Protecting your data is particularly important to us – especially when it comes to medical topics. This website has been deliberately built to be data-minimizing: without external analytics or advertising services, and with locally embedded fonts. Below we provide you with information pursuant to Art. 13 GDPR (DSGVO).
1. Controller
Plastetik GmbH, Bürgerstraße 14, 81925 München
Phone: +49 89 987855, email: info@dr-woerl.de
Represented by the management (see legal notice).
2. Data protection officer
Philip Knoll
KnoCo UG (haftungsbeschränkt), Zanderweg 15, 85586 Poing
Email: datenschutz@knoco.de
You can contact our data protection officer directly and confidentially with any questions about data protection and about exercising your rights.
3. Accessing the website and server logs
When you access this website, the web server processes technically necessary data: IP address, date and time, page accessed, amount of data transferred, referrer as well as browser and operating system information. This is necessary to deliver the website, to ensure its security and to fend off attacks.
The legal basis is Art. 6(1)(f) GDPR (DSGVO); our legitimate interest lies in secure and stable operation. The logs are deleted after 14 days at the latest, unless they are needed to investigate a security incident.
3a. Audience measurement (server-side, without cookies)
In order to improve our website and make it findable (search engine optimization), we evaluate the use of this website with our own server-side audience measurement. No cookies are set, no tracking script is executed and no data is transmitted to third parties.
For each page view, we store: time, page accessed, status code, the referring website (without parameters), in the case of search engines their name and – only if transmitted – the search term, campaign identifiers (utm parameters), country, region and city as well as approximate coordinates (rounded to about 11 km), device type, browser, operating system, preferred language and, in the case of automated access, the name of the crawler.
Your IP address is not stored. It is only used in working memory during the request to determine the country and city using a database located locally on our server (DB-IP City Lite) and to verify genuine search engine crawlers via DNS lookup; it is then discarded. In order to be able to count visits, we create a checksum from the IP address, browser identifier and a random value that is newly generated every day. The random value is deleted daily – recognition across several days or recalculation of the IP address is therefore not possible.
The aggregated results (without individual data, cities only from three visits upwards) are displayed at /analytics. Logged-in editors are not recorded.
The legal basis is our legitimate interest in designing the website according to need and making it findable (Art. 6(1)(f) GDPR (DSGVO)). Since no information is stored on or read from your device, no consent pursuant to § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is required. We automatically delete the data after 25 months. You can object to the processing at any time (Art. 21 GDPR (DSGVO)), e.g. by email to our data protection officer.
4. Hosting
This website is operated on a server of KnoCo UG (haftungsbeschränkt), Zanderweg 15, 85586 Poing. The data center operator is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen; the server is located in the European Union. Data processing agreements pursuant to Art. 28 GDPR (DSGVO) are in place or are being concluded with the service providers. This section must be adapted when moving to the final server.
5. Cookies and consent
We only set one technically necessary cookie (“pl_consent”), which stores your choice in the consent dialog for 12 months. The legal basis is § 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(c) and (f) GDPR (DSGVO).
Only if you explicitly choose „Dieses Gerät nicht mehr mitzählen“ (do not count this device) on the /analytics page do we additionally set the cookie “pla_nicht_zaehlen” (12 months). It contains no identifier and only ensures that visits from this browser are not recorded in the audience measurement. The legal basis is § 25(2) No. 2 TDDDG (expressly requested by you). You can remove it there via „Wieder mitzählen“ (count again) or in your browser.
For logged-in editors, WordPress additionally sets login cookies in the protected administration area. This is not relevant for visitors to the website.
You can change or withdraw your consent at any time via the “Cookie settings” link in the footer of every page.
6. Google Maps (only with consent)
On the “Locations” page, you can display location maps from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The maps are only loaded once you consent – before that, there is no connection to Google.
After your consent, your browser transmits data to Google, in particular your IP address and the information about which page you visited. This may involve a transfer to the USA. Google LLC is certified under the EU-US Data Privacy Framework; the EU Commission has determined an adequate level of data protection for this (Art. 45 GDPR (DSGVO)).
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (DSGVO) and § 25(1) TDDDG. You can withdraw it at any time with effect for the future. Further information: Google’s privacy policy.
