Imprint & Privacy Policy

Managing Director - Operations & Patient Services

Last updated: 11 July 2026

IMPRINT

Person responsible for content pursuant to § 5 DDG / § 18 (2) MStV

RAB Holding GmbH
Managing Director: Tobias Carsten Reiche
Registered: Amtsgericht Charlottenburg (Local Court), HRB 289538 B
VAT ID: DE 247079802

Address:
Roscherstraße 3
10629 Berlin

Phone: +49 30 550 77 870
E-mail: reiche@rab.berlin

Responsible for editorial content pursuant to § 18 (2) MStV
Tobias Carsten Reiche
Roscherstraße 3, 10629 Berlin

Consumer Dispute Resolution / Universal Arbitration Board

We are not willing or obliged to participate in dispute resolution proceedings before a consumer arbitration board.

Online Dispute Resolution (ODR Platform)

The European Commission provides an online dispute resolution (ODR) platform:
EU Commission platform for online dispute resolution (ec.europa.eu/consumers/odr)

Our e-mail address can be found in the imprint above.

Liability Notice

Despite careful content review, we assume no liability for the content of external links. The operators of linked pages are solely responsible for their content.

Note on Medical Treatment

The treatment contract is concluded exclusively between the patient and the treating physician. RAB Arztbesuche (operated by RAB Holding GmbH, Managing Director: Tobias Carsten Reiche) acts solely as an intermediary and is not a party to the treatment contract. Medical triage and treatment decisions are made exclusively by the treating physician; the non-medical dispatch team does not carry out any medical assessment.

Privacy Policy / Patient Information

The Essentials at a Glance

We use your data only for your treatment and its billing. It is shared exclusively with the treating physician and the billing office (PVS Hamburg).
Data is stored in the EU (data centre in Frankfurt am Main).
No personalised advertising, no profiling, no sale of data.
We only set statistics cookies (Google Analytics) with your consent. In addition, we measure the reach of our pages cookielessly and without profiling (legitimate interest). You can object to both at any time via “Cookie settings” in the footer.

1. Controller

Controller within the meaning of data protection law
RAB Holding GmbH
Tobias Carsten Reiche (Managing Director)
Roscherstraße 3
10629 Berlin
Tel.: +49 30 550 77 870
E-mail: reiche@rab.berlin

2. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional website and our services. Processing of personal data takes place only with the consent of the data subject or on the basis of a legal permission. For the processing of health data (special categories under Art. 9 GDPR) we always obtain explicit consent under Art. 9(2)(a) GDPR.

3. Hosting and Collection of Access Data / Server Log Files

Our website is hosted by Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg). AWS acts as our processor pursuant to Art. 28 GDPR; data is stored in the EU (Frankfurt am Main region).

What is processed?

Each time our website is accessed, our host automatically records information transmitted by your browser:

IP address (personal data pursuant to ECJ, Case C-582/14 – Breyer)
Date and time of the request
Page / URL accessed
Referrer URL (previously visited page)
Browser type and version
Operating system
Data volume transferred, HTTP status code

Legal basis

Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest is to ensure technical operation, detect and defend against attacks, and analyse errors.

Retention period

Server log files are stored for a maximum of 90 days and then automatically deleted, unless a security incident requires longer retention.

4. Booking Form (Online Appointment Booking)

What is processed?

Via the online booking form we collect the following data:

Name, date of birth (patient)
Treatment address (street, postcode, city, doorbell name)
Phone number, e-mail address
Health insurance status (private / statutory)
Name of health insurance provider
Nature of complaints (health data within the meaning of Art. 9 GDPR)
Preferred appointment
If applicable, name and address of a third party (client)

Legal basis

Art. 6(1)(b) GDPR (initiation and performance of contract) and Art. 9(2)(a) GDPR (explicit consent to processing of health data). Consent is given by ticking the corresponding checkbox in the form.

Disclosure

The data submitted will be passed on to the treating physician who takes on the appointment. Medical treatment is carried out on their own responsibility by the treating physician.

