Privacy Policy

As at August 2026

Here we explain, in a clear and concise manner, what data this website processes, why we need it and what rights you have.

Who is responsible?

The following parties are jointly responsible for data processing on this website and in connection with online appointment booking:

Dr. Gerhard Kofler
Dr. Kristina Lessel
Rechte Wienzeile 147
1050 Wien
Email: ordination@hno-anderwien.at

For specific data protection requests, please use this contact point. Please use the practice’s contact details provided at the time of booking to change appointments or cancel them.

When you visit the website

When you access the website, the web server processes, in particular, your IP address, the date and time, the page accessed and browser information. We use this data to provide the website, to operate it securely and to detect technical errors. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and reliable operation of the website.

We use technical service providers for hosting and technical operations. They are only permitted to process the data on our behalf.

Fonts, stylesheets and JavaScript are hosted on our own server – with the exception of the Google Map, which is only loaded once you have selected it. We do not use web analytics or advertising tracking, nor do we create user profiles.

What types of cookies are there?

We only use technically necessary cookies – no analytics or advertising cookies. No consent banner is required for these cookies. The legal basis is Section 165(3) of the TKG 2021 and, depending on the function, Article 6(1)(b) or (f) of the GDPR.

• Language setting: remembers your chosen language for one year.
• Secure appointment booking: protects the booking form and is deleted when the browser is closed. This cookie does not contain any patient or form data.

Online appointment booking and notifications

When you book online, we store your name, telephone number, the appointment you have chosen and the language, as well as – if provided – your title and email address.

Your name, telephone number and preferred date are required for online booking. Without this information, it is not possible to book online. Your email address is optional and is only required for confirmation by email.

We use the data solely for the purpose of booking appointments, making any necessary enquiries and organising the surgery.

Only authorised personnel who are bound by a duty of confidentiality have access to this information. We do not use the data for advertising purposes and do not create user profiles. The IP address is not stored alongside the appointment in the booking database. However, it may be included in the server logs described above.

We require this data in order to arrange the requested appointment and to manage the treatment relationship. The legal basis is Article 6(1)(b) of the GDPR.

As booking an appointment may already be linked to medical treatment, the information provided may constitute health data. The processing of such data is additionally subject to Article 9(2)(h) of the GDPR and medical confidentiality.

Where such information forms part of the medical records required by law, the processing is also based on Article 6(1)(c) of the GDPR.

When an appointment confirmation is sent, the delivery service provider used for this purpose receives the email address or telephone number and the necessary message content, depending on the delivery method. The service provider may only use this data for dispatch, delivery and the resolution of technical faults.

The messages do not contain a diagnosis or any details regarding the reason for treatment. An automatic SMS reminder is not currently sent at a later date.

Google Maps

Google Maps does not load automatically. Only when you select ‘Load Google Map’ will your browser establish a connection with Google Ireland Limited. In doing so, Google receives, in particular, your IP address and information about your browser and device.

Loading the map is optional and is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 165(3) of the TKG 2021. The map is not required to use the website.

Google may also process data in the US. According to Google, the EU-US Data Privacy Framework and, where necessary, standard contractual clauses are used for this purpose.

If you click on the route link, you will leave our website and be taken directly to Google Maps.

Google’s Privacy Policy
Additional Terms of Use for Google Maps

How long do we keep data?

We only retain server logs for as long as is necessary for secure technical operation, troubleshooting and defence against attacks. In the event of a specific security incident, the relevant logs may be retained for longer until the matter has been resolved.

We only retain data that is required solely for appointment management and does not form part of the medical records for as long as it is needed for organising appointments, handling any necessary enquiries, or asserting and defending legal claims. It is then deleted.

Delivery and error data are deleted as soon as they are no longer required for delivery or for the resolution of technical faults.

Where data forms part of medical records, it must, in principle, be retained for at least ten years in accordance with Section 51(3) of the Medical Practitioners Act.

Your data protection rights

Provided that the legal requirements are met, you may request access to your data, rectification, erasure, restriction of processing, data portability or object to the processing.

Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of the processing carried out prior to withdrawal. Statutory retention obligations or the rights of other individuals may limit the scope of erasure.

For enquiries regarding data protection, please write to the email address given above. It would be helpful if you could state your name, the relevant process or time period, and the nature of your enquiry. No specific form or justification is required.

Please do not send copies of your ID or medical records without being asked. We will only ask for further details regarding your identity if we have reasonable grounds for doubt.

We generally reply within one month. In exceptional cases, this time limit may be extended by law.

You can also lodge a complaint with the Austrian Data Protection Authority:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Email: dsb@dsb.gv.at
www.dsb.gv.at