PRIVACY POLICY

Privacy Policy

1. Who we are (Controller)

This Privacy Policy explains how we process personal data when you visit our website https://austriastemcell.com or contact us via the site.

Controllers

Austria Stem Cell
Dr. med. univ. Patricia Lebo
Dr. med. univ. Hans Gschnitzer

Practice addresses:

• • • Mogersdorf 2, 8382 Mogersdorf, Austria
    • Herrengasse 2, 1010 Vienna, Austria 

Contact:
Email: dr.lebo@die-ordi.at
Phone: +43 664 16 61 317

We (the “Controller”) determine the purposes and means of processing personal data in accordance with:

• • • EU General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR) 
    • Austrian Data Protection Act (Datenschutzgesetz – DSG)
    • Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021 – TKG 2021), in particular for cookies and similar technologies.

This Privacy Policy applies only to this website and not to third-party websites that may be linked here.

For questions about this Privacy Policy, please contact us using the details above.

 

2. What data we process, why and on which legal basis

When you use our website, we process only the data that is necessary and proportionate.

2.1 Data processed when you visit the website (server log files)

When you access our website, our hosting provider automatically collects and temporarily stores information in so-called server log files.

Data categories

• • • IP address of the requesting device
    • Date and time of access
    • Accessed pages / files
    • Referrer URL (previously visited page)
    • Browser type and version, operating system
    • Amount of data transmitted and technical status codes (e.g. error codes)

Purposes

• • • Technical delivery of the website
    • Ensuring security and stability of the IT systems (e.g. defence against attacks, troubleshooting)
    • Statistical evaluation in anonymous form (where possible) to improve the website

           Legal basis
           Legitimate interests, Art. 6(1)(f) GDPR: our legitimate interest in operating a secure, stable and user-friendly website.

Log files are usually stored only for a short period and deleted or anonymised afterwards, unless a security incident requires longer storage.

 

2.2 Contact via form or email

On our “Contact us” page you can send us a message using a contact form, or you can contact us directly by email. austriastemcell.com

Data categories

• • • Name
    • Email address
    • Subject
    • Message content
    • Any additional information you voluntarily provide (which may include health information)

Purposes

• • • Processing your enquiry
    • Communicating with you
    • Arranging appointments or preparing treatments
    • Pre-contractual communication and, where applicable, documentation in the context of medical treatment

Legal bases

• • • Performance of a contract / pre-contractual measures (Art. 6(1)(b) GDPR): responding to your enquiry and preparing a potential treatment contract.
    • Legitimate interests (Art. 6(1)(f) GDPR): our interest in answering questions from interested persons and patients and managing communication efficiently.
    • If your enquiry contains health data (e.g. information about complaints, previous treatments): processing is based on Art. 9(2)(h) GDPR in conjunction with relevant
      Austrian medical and professional regulations (e.g. Ärztegesetz), i.e. processing for the purposes of medical diagnosis, provision of health care and treatment by medical
      professionals bound by professional secrecy.

Important note:
Please avoid sending highly sensitive medical details or extensive documents via the simple web form or unencrypted email. Such information is best discussed
during personal consultations or via secure channels.

We store enquiries only as long as necessary to respond and in line with statutory retention periods, especially where the information becomes part of medical documentation.

 

3. Categories of personal data

Depending on how you use our website, the following categories of personal data may be processed 

           3.1 Identification and contact data

• • • Name, surname
    • Email address
    • Phone number
    • Postal address (if you provide it)

         

          3.2 Content data

• • • Free-text messages or information you provide in the contact form or by email (which may incidentally include health data).

       

          3.3 Technical and usage data (browsing data)

• • • IP address
    • Browser and device type
    • Operating system
    • Pages visited and duration of visit
    • Referrer URL
    • Information collected through cookies and similar technologies (see section 4).

We do not intentionally collect data from children via this website. If you are a parent or guardian and believe that your child has provided personal data via our website,
please contact us so we can delete it if  necessary.

 

4. Cookies and similar technologies

Our website uses cookies and similar technologies to ensure its proper functioning and, where applicable, to analyse usage and improve content.

4.1 What are cookies?

Cookies are small text files stored on your device by your browser when you visit a website. They may contain information such as your language setting or a session ID.

Under European and Austrian law, and in particular TKG 2021, we distinguish between:

• • • Technically necessary cookies – required to operate the website and provide basic functions
    • Non-essential cookies (e.g. for analytics, marketing, social media) – these generally require your prior consent BMAS+1

      4.2 Necessary cookies

These cookies are required for:

• • • Displaying the website correctly
    • Enabling navigation and basic functions
    • Ensuring security and prevention of misuse

Legal basis:
Our legitimate interests (Art. 6(1)(f) GDPR) in providing a technically functioning and secure website, in conjunction with Sec. 165 TKG 2021.

