Privacy Policy
Responsible Party
The responsible party within the meaning of the General Data Protection Regulation (GDPR) is:
Nadin Elyan
Münsterstraße 30–34
44145 Dortmund
Germany
Email: praxiselyan@t-online.de
Phone: 0231 81 23 39
Website: www.praxis-elyan.com
General Information on Data Processing
We take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with the legal provisions. This privacy policy informs you about which data we collect when you use this website, how we use it, and what rights you have as a data subject.
The processing of personal data is carried out exclusively on the basis of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and other applicable data protection regulations.
Hosting and Server Logfiles
This website and the associated content (e.g., texts, images, practice information) are stored and delivered by an external hosting and infrastructure provider:
Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA
A data processing agreement exists with the provider in accordance with Art. 28 GDPR; the transfer to the USA is based on the EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR).
When you visit this website, the following data is automatically transmitted by your browser to our server and temporarily stored in so-called server logfiles:
IP address of the requesting computer
Date and time of access
Name and URL of the retrieved file
Website from which access is made (referrer URL)
Browser and operating system used
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in ensuring a technically error-free and secure operation of the website). The logfiles are automatically deleted without merging with other data sources as soon as they are no longer necessary for the aforementioned purposes.
Data Storage: Database and Media Storage
Structured website content (opening hours, blog posts, page texts, settings) as well as appointment requests are stored in a PostgreSQL database:
Neon, Inc., 5 W 19th Street, New York, NY 10011, USA – Server location: EU (Frankfurt am Main, Germany)
Images, profile photos, and other media files are stored in a secure object storage:
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA – Server location: EU
Data processing agreements exist with both providers in accordance with Art. 28 GDPR. Storage in the EU ensures compliance with the GDPR even without additional standard contractual clauses. Appointment requests and consent records are stored in a protected and encrypted manner.
Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfillment, appointment processing), Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interest in the reliable operation of the website).
Cookies and Local Storage
This website uses only technically necessary cookies or comparable storage technologies (e.g., local storage of your browser) that are required for the operation of the website:
Language setting: A cookie stores the language you have chosen so that the website can be displayed in the last selected language during your next visit.
Map consent: If you have consented to the integration of Google Maps (see section "Google Maps"), this consent is stored in your browser's local storage so that you are not asked again on each visit.
Admin area: A session cookie is used in the internal, password-protected admin area of the practice, which is used exclusively by practice staff.
These cookies or storage technologies cannot be disabled without the website or individual functions no longer functioning properly. They do not contain any personal data of website visitors and are not used for analysis, tracking, or marketing purposes.
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a functional, user-friendly design of the website) or § 25 para. 2 TTDSG.
Beyond the aforementioned technically necessary storage technologies, we do not use analysis, tracking, or marketing cookies (e.g., Google Analytics).
Furthermore, we only collect anonymous click events (e.g., click on "Call Now", directions or Google Maps, or appointment booking) for purely statistical and technical evaluation. No IP addresses, cookies, or personal data are stored; individual visitors are not recognized.
Google Maps
On the "Opening Hours & Contact" page, we offer the option to load an interactive map from Google Maps to facilitate your journey to our practice.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (on behalf of Google LLC, USA).
The map is not loaded automatically but only when you actively consent via the corresponding button. Only with your consent is the connection to Google servers established; this includes your IP address and possibly other usage data being transmitted to Google – also to the USA – and processed there. Google may set cookies in your browser in this process.
Legal basis: Art. 6 para. 1 lit. a GDPR (consent). Your consent is stored locally in your browser (see section "Cookies and Local Storage") and is valid until you clear the local storage of your browser. You can prevent the integration at any time by not consenting to the map or by deleting the local storage of your browser.
Further information on data processing by Google: https://policies.google.com/privacy
Online Appointment Booking with DocVisit
On the "Appointments" page, we offer the option to load the online appointment calendar of the provider DocVisit to conveniently book an appointment with us online.
Provider: DGN Deutsches Gesundheitsnetz Service GmbH, [INSERT DGN ADDRESS].
Two-click solution: The appointment calendar is not loaded automatically. Only when you actively consent via the corresponding button is the connection to DocVisit established. No data is transmitted to DocVisit before your consent.
Processed data: With your consent, when loading the calendar, your IP address and browser data are transmitted to DocVisit. Data processed during the booking process includes your name, date of birth, contact details, and your appointment request (date, time, and possibly specified reason for visit).
Note on the reason for visit: The reason for visit may represent health data within the meaning of Art. 9 para. 1 GDPR (e.g., information about complaints or illnesses).
Legal basis: Art. 6 para. 1 lit. a GDPR (consent) and – in the context of appointment booking – Art. 9 para. 2 lit. a GDPR for the processing of health data.
Data processing agreement: [DATA PROCESSING AGREEMENT WITH DGN/DOCVISIT EXISTS — INSERT DATE].
Revocation: Your consent applies only for the respective page visit; the calendar will be loaded again on each visit only after your consent. You can revoke your consent at any time with effect for the future by not loading the calendar or by leaving the page without consenting to the loading.
Processing of Patient Data
The patient data collected in the context of the treatment relationship (especially health data) are processed exclusively to fulfill our medical obligations. This data is subject to medical confidentiality and will not be disclosed to third parties unless required by law or you have expressly consented.
Legal basis: Art. 9 para. 2 lit. h GDPR in conjunction with § 22 para. 1 no. 1 lit. b BDSG and § 630a BGB.
Patient data will be stored for the duration of the statutory retention obligations (usually 10 years after the end of treatment).
Your Rights as a Data Subject
You have the following rights regarding your personal data:
Right to access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent given with effect for the future (Art. 7 para. 3 GDPR)
To exercise these rights, please contact the address mentioned in the "Responsible Party" section.
Furthermore, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The responsible authority is particularly:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
P.O. Box 20 04 44, 40102 Düsseldorf
Phone: 0211 / 38424-0
Website: https://www.ldi.nrw.de
Right to Object to Data Processing
If we process your personal data on the basis of legitimate interests in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to this processing at any time. We will then cease processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
Data Security
This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the lock symbol in the address bar of your browser and the prefix "https://".
Our website is delivered via the infrastructure of our hosting provider (see section "Hosting and Server Logfiles"), which implements appropriate technical and organizational measures to protect the transmitted data. Content containing patient or inquiry data is additionally secured through access-protected areas and encrypted transmission paths.
Overview of External Service Providers Used
In the context of operating this website, we use the following external service providers. Data processing agreements in accordance with Art. 28 GDPR exist with all providers as required by law:
Vercel Inc., USA – Hosting and delivery of the website. Server location: EU possible; transfer to the USA based on EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR).
Neon, Inc., USA – PostgreSQL database for structured content and appointment requests. Server location: EU (Frankfurt am Main). The data remains in the EU.
Cloudflare, Inc., USA – Object storage (R2) for images and media. Server location: EU. The data remains in the EU.
Google Ireland Limited, Ireland – Display of the directions map via Google Maps, exclusively after your express consent (opt-in).
The aforementioned service providers only receive the data necessary for the respective purpose. Further use or disclosure of the data by the service providers for their own purposes is contractually excluded.
Current Status and Changes to this Privacy Policy
This privacy policy is current as of June 14, 2026.
We reserve the right to update this privacy policy as necessary to adapt it to changed legal situations or changes to the website or our services. The version available at the time of your visit to this website applies.