6(1)(c) GDPR. I process health data for the provision of healthcare under Article 9(2)(h) GDPR, subject to the requirements of Article 9(3) GDPR. Where necessary, I obtain separate consent for other processing activities.
4. Appointment Booking, Notifications and Calendar
I use Acuity Scheduling (Squarespace) for online bookings. Contact and booking data are processed there; medical history forms are not stored in Acuity. Acuity sends automatic confirmations and reminders. Appointments are synchronised with Google Calendar. Under the current settings, patients’ names, email addresses and further booking details are transferred to Google. Please do not enter diagnoses or sensitive health information in free-text fields when booking.
5. Email Communication and Medical History Forms
I use Zoho Mail with a European account region (zoho.eu). Patients may voluntarily return a completed medical history form in advance by ordinary email to info@holistictouch.org, or instead complete it on site or bring it to their appointment. Medical history forms contain particularly sensitive health data. Ordinary email is not end-to-end encrypted throughout; even where transport encryption is used, risks remain, such as sending to the wrong address or unauthorised access to email accounts. Please send medical documents only if you choose to use this transmission method. Returning a form by email is not a condition of treatment. Documents received are added to the patient record; email copies are deleted after transfer where no further retention is required. Confidential communication is also possible in person during the appointment.
6. Payments, Invoices and Tax Adviser
Online payments can be made via Stripe or PayPal; cash payment and bank transfer are also available. Payment service providers and banks process the data necessary to complete payments. My tax adviser receives invoice data required for bookkeeping and tax obligations, but does not routinely receive clinical treatment notes. I do not currently use a card payment terminal.
7. Recipients and Transfers to Third Countries
Depending on the services used, Squarespace/Acuity, Google, Zoho, Stripe, PayPal, banks and my tax adviser may receive data. Some providers may process data outside the European Economic Area or allow access from there. The applicable transfer safeguards (for example, an adequacy decision or standard contractual clauses) depend on the particular provider and agreement. Data are shared with other healthcare professionals or insurers only where a legal basis exists or the necessary consent or release from confidentiality has been obtained.
8. Retention Periods
Patient records are generally retained for ten years after treatment ends, unless longer statutory retention periods apply (section 630f(3) of the German Civil Code, BGB). Invoices and tax documents are subject to the applicable statutory retention periods. Other data are deleted when no longer needed and where no retention obligation applies.
9. Your Data Protection Rights
Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, and, where applicable, data portability and objection. Consent may be withdrawn with effect for the future. You may lodge a complaint with a supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information (www.datenschutz-berlin.de).
10. Provision of Data and Automated Decision-Making
Certain information is required to arrange an appointment and provide safe treatment. Questions that are not necessary may be left unanswered. No solely automated decision-making, including profiling under Article 22 GDPR, takes place as part of my treatment.