Because they are essential, you cannot disable these cookies via our site, but you can block them in your browser settings (which may restrict website functionality).

4.3 Analytics and marketing cookies (if used)

If we implement web analytics or marketing tools (for example to understand how often certain pages are visited or to measure the effectiveness of online campaigns),
these tools set cookies or similar identifiers.

In that case:

• • • These cookies will only be activated after you have given consent (e.g. via a cookie banner).
    • You can withdraw your consent at any time with effect for the future, for example by changing your browser settings or (if available) revisiting the cookie settings on the website.

           Legal basis:

• • • Consent, Art. 6(1)(a) GDPR in conjunction with Sec. 165 TKG 2021.

4.4 Third-party content (e.g. maps, videos, social media)

Our website may include links or embedded content from third parties (for example, map services or video platforms). When you access such content, the respective
providers may process your IP address and other technical data for their own purposes according to their privacy policies.

Currently, our contact and address section may link to Google Maps for route planning. When you click this link or view embedded maps, Google may process personal
data (e.g. IP address, location data) in line with its own privacy policy.

We recommend reading the privacy information of such providers to understand how they process your data.

 

5. Recipients and categories of recipients

We treat your personal data as confidential. Within our practice, only those persons who need access to your data for the purposes outlined above receive it (e.g. doctors, practice staff).

In addition, we may share data with the following categories of recipients:

• • • IT and hosting service providers who support the operation and maintenance of the website (acting as processors under Art. 28 GDPR and bound by contract)
    • External technical providers / web agencies who maintain or further develop the website
    • Other health professionals or institutions, if you explicitly ask us to share information for your treatment or if this is required by law and permitted for your medical care
    • Public authorities, courts and legal advisors, where required to comply with legal obligations or to establish, exercise or defend legal claims

All processors are carefully selected and contractually obliged to process personal data only according to our instructions and to implement suitable technical and
organisational measures to protect your data. 

We do not sell your personal data.

 

6. Data transfers to third countries

We primarily process your personal data within the European Union / European Economic Area (EU/EEA).

If, in individual cases, tools or providers from third countries (outside the EU/EEA) are used and this involves the transfer of personal data (for example certain map,
analytics or marketing providers), we ensure that an adequate level of data protection is in place, for example by:

• • • An adequacy decision of the European Commission, or
    • Standard Contractual Clauses approved by the Commission, and, where required, additional measures.

If such transfers occur, we will explain them in more detail in this Privacy Policy or the cookie information.

 

7. How long do we store your data?

We store personal data only as long as necessary for the purposes stated in this Privacy Policy and in accordance with statutory retention periods.

Criteria for storage periods include:

• • • Legal retention obligations under Austrian law, especially for medical documentation and billing
    • Statutory limitation periods for legal claims
    • Necessity of the data to respond to enquiries and manage any follow-up

After these periods expire, personal data are deleted or anonymised in accordance with legal requirements.

 

8. Your rights as a data subject

Under the GDPR, you have several rights regarding your personal data:

• • • Right of access (Art. 15 GDPR): to obtain confirmation of whether we process personal data about you, and information about such data.
    • Right to rectification (Art. 16 GDPR): to correct inaccurate or incomplete data.
    • Right to erasure (Art. 17 GDPR): to request deletion of your data, where legal conditions are met.
    • Right to restriction of processing (Art. 18 GDPR).
    • Right to data portability (Art. 20 GDPR): to receive personal data you provided to us in a structured, commonly used and machine-readable format.
    • Right to object (Art. 21 GDPR): to object to processing based on legitimate interests, on grounds relating to your particular situation.
    • Right to withdraw consent (Art. 7(3) GDPR): where processing is based on consent, you can withdraw it at any time with effect for the future.

To exercise your rights, please contact us using the contact details in section 1. We may need to verify your identity to handle your request.

Right to lodge a complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority, in particular
in the Member State of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR).

In Austria, the competent authority is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna, Austria

 

9. Security of your data

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration,
unauthorised disclosure or access.

These measures include, for example:

• • • Access control and role-based authorisations
    • Secure hosting and regular updates of systems
    • Data minimisation and restricted access to sensitive information
    • Regular review of our security procedures

Please note that transmission of data over the internet (for example via email) can have security risks. For highly sensitive medical information, we recommend
using more secure communication channels.

 

10. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR in connection with this website.

 

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example if our website or legal requirements change. The current version is always available
at https://austriastemcell.com under “Privacy Policy”.

Last updated: December 2025