Privacy notice

This notice explains how personal data is processed when you visit this website or contact the practice. The controller under the General Data Protection Regulation (GDPR) is:

Katharina Mitterbauer · Naturheilpraxis Kokoro

Poststraße 30, 83435 Bad Reichenhall, Germany

Telephone: +49 159 06 80 41 80

Email: hallo@praxiskokoro.de

This website provides information about the practice. It does not contain patient records, a contact form or online appointment booking. Information about data processing during treatment is provided separately.

When you open a page, your browser sends technical connection data. This includes, in particular, your IP address, date and time, the requested address or file, browser and operating-system information, transferred data volume and, where sent by your browser, the referring page.

These data are needed to deliver the requested content, protect the service and detect technical faults or misuse. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is to provide a functioning, secure and reliable practice website.

The website is hosted by Netlify, Inc., USA. Netlify processes technical data needed for hosting and delivery and may use affiliated companies and infrastructure providers. Global delivery can involve processing outside the European Union or European Economic Area.

Technical data are needed only for as long as required for delivery, operational security, troubleshooting or investigation of a specific incident. Logs and backups are also subject to the hosting provider’s deletion and retention procedures. No single retention period is promised here for all types of technical logs.

Provider information: Netlify Privacy Statement and Data Processing Agreement.

Texts and images are managed in Sanity, a service provided by Sanity AS, Norway, and Sanity US Inc., USA. Text content is generally retrieved by the website server. Some images are loaded directly from Sanity’s image network at cdn.sanity.io. For a direct image request, Sanity receives the necessary technical connection data, particularly the IP address and details of the requested file.

This integration supports an up-to-date, reliable and appropriate presentation of the website. The legal basis is Article 6(1)(f) GDPR. No patient information is entered into this editorial system through this website.

Sanity’s privacy notice describes deletion or anonymisation of technical logs within 90 days. Different periods may apply to content, version history, backups and cached images. These provider statements do not describe how long the practice retains your correspondence.

Provider information: Sanity Privacy Policy and Data Processing Addendum.

Recipients may include the hosting and CMS providers named above and their technical subprocessors. If you contact the practice, the providers used for email or telephone communications are also involved. Access is limited to the relevant service.

Using Netlify and Sanity may involve processing in the USA. Their published data-processing terms provide for applicable adequacy decisions and, where required, the European Commission’s standard contractual clauses for international transfers. Netlify also describes its use of the EU-US Data Privacy Framework. Applicable terms and subprocessors are available through the provider information linked above.

Public-authority access and available remedies in third countries may differ from those in the EU. You may request information about the recipients relevant to your data and a copy of applicable safeguards using the contact details above.

The public website does not use advertising cookies, analytics trackers, embedded maps or social-media plugins. We do not create visitor profiles.

If you explicitly pause or resume animation, your browser stores this display choice locally under “kata-motion”. The entry contains only the chosen state, without an individual identifier. It remains until you change the preference or clear this website’s browser data. The preference is not transmitted to the practice.

During your current use of the website, the open tab remembers in its working memory whether the introduction has already been shown. This does not create a persistent visitor profile.

Storing and reading the display preference serves the function you explicitly selected, under section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data are involved, the basis is Article 6(1)(f) GDPR; the interest is to respect your chosen, more accessible display. Content remains accessible if browser storage is blocked.

Cormorant Garamond and DM Sans fonts are served locally by this website. Loading these fonts does not connect to Google Fonts.

When you contact the practice, it processes the information you provide, such as your name, telephone number, email address, appointment request and message. These details are used to respond to your enquiry and arrange appointments.

Where an enquiry relates to a treatment contract or steps taken before entering into it, processing is based on Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR; the legitimate interest is to respond to your message.

Health information receives special protection. If you provide it, it is processed only where necessary and permitted for treatment or its preparation under Article 9(2)(h) in conjunction with Article 9(3) GDPR, or where explicit consent under Article 9(2)(a) GDPR applies. Please do not send detailed medical reports or other highly confidential documents unsolicited by ordinary email. A suitable communication method can be arranged personally.

Enquiries are retained for as long as required to handle them and, where applicable, to arrange appointments or manage the contractual relationship. They are then deleted unless statutory retention duties or necessary evidence require otherwise. Where information becomes part of a treatment record, section 630f(3) of the German Civil Code generally requires retention for ten years after treatment ends, unless other periods apply.

Contacting the practice is voluntary. Without a way to contact you and the information necessary for your request, the practice may be unable to respond or arrange an appointment.

The /studio area is intended for editors. Opening it and signing in to Sanity also uses Sanity’s authentication and editorial services. Sanity processes account, session and technical usage data under its own privacy notice. Signing in is not necessary to visit the public practice website.

An authorised draft preview uses a necessary session cookie to distinguish preview access from the public view. It is disabled when the preview is ended. Storage serves the explicitly requested preview function under section 25(2)(2) TDDDG and access security under Article 6(1)(f) GDPR.

Subject to the applicable legal conditions, you have the following rights:

• Access to information about processing and a copy of your personal data (Article 15 GDPR).
• Correction of inaccurate data and completion of incomplete data (Article 16 GDPR).
• Erasure of your data or restriction of processing (Articles 17 and 18 GDPR). Statutory retention duties may prevent immediate erasure.
• Data portability where processing is automated and based on consent or a contract (Article 20 GDPR).
• Withdrawal of consent with effect for the future, without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR).

Right to object: where data are processed under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Article 21 GDPR). You can exercise your rights by contacting the practice using the details above.

This website does not make decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects on you.

Under Article 77 GDPR, you may lodge a complaint with a data-protection supervisory authority, particularly where you habitually live, work or where you believe an infringement occurred. The Bavarian State Office for Data Protection Supervision (BayLDA) is responsible in particular for private-sector organisations in Bavaria.

Bayerisches Landesamt für Datenschutzaufsicht · Promenade 18, 91522 Ansbach, Germany · Postal address: Postfach 1349, 91504 Ansbach, Germany

Contact BayLDA · Submit a data-protection complaint

Last updated: 24 October 2026. This notice will be adapted when the website or its services change.