7. Contact by email or phone
If you contact us by email or phone, we process your information in order to answer your inquiry and, if applicable, to arrange an appointment. The legal basis is Art. 6(1)(b) GDPR (DSGVO) (initiation of a treatment contract), and for health information additionally Art. 9(2)(h) GDPR (DSGVO).
Please do not send detailed health information or photos by unencrypted email. We discuss medical details confidentially in a personal conversation. We delete inquiries once they have been dealt with, provided that no statutory retention obligations prevent this.
8. Online appointment booking and patient account
To book appointments online, you create a patient account. In doing so, we process your first name, last name, email address, phone number (optional) and a password (stored only in encrypted form). For each booking, we store the appointment type, date, time, location, status as well as the time and version of your consent.
Because the appointment type and appointment may allow conclusions to be drawn about your health, we only process this data with your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR (DSGVO)), which you give before each booking. The account itself serves to initiate a contract (Art. 6(1)(b) GDPR (DSGVO)). Please do not enter any medical details in the account itself. If you would like to send information, questions or images, please use the voluntary, encrypted patient area (section 8b).
Recipients: Dr. med. Hans-Hermann Wörl and the practice team of Plastetik GmbH; the technical operator of the website within the scope of data processing on behalf (see Hosting). Appointments may be transferred to the practice calendar; by default, we only transfer the date, time and initials.
Emails: You receive confirmations and cancellations by email. The subject line does not contain the appointment type.
Storage period: We automatically delete appointments 24 months after the appointment date. Your account remains in place until you delete it. You can delete your account yourself at any time under “My account” – this deletes all your appointments and cancels upcoming appointments. In doing so, you also withdraw your consent.
Security: Login only via HTTPS, limitation of failed login attempts, passwords of at least 10 characters and stored only as a hash, no access from patient accounts to the administration area.
8b. Patient area (voluntary, encrypted)
With your patient account, you can additionally set up a personal patient area. It is voluntary: you can also book appointments without it. You set it up yourself under “My account” by giving your explicit consent.
Data processed: information you enter yourself (e.g. date of birth, concern, pre-existing conditions, medication, allergies, previous operations, smoking), your messages to the practice and its replies, including attachments (photos, documents, videos and voice messages), images you upload together with an optional description, the time and version of your consent, and a log of when you or the practice accessed your area. When uploaded, photos are saved anew; embedded information such as the location where the photo was taken (GPS) and the device is removed in the process. Videos, documents and voice messages are stored unchanged; any information they contain (e.g. the recording location in videos) is retained.
Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR (DSGVO)). You can withdraw it at any time with effect for the future by deleting the patient area under “My data & rights”. Your appointment account remains in place.
Purpose and recipients: preparation, performance and aftercare of your consultation and treatment, as well as communication with you. The content can only be viewed by Dr. med. Hans-Hermann Wörl and practice staff authorized by him; technical operation is carried out by the processor (see Hosting). No disclosure to other third parties, no transfer to third countries, no analysis by AI, no automated decision-making.
Transfer to the practice management system: only if you separately consent to this when creating the area or later under “My data & rights” will the practice transfer your information, messages and files to its practice management system (the practice’s electronic patient file). The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR (DSGVO)); it is voluntary and can be withdrawn at any time. Content already transferred is then subject to the statutory retention periods for patient files (ten years, § 630f(3) BGB, German Civil Code). Irrespective of this consent, the practice documents information that is essential for your treatment on the basis of its legal obligation (Art. 9(2)(h) GDPR (DSGVO), § 630f BGB, German Civil Code).
Documents to prepare for your appointment: depending on the type of appointment, the practice can provide documents to read and questionnaires. We point this out in the confirmation email for your appointment booking (titles of the documents and a link to the patient area); only if the practice has expressly configured this for a document is an information sheet attached as a PDF. Your answers in questionnaires are stored encrypted, like all content; we also store when you confirmed that you have read a document or submitted a questionnaire. The legal basis is your consent to the patient area (Art. 6(1)(a) and Art. 9(2)(a) GDPR (DSGVO)).
Two-factor login (voluntary): if you switch it on, we store a secret key for your authenticator app (encrypted) as well as recovery codes (only as a check value, not in plain text). The app generates the codes on your device; no data is transmitted to us or to the provider of the app in the process. The legal basis is Art. 6(1)(a) GDPR (DSGVO) in conjunction with Art. 32 GDPR (DSGVO) (security of processing). You can switch off two-factor login yourself at any time.