For billing purposes, the required billing data will be forwarded to the Privatärztliche Verrechnungsstelle (PVS) Hamburg. PVS Hamburg acts as an independently responsible controller within the meaning of Art. 4(7) GDPR.

Storage location

Booking data is stored encrypted on Amazon Web Services servers in the EU (Frankfurt am Main region). AWS is contractually bound as a processor pursuant to Art. 28 GDPR and is certified under the EU-US Data Privacy Framework.

Retention period

Billing records are retained for 10 years pursuant to § 147 AO (German Fiscal Code); patient-related treatment records are retained for 10 years after completion of treatment pursuant to § 10 BO-Ärzte (German Medical Professional Code). Contact data for uncharged contacts is deleted after 6 months.

5. Contact by E-mail or Phone

What is processed?

If you contact us by e-mail or phone, we process the data you provide (name, e-mail address, phone number, content of your message) and any health information communicated in the process.

Legal basis

Art. 6(1)(b) GDPR (initiation of contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). For health data: Art. 9(2)(a) GDPR.

Retention period

Enquiries without a subsequent engagement are deleted after 6 months. Upon engagement, the retention periods from Section 4 apply.

6. Cookies and Consent (§ 25 TDDDG)

Our website uses cookies and similar technologies. Technically necessary cookies are used on the basis of § 25(2)(2) TDDDG without consent. For all other cookies (in particular analytics and marketing cookies) we obtain your consent pursuant to § 25(1) TDDDG.

Technically necessary cookies

These cookies are required for the operation of the website (e.g. session management, security functions, remembering your cookie choice). Legal basis: § 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

Statistics cookies (Google Analytics)

We only set cookies for audience measurement (Google Analytics) if you have given your consent via our cookie banner. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. See Section 7 for details.

Withdrawal / Opt-out

You can withdraw or adjust your consent at any time with effect for the future via the “Cookie settings” link in the footer, just as easily as you gave it. Alternatively, you can block cookies via your browser settings; in that case, some functions of the website may be restricted.

7. Web Analytics

7.1 Own cookieless audience measurement (first-party statistics)

Controller and scope

We operate our own data-minimising audience measurement. It runs entirely on our own infrastructure (Amazon Web Services, EU region Frankfurt am Main); no data is shared with third parties. The purpose is to understand, in aggregated form, how our pages are used and to improve our services.

What data is processed?

We record a truncated IP address hashed with a daily-rotating key (not stored permanently, not correlatable across days), the pages visited, the referrer URL, the browser window width, click and scroll events, and technical JavaScript errors. No cookies are set and no cross-device identifier is created.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement and in improving our services) in conjunction with § 25(2)(2) TDDDG. As the measurement is cookieless and does not access information stored on your device, no consent is required.

Retention period

Personal raw event data is automatically deleted after 90 days; the daily visitor hash markers after 2 days. Only anonymous, aggregated counters without any personal reference are kept for up to 24 months.

Objection

You can object to this processing at any time with effect for the future via the “Cookie settings” link in the footer and via your browser settings.

7.2 Google Analytics 4 (Google Tag)

Provider

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA.

Purpose and scope

We use Google Analytics 4 to understand in aggregated form how our website is used (e.g. page views, time on page, approximate region of origin) and to improve our services. Personalised ads and remarketing are disabled. With your consent, however, we measure whether a website visit that came through one of our Google Ads led to a contact (Google Ads conversion measurement, see Section 7.3). Google Analytics 4 does not log or store full IP addresses.

Consent and Google Consent Mode

Google Analytics only sets cookies (in particular “_ga”) after you have given your consent via our cookie banner. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without or before your consent, only cookieless, aggregated technical signals are transmitted to Google via Google Consent Mode; no cookie is set and no cross-site usage profile is created.

Transfer to third countries

Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework; EU standard contractual clauses (Art. 46 GDPR) apply in addition.

Retention period

User-related data stored in Google Analytics is automatically deleted after 14 months. The “_ga” cookie has a lifetime of up to 24 months.

