Privacy Policy

Controller (clinic): Dr. Fatih Yıldırım — Authorized Dripfy Corner, Schillerstraße 31, 60313 Frankfurt am Main, Germany. Phone: +49 177 3344725. E-mail (general and data-protection inquiries): [email protected].

Trademark and longevity infrastructure provider: Dripfy GmbH, Neue Mainzer Straße 66, 60311 Frankfurt am Main, Germany. The clinic operates as an authorized "Dripfy Corner" in Frankfurt am Main under license from Dripfy GmbH. Dripfy GmbH is not the controller of your medical data.

Identity data: name, date of birth.

Contact data: phone, e-mail, address.

Health insurance data: insurance type and insured number (only where required for invoicing).

Health data (special category, Art. 9 GDPR): medical history, examination findings, lab/imaging results, treatment plans, surgical and post-operative records.

Financial data: invoicing only (no card data stored on our servers; payment via PCI-DSS-compliant providers).

Marketing preferences: newsletter/SMS/WhatsApp consents, longevity quiz results (consent-based only).

Technical data: IP address, browser type, pages visited (server logs and — only with your consent — analytics/marketing tools).

Provision of medical services and patient file management — Art. 6(1)(b) contract performance (treatment contract, Sec. 630a German Civil Code/BGB), Art. 9(2)(h) GDPR in conjunction with Sec. 22(1) no. 1(b) BDSG: provision of healthcare by persons bound by professional secrecy (Sec. 203 German Criminal Code/StGB).

Appointment management and patient communication (web forms, e-mail, phone, WhatsApp) — Art. 6(1)(b).

Compliance with medical professional law and tax law (documentation duty under Sec. 630f BGB, Professional Code of the Hessen State Medical Association, retention under Sec. 147 Fiscal Code/AO) — Art. 6(1)(c) legal obligation.

Invoicing and health-insurance processes (German Medical Fee Schedule, GOÄ) — Art. 6(1)(b) and (c).

Marketing, newsletter and longevity content; analytics and marketing cookies; WhatsApp communication — Art. 6(1)(a) and Art. 9(2)(a) explicit consent only.

Secure operation of the website (server logs, abuse prevention, defence of legal claims) — Art. 6(1)(f) legitimate interest.

With your explicit consent only, your marketing-related contact data (name, email, phone, longevity preferences) may be shared with Dripfy GmbH for the purposes of longevity program updates, IV protocol education and global patient communications.

Your medical (health) data is never shared for marketing purposes.

Both the clinic and Dripfy GmbH are located in Germany (EU); this sharing does not constitute a transfer to a third country and is governed directly by the GDPR.

You may withdraw consent at any time with effect for the future via 'unsubscribe' in our e-mails or by contacting [email protected] (Art. 7(3) GDPR).

Recipients within Germany/EU: partner laboratories and imaging centres, consulting physicians and hospitals in case of referral, health insurers (legal obligation or at your request), tax advisor (legal obligation), IONOS (web hosting and delivery of form e-mails — processor under Art. 28 GDPR).

Transfers to third countries (only with your respective consent): Google Analytics 4 (Google Ireland Ltd. / Google LLC, USA), Meta Pixel and WhatsApp (Meta Platforms Ireland Ltd. / Meta Platforms Inc., USA), TikTok Pixel (TikTok Technology Ltd., Ireland; onward transfers to third countries possible). Transfers to the USA rely on the provider's certification under the EU-US Data Privacy Framework and/or the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

No data is transferred to third countries without your consent and appropriate safeguards.

Patient records: at least 10 years after completion of treatment (Sec. 630f(3) BGB and the Professional Code of the Hessen State Medical Association); longer statutory periods (e.g. radiology records) apply where required.

Invoices and tax-relevant documents: 10 years (Sec. 147 AO).

Contact and appointment records: until the purpose ceases; where no statutory retention applies, deleted at the latest after the general limitation period of 3 years (Sec. 195 BGB).

Marketing data: until withdrawal of consent.

Analytics data: at most 14 months in Google Analytics 4; server logs are kept by the hosting provider for a short period for security purposes and then deleted.

Right of access (Art. 15) — request a copy of your personal data.

Right to rectification (Art. 16) — correction of inaccurate data.

Right to erasure ('right to be forgotten', Art. 17) — subject to legal retention obligations.

Right to restriction of processing (Art. 18).

Right to data portability (Art. 20).

Right to object (Art. 21) — to processing based on legitimate interest and, at any time, to direct marketing.

Right to withdraw consent at any time (Art. 7(3)) — without affecting the lawfulness of processing before withdrawal.

Right to lodge a complaint with a supervisory authority (Art. 77): the competent authority for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, https://datenschutz.hessen.de. You may also contact the supervisory authority of the EU member state in which you reside.

Obligation to provide data (Art. 13(2)(e)): identity, contact and health data required for treatment are necessary to conclude the treatment contract; marketing and cookie data are entirely voluntary.

Automated decision-making (Art. 22): we do not use automated decision-making or profiling producing legal effects.

Essential cookies / local storage are used to operate the site (language preference, theme, your cookie choice) — Sec. 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR.

Analytics (Google Analytics 4 with IP anonymisation) and marketing tools (Meta Pixel, TikTok Pixel) are loaded only with your explicit consent via our cookie banner — Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR.

You can change your preferences or withdraw consent at any time via the cookie settings link in the footer.

If you choose to contact us via WhatsApp (Meta Platforms Ireland Ltd.), the message content and metadata (phone number, timestamps) are processed on Meta's servers and may be transferred to the USA. You use this channel at your own choice (Art. 6(1)(a) and (b) GDPR).

We use WhatsApp for appointment coordination and general questions. Please do not send health data (findings, lab results, images) via WhatsApp; for medical questions please use an appointment, phone or e-mail.

For WhatsApp's own processing, please refer to Meta's privacy policy.

For data-protection inquiries: [email protected] (clinic), by post to Schillerstraße 31, 60313 Frankfurt am Main, Germany, or [email protected] (Dripfy GmbH, marketing data only).

We respond without undue delay and at the latest within one month (Art. 12(3) GDPR); for complex requests this period may be extended by two months, in which case we will inform you.