Privacy Policy

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

Essence Medical Spa — Dr. med. Silvino Polla Neto

Hartmannstraße 17, 91052 Erlangen, Germany

E-mail: essencemedicalspa.de@gmail.com

Phone: +49 155 60542410

Professional title: Facharzt für Dermatologie (physician title awarded in Brazil / Germany). Competent chamber: Bayerische Landesärztekammer. Applicable professional regulations: Berufsordnung für die Ärzte Bayerns, Heilmittelwerbegesetz (HWG), available from the competent chamber.

Because the clinic processes health data on a small scale within a single medical practice, a data protection officer is appointed only where required by Art. 37 GDPR in conjunction with § 38 BDSG. Contact for all data protection matters: essencemedicalspa.de@gmail.com.

Any information you send us about your skin, symptoms, medication, treatments or photographs is health data and constitutes a special category of personal data under Art. 9(1) GDPR.

We process such data only where Art. 9(2)(h) GDPR applies (medical diagnosis, treatment and the management of health-care services, by or under the responsibility of a professional bound by medical confidentiality under § 203 StGB), or on the basis of your explicit consent under Art. 9(2)(a) GDPR.

Please do not send sensitive health details through unencrypted e-mail, WhatsApp or web forms. For anything clinical, we will arrange a secure channel or an in-person consultation.

When you open this website, your browser automatically transmits technical data to our hosting provider's server, which is stored in server log files: IP address (shortened/anonymised where possible), date and time of the request, requested page, referrer URL, browser type and version, operating system, and volume of data transferred.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and error-free operation of the website and the prevention of abuse. Storage of technical access data on your device is strictly necessary within the meaning of § 25(2) no. 2 TDDDG and therefore does not require consent.

Retention: server logs are deleted or anonymised no later than 30 days after collection, unless a security incident requires longer retention as evidence.

This website is hosted on infrastructure operated by our hosting provider on our behalf as a processor under Art. 28 GDPR, on the basis of a data processing agreement. Where data is transferred to a country outside the EU/EEA, the transfer is safeguarded by the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework.

If you contact us by e-mail, telephone or WhatsApp, we process the data you provide (name, contact details, the content of your message and any appointment details) in order to answer your enquiry and, where relevant, to prepare a treatment.

Legal basis: Art. 6(1)(b) GDPR for pre-contractual and contractual measures, Art. 6(1)(f) GDPR for our legitimate interest in answering general enquiries, and — where your message contains health data — Art. 9(2)(h) or Art. 9(2)(a) GDPR.

WhatsApp is operated by WhatsApp Ireland Ltd. If you choose to write to us there, your metadata is processed by that provider under its own privacy policy. We offer WhatsApp only as an optional convenience; you may always use telephone, e-mail or an in-person appointment instead.

Retention: enquiry correspondence is deleted once the matter has been finally dealt with, unless statutory retention periods apply (in particular 6 or 10 years under § 257 HGB and § 147 AO). Medical records are retained for at least 10 years after the end of treatment under § 630f(3) BGB, and longer where specific professional rules require it.

Data collected for booking, carrying out and documenting a treatment (identity data, contact data, anamnesis, findings, images, treatment plans, invoicing data) is processed under Art. 6(1)(b) and Art. 9(2)(h) GDPR, § 630f BGB and the applicable professional code of conduct. Access is restricted to the treating physician and to staff bound by confidentiality.

This website uses only technically necessary storage on your device (for example, your language selection and your cookie consent decision). Non-essential cookies, analytics or marketing technologies are only set after you have given your consent through our consent banner, in accordance with § 25(1) TDDDG and Art. 6(1)(a) GDPR.

Details and how to withdraw consent at any time are described in our Cookie Policy.

Our contact page does not embed Google Maps. It only provides an ordinary hyperlink to Google Maps for route planning. No data is transferred to Google unless you actively click that link, at which point Google's own privacy policy applies. The same principle applies to links to social networks such as Instagram: they are plain links, not embedded widgets or tracking pixels.

We do not sell personal data. Data may be disclosed to: our hosting and IT service providers (as processors), laboratories or specialists involved in your treatment (with your knowledge), tax advisers and accountants, billing service providers where you have consented, statutory health insurers or private insurers where legally permitted, and public authorities where we are legally obliged to disclose.

Health data is not transferred outside the EU/EEA. For general website operation, any transfer is based on an adequacy decision, EU Standard Contractual Clauses, or another safeguard under Chapter V GDPR.

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21).

Where processing is based on consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR), without affecting the lawfulness of processing carried out before withdrawal.

To exercise any right, write to essencemedicalspa.de@gmail.com. We may need to verify your identity before disclosing health data.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority for our clinic is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.

You are not legally obliged to provide personal data to browse this website. For a medical consultation, however, certain data (identity, anamnesis) is necessary; without it a treatment cannot lawfully or safely be carried out.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

This website is delivered over TLS encryption. We apply technical and organisational measures under Art. 32 GDPR to protect your data against unauthorised access, loss or manipulation.

We may update this policy to reflect legal or technical changes. The version published here always applies.