Withdrawal

You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.

7.3 Google Ads conversion measurement

Provider

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA.

Purpose and scope

If you reach the website through one of our Google Ads, we measure, with your consent, whether the visit leads to a contact (e.g. a call or appointment request). To do so, the Google click identifier (gclid) is evaluated and Google may set conversion-measurement cookies (in particular “_gcl_au”). This is used solely to measure the effectiveness of our ads. It is not used for personalised advertising or remarketing. Without or before your consent, no click identifier is collected via Google Consent Mode; it is redacted.

Legal basis

Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent via the cookie banner).

Transfer to third countries

Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework; EU standard contractual clauses (Art. 46 GDPR) apply in addition.

Withdrawal

You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.

7.4 Google Ads conversion import (enhanced conversions for leads)

Purpose and scope

To measure the effectiveness of our Google Ads, we additionally transmit to Google, server-side, whether an appointment booking was completed via our website. The email address and phone number provided during booking are hashed with SHA-256 (pseudonymised) before transmission; these details are never transferred to Google in plain text. We also transmit the time of the booking and, where available, the Google click identifier (gclid). Google matches the hashed values only against existing Google accounts to attribute the booking to an ad; the data is not used for personalised advertising or remarketing. The transfer is encrypted and access-protected, and the provided data covers at most the last 60 days.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in measuring and managing our advertising); where the Google click identifier is concerned, Art. 6(1)(a) GDPR (consent via the cookie banner).

Transfer to third countries

Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework; EU standard contractual clauses (Art. 46 GDPR) apply in addition.

Objection

You can object to this processing at any time with effect for the future (Art. 21 GDPR), e.g. by email to the address given in the legal notice.

8. Third-Party Services

8.1 YouTube Videos (Click-to-Load)

On individual pages we embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com). Videos are only loaded once you actively click the preview; before that, no data is transmitted to Google. By clicking, you consent to the transfer of data to Google Ireland Limited (Ireland) and Google LLC (USA). Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Google LLC is certified under the EU-US Data Privacy Framework.

8.2 Google Maps / Google Business Profile (Click-to-Load)

On individual pages (e.g. “About us”) we embed our Google Business Profile via a Google Maps map. Initially only a static preview is shown; the Google map is only loaded once you actively click “Load Google profile”. Before that, no data is transmitted to Google. By clicking, you consent to the transfer of data to Google Ireland Limited (Ireland) and Google LLC (USA); your IP address and possibly further information are processed and cookies may be set. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Google LLC is certified under the EU-US Data Privacy Framework.

8.3 Google Fonts

The fonts used on our website are generally served locally from our own servers (self-hosting), so as a rule no connection to Google is established. However, in connection with embedded Google services (see 8.1 and 8.2) a connection to the Google Fonts servers (fonts.gstatic.com, fonts.googleapis.com) may be established, transmitting your IP address to Google Ireland Limited (Ireland) or Google LLC (USA). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a consistent, performant presentation); where the connection is only established by loading a Google service, Art. 6(1)(a) GDPR also applies. Google LLC is certified under the EU-US Data Privacy Framework.

9. Disclosure of Data

Personal data is only disclosed to the treating physician, PVS Hamburg, with your explicit consent, or when required by law.

10. Retention Period

Patient-related treatment and billing records: 10 years after completion of treatment (§ 147 AO, § 10 BO-Ärzte). Enquiries without a subsequent engagement: deleted after 6 months.

11. Data Subject Rights

You have the following rights under Art. 15–21 GDPR:

Access to your data
Rectification of incorrect data
Erasure of your data
Restriction of processing
Data portability
Objection to processing based on Art. 6(1)(f) GDPR (legitimate interest) (Art. 21 GDPR)
Withdrawal of given consents

12. Complaint

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin

13. No Profiling

Automated decision-making or profiling is not used.

14. Required Information

Some fields in the forms are required so that we can process your enquiry. Further information is voluntary. Without required information we cannot process your enquiry.