Active sessions and login history: for each existing session, WordPress stores, as technically necessary, the browser identifier, IP address and the start and expiry of the session until you log out or the session expires (14 days at most). In the “My account” tab we show you your active sessions and your last 20 login attempts with the time, device type and approximate location (city, country). We determine the location at the moment of login from the IP address using a database stored locally on our server; the IP address itself is not stored for the login history. The purpose is to enable you to recognise access by others (Art. 6(1)(f) and Art. 32 GDPR (DSGVO)).
Notifications, reminders and language: you decide yourself whether you would like to be notified by email about replies from the practice and about documents to prepare for your appointment, and to be reminded one day before your appointment; the emails do not contain any medical content. We store your preferred language in order to display the patient area and our emails to you in this language. The legal basis is your consent (Art. 6(1)(a) GDPR (DSGVO)), which you can change there at any time.
Companion (voluntary): you can store the name, relationship and telephone number of a person who, for example, collects you after a procedure. The details are stored encrypted and are viewed only by the practice in order to contact the person if necessary; the person does not receive access to your patient area. Please inform the person of this. The legal basis is Art. 6(1)(f) GDPR (DSGVO) (organisation of your treatment).
Change of your email address: we only adopt a new address once you have opened the confirmation link that we send to the new address (valid for 24 hours); we send a notification to the previous address.
Messages: the exchange does not take place in real time. You will usually receive a reply within a few working days. The email notification does not contain any content. The patient area is not intended for emergencies; no remote diagnosis or treatment takes place.
Encryption: transmission exclusively via HTTPS. Information, messages, attachments, images and image descriptions are stored individually encrypted (XChaCha20-Poly1305). Each patient area has its own key, which in turn is protected by a master key; this master key is stored on the server separately from the database. Images and attachments cannot be accessed via a public address.
Storage period: until you delete the patient area or your account. If you do not log in, we automatically delete the area after 24 months. On deletion, the key, all records and the image files are removed. Content that is essential for your treatment is transferred by the practice to its patient file; the statutory retention periods apply there (§ 630f BGB, German Civil Code).
Your rights directly in the patient area: under “My data & rights”, you can see at any time which data is stored and who accessed it and when (Art. 15 GDPR (DSGVO)). You can download all data including images as a file (Art. 15(3) and Art. 20), change information yourself (Art. 16), request restriction of processing (Art. 18), and withdraw your consent and delete everything (Art. 7(3), Art. 17). You can find your further rights in section 10.
8a. Patient chat (AI assistant)
On this website you can ask an AI assistant general questions. It answers exclusively from the content of this website and cites the source with every answer. The language model runs on our own server – your questions are not transmitted to external AI providers. The chat is only loaded when you open it.
Data processed: the text of your question and the language of the page. Your questions are not stored or logged; to limit misuse we count requests using an anonymous value that changes daily, without storing your IP address. The legal basis is our legitimate interest in clear patient information (Art. 6(1)(f) GDPR). Please do not enter names or personal health information in the chat.
“Contact the doctor”: If you send your question to the practice, we transmit your name, email address or phone number, your message and the chat so far to Dr. med. Hans-Hermann Wörl and the practice team. Because this information may include health data, this only happens with your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which we store with time and wording. The request is stored only in the protected administration area; the email notification to the practice contains no content. We delete the request no later than 90 days after receipt. You can withdraw your consent at any time.
Note: The answers are generated by an AI model, may contain errors and do not replace medical advice.
9. Fonts and external content
All fonts are embedded locally on our server. When you access the website, no data is transmitted to font providers, content delivery networks, social networks or external analytics services. Links to external websites only open their content when you click on them.
10. Your rights
You have the right of access (Art. 15 GDPR (DSGVO)), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time (Art. 7(3)).
You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian Data Protection Authority), Promenade 18, 91522 Ansbach, www.lda.bayern.de.
11. Data security
This website is delivered exclusively in encrypted form via HTTPS. Servers and software are updated regularly.
12. Version
Version: 03.11.2026. To be approved by the data protection officer before publication on dr-woerl.de.