Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Dr. Rainer Knoll
General Practitioner
Prager Straße 42
1210 Vienna, Austria

Phone: +43 1 272 68 26
Email: rainer.knoll@aon.at

2. General Information on Data Processing

The protection of your personal data is of particular importance to us. We process your personal data exclusively on the basis of the statutory provisions (GDPR, Austrian Data Protection Act, Telecommunications Act 2021 – TKG 2021).

Your data is processed on the basis of the following legal grounds pursuant to Art. 6 GDPR:

• Consent (Art. 6(1)(a) GDPR) -- you have given your consent to the processing.
• Performance of a contract (Art. 6(1)(b) GDPR) -- the processing is necessary for the performance of a contract or pre-contractual measures.
• Legal obligation (Art. 6(1)(c) GDPR) -- the processing is necessary for compliance with a legal obligation.
• Legitimate interest (Art. 6(1)(f) GDPR) -- the processing is necessary to safeguard legitimate interests.

3. Visiting the Website

When you access our website, technical access data is automatically recorded in server log files. This includes:

• IP address
• Date and time of access
• Page / URL accessed
• Browser type and version
• Operating system

This data is processed to ensure the trouble-free operation of the website. It is not combined with other data sources.

We do not use any tracking cookies or analytics tools. Only technically necessary cookies are used. Content from Google Maps is only loaded after your explicit consent (clicking on “Load map”).

Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Prescription Orders

Our website allows you to order prescriptions for medications that have already been prescribed online. The following data is collected for this purpose:

• First and last name
• Date of birth
• Social security number
• Email address
• Phone number (optional)
• Requested medications

Purpose of Processing

The data is used exclusively to process your prescription order, to assign it to your patient record, and to contact you in case of queries.

Legal Basis

Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Insofar as the processing concerns health data, it is carried out on the basis of your explicit consent (Art. 9(2)(a) GDPR) and for the purpose of medical care (Art. 9(2)(h) GDPR).

Storage Location and Retention Period

The order data is stored in a database of our processor Supabase (see Section 6). The individual online order record is deleted from the order database once the order has been processed and transferred to the patient documentation, but no later than after 90 days. The statutory retention periods of at least 10 years pursuant to §51 ÄrzteG apply to the medical documentation itself.

Spam Protection (Cloudflare Turnstile)

To protect the order form against automated abuse, we use “Cloudflare Turnstile” provided by Cloudflare, Inc. In doing so, technical data (including the IP address) is transmitted to and checked by Cloudflare. Turnstile works without conventional tracking cookies. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

5. Email Communication

When you place a prescription order, you receive automated confirmation and status emails at the email address you provide. The emails are sent via the email service provider Resend (Resend, Inc., USA), which acts as a processor pursuant to Art. 28 GDPR (see Section 6).

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

6. Processors

To operate this website, we use the following external service providers, which act as processors pursuant to Art. 28 GDPR. Appropriate agreements ensuring the protection of your data are in place with all processors:

• Cloudflare (Cloudflare, Inc., USA) – hosting/delivery of the website as well as spam protection (Turnstile). Delivery takes place primarily via EU data centers.
• Supabase (Supabase, Inc., USA) – database hosting for the prescription orders (EU region, Frankfurt).
• Resend (Resend, Inc., USA) – delivery of the confirmation and status emails.
• Google Maps (Google Ireland Ltd. / Google LLC, USA) – display of the directions map, only after your consent (two-click solution).

Insofar as personal data is transferred to third countries (in particular the USA), this is done on the basis of the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses (Art. 46 GDPR).

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) -- you have the right to request information about the personal data we process.
• Right to rectification (Art. 16 GDPR) -- you can request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) -- you can request the deletion of your data, provided that no statutory retention obligations prevent this.
• Right to restriction of processing (Art. 18 GDPR) -- you can request the restriction of the processing of your data.
• Right to data portability (Art. 20 GDPR) -- you have the right to receive your data in a common, machine-readable format.
• Right to object (Art. 21 GDPR) -- you can object to the processing of your data at any time.
• Right to withdraw consent (Art. 7(3) GDPR) -- you can withdraw any consent given at any time with effect for the future.

To exercise your rights, you can contact us at any time: rainer.knoll@aon.at

8. Right to Lodge a Complaint with the Supervisory Authority

You have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data infringes the GDPR.

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna

Phone: +43 1 52 152-25
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

9. Currency of This Privacy Policy

This privacy policy is dated March 2026. We reserve the right to amend this privacy policy in order to adapt it to changes in the legal situation or changes to the service.