Privacy Policy

Privacy Policy

Last updated: August 2026

Controller

Dr. med. univ. et scient. med. Demir Mulalić
Reithofferplatz 16
1150 Vienna
Austria
E-Mail: office@drmulalic.at
Phone: +43 650 210 99 84

Scope and principles

This Privacy Policy explains how personal data is processed when you visit this website and use the functions offered on it. Personal data is processed only for specified purposes and on an appropriate legal basis.

Retention period: Data is generally deleted as soon as the respective purpose of processing no longer applies. Further storage takes place only for as long as required by statutory retention obligations, legitimate evidentiary interests, or the establishment, exercise or defence of legal claims. Any differing or more specific periods are stated for the respective processing activity.

Hosting and server log files

When the website is accessed, the web server processes technically necessary log data. This may include, in particular, the IP address, date and time, the page or file accessed, the amount of data transferred, the referrer URL, and information about the browser and operating system.

The processing serves to provide the website, ensure system security, analyse errors and prevent misuse. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and functional operation of the website.

Hosting provider: Hostinger International Ltd.

The log data is processed in accordance with the criteria described above only for as long as necessary for operation, security, error analysis and prevention of misuse.

Contact

If you contact us by email, telephone or contact form, the contact details provided and the content of the enquiry are processed in order to handle and respond to it. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract or pre-contractual measures; otherwise Art. 6(1)(f) GDPR based on the legitimate interest in appropriate communication.

Retention period: until the enquiry has been fully processed and thereafter only for as long as required by statutory retention obligations, legitimate evidentiary interests, or the establishment, exercise or defence of legal claims. Data subject to statutory documentation or retention obligations is retained only for the respective prescribed period.

Recipients: internally responsible persons as well as the website, hosting, form and email service providers used.

Recipients and processors

Recipients include the hosting provider Hostinger International Ltd. and those IT, communication, analytics, marketing, payment or other service providers specifically named in the processing activities below. Data is transferred only to the extent permitted and necessary for the purpose described there. Processors are contractually bound in accordance with Art. 28 GDPR.

Transfers to third countries

Personal data is transferred to countries outside the European Economic Area only where this is described for the relevant service and the requirements of Arts. 44 et seq. GDPR are met. Depending on the recipient, safeguards may include in particular an adequacy decision – for certified US organisations, for example, the adequacy decision for the EU-US Data Privacy Framework – or Standard Contractual Clauses together with any required supplementary measures. The safeguard actually used and documented for the respective recipient is decisive. Information or a copy of the safeguard used can be requested at office@drmulalic.at.

Data security

In accordance with Art. 32 GDPR, appropriate technical and organisational measures are implemented taking into account the state of the art, implementation costs, and the nature, scope and risks of the processing. Transmission between the browser and the website is encrypted via HTTPS.

Your rights

Nach Maßgabe der Art. 15 bis 21 DSGVO bestehen Rechte auf Auskunft, Berichtigung, Löschung, Einschränkung der Verarbeitung, Datenübertragbarkeit und Widerspruch. Das Widerspruchsrecht betrifft insbesondere Verarbeitungen auf Grundlage berechtigter Interessen. Eine erteilte Einwilligung kann jederzeit mit Wirkung für die Zukunft widerrufen werden; die Rechtmäßigkeit der Verarbeitung bis zum Widerruf bleibt unberührt. Soweit automatisierte Entscheidungen einschließlich Profiling im Sinne des Art. 22 DSGVO eingesetzt werden, bestehen die dort vorgesehenen Rechte.

Under Arts. 15 to 21 GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. The right to object applies in particular to processing based on legitimate interests. Consent that has been given may be withdrawn at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected. Where automated decision-making, including profiling within the meaning of Art. 22 GDPR, is used, the rights provided for there apply. https://www.dsb.gv.at.

Appointment and medical enquiries

When appointments are booked or medical enquiries are made, health information may be processed in addition to contact and appointment data. Processing is carried out for the initiation or provision of medical treatment pursuant to Art. 6(1)(b) GDPR. Where health data is concerned, processing is based on Art. 9(2)(h) GDPR in conjunction with professional confidentiality and documentation obligations. Medical data is made accessible only to persons who are bound by confidentiality and is retained in accordance with the periods applicable to medical documentation. The website form is not suitable for medical emergencies.

Services used

Updates

This Privacy Policy will be updated if processing activities or legal requirements change. The version published on this website is authoritative.