Privacy Policy
The protection of your personal data is important to us. In this privacy policy, we inform you about the processing of your data when using deinrezept.de.
1. Data Controller
MEDICARE HEALTH GROUP LTD
First Floor Office, 3 Hornton Place, London, W8 4LZ, United Kingdom
Represented by the Director: Houssem Sefi
Company Number: 17089430 (England and Wales)
VAT Reg. No. (UK): GB 528 4853 61
Data Protection Officer: Currently not appointed; legal requirements under Art. 37 GDPR are being reviewed.
2. What data do we process?
- •Account and contact data (e.g. email, phone number if applicable) for verification (OTP), communication and status updates.
- •Order/contract data (treatment, shopping cart, billing data, delivery address).
- •Health data (questionnaire responses) exclusively for medical review/processing and only to the extent necessary.
- •Technical data (log files, security events) for stability, abuse prevention and error analysis.
3. Purposes & Legal Bases
- •Contract fulfillment (Art. 6(1)(b) GDPR) — Processing of orders, prescription requests, communication.
- •Security/abuse prevention (Art. 6(1)(f) GDPR) — Protection against fraud, rate limiting, logging.
- •Fulfillment of legal obligations (Art. 6(1)(c) GDPR) — Tax retention, pharmaceutical documentation.
- •Health data (Art. 9(2)(h) GDPR) — Processing for healthcare purposes based on the treatment contract. Questionnaire responses are processed exclusively for the medical suitability assessment and stored in pseudonymized form.
- •Consent (Art. 9(2)(a), Art. 6(1)(a) GDPR) — Where explicit consent is obtained (e.g. for optional cookies or additional services).
- •Reach measurement (Art. 6(1)(f) GDPR) — Anonymous, aggregated counting of concurrent visitors to assess site load. NO cookies are set and no device or user profiles are created; a non-reversible short-lived identifier is derived from IP address and browser signature using a secret random value that rotates daily and expires after 60 seconds. Recognition beyond the day or attribution to a person is impossible. The IP address is not stored for this purpose.
Note:Health data is subject to medical confidentiality and is transmitted in encrypted form (TLS 1.3) and stored in EU infrastructure.
4. Recipients / Data Processors
- •Hetzner Online GmbH (Hosting, Industriestr. 25, 91710 Gunzenhausen, Germany) — Server operations and data storage within the EU. DPA concluded.
- •Microsoft Ireland Operations Ltd. (Microsoft 365, sending of login codes, fallback route for notifications, One Microsoft Place, Dublin 18, Ireland) — processor, servers located in the EU.
- •Amazon Web Services EMEA SARL (Amazon Simple Email Service, sending of notifications and the newsletter, 38 Avenue John F. Kennedy, L-1855 Luxembourg) — processor under the AWS Data Processing Addendum (part of the AWS Service Terms), servers located in the EU (Frankfurt).
- •PayPal (Europe) S.à r.l. et Cie, S.C.A. (Payment processing, 22-24 Boulevard Royal, L-2449 Luxembourg) — Payments by PayPal, credit or debit card, Apple Pay, Google Pay and SEPA direct debit, also without a PayPal account. PayPal processes the payment data as an independent controller; the responsible entity is the PayPal company in your country of residence, in the EU the one named here. We only transmit the amount, the order reference and a neutral description (e.g. “prescription fee”) to PayPal, no information about your treatment; you enter your payment details directly with PayPal. For Apple Pay and Google Pay, the privacy policies of Apple and Google also apply. Until 16 September 2026, payments were processed by Stripe Inc. For details on data transfers, see section 7.
- •Cloudflare Inc. / Turnstile (Bot protection) — Processing of technical data to distinguish humans from bots. No tracking, GDPR-compliant.
- •Cooperating physicians / partner pharmacy — Medical review and prescription issuance or dispensing of medications. Processing based on the treatment contract.
- •Daily.co (provider: Daily.co, Inc.) — Technical service provider for conducting video consultations. Only the audio and video data arising during the consultation are processed for the purpose of real-time transmission. Media routing takes place within the EU region (Frankfurt). The consultation is NOT recorded. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Daily.co.
- •Google Ireland Ltd. (Google Analytics 4, audience measurement, Gordon House, Barrow Street, Dublin 4, Ireland) — only after your consent to the "Analytics" category. Pseudonymous usage data is transmitted; the page address is stripped of treatment-related details before sending. Transfer to the United States cannot be ruled out (EU-US Data Privacy Framework adequacy decision).
- •Meta Platforms Ireland Ltd. (Meta Pixel, advertising measurement, Merrion Road, Dublin 4, Ireland) — only after your consent to the "Marketing" category. Without that consent the pixel is not loaded and no data leaves your browser.
- •Google Ireland Ltd. (Google Wallet, Gordon House, Barrow Street, Dublin 4, Ireland) — Only if you save your patient card to Google Wallet: the card data (patient number, name, treating practice) is transmitted to Google in a signed token. The Apple Wallet pass, by contrast, is generated and signed entirely on our servers and delivered straight to your device — no data is transmitted to Apple.
5. Storage Period
We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods:
- •Account data: Until account deletion + 30-day grace period.
- •Orders and billing data: 10 years (Section 257 HGB, Section 147 AO).
- •Health data (questionnaires): 10 years after end of treatment (Section 10(3) MBO-A).
- •Server log files: 90 days.
- •Cookies: Between 1 hour (session) and 365 days (consent preference), depending on the cookie.
6. Your Rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), among others. You may revoke any given consent at any time. You also have the right to lodge a complaint with a supervisory authority.
7. Third-Country Transfers
Payments: The PayPal company responsible for customers in the EU is based in Luxembourg. Where PayPal transfers data within the PayPal group to countries outside the EU, PayPal relies on Binding Corporate Rules approved by the competent supervisory authorities (Art. 47 GDPR); for other transfers, PayPal states that it uses adequacy decisions or EU Standard Contractual Clauses. Our merchant account is held by PayPal UK Ltd (5 Fleet Place, London EC4M 7RD, United Kingdom); an adequacy decision of the European Commission exists for the United Kingdom (Art. 45 GDPR). For payments until 16 September 2026, Stripe Inc. was the payment service provider; Stripe processes this data in the USA on the basis of EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, and Stripe is also certified under the EU-US Data Privacy Framework. All other processors process data exclusively within the EU/EEA.
8. Automated Decision-Making
The evaluation of your health questionnaire serves to structure the information for medical review. No fully automated decision-making within the meaning of Art. 22 GDPR takes place — every prescription decision is made individually by a licensed physician. You have the right to human review at any time.
9. SSL/TLS & Security Measures
This website uses SSL/TLS encryption (indicated by the lock icon in your browser). All data is transmitted in encrypted form. In addition, we employ extensive technical and organizational measures: Content Security Policy (CSP), rate limiting, CSRF protection, encrypted data storage, and regular security audits.
10. Cookies
Technically necessary cookies are always set. Cookies and comparable storage technologies for analytics and marketing are set only after your consent; you can withdraw it at any time via "Cookie settings" in the footer. Overview:
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| dr_session | Session management (login) | 24 hours | Essential |
| dr_csrf | CSRF protection | Session | Essential |
| dr_cookie_consent | Storage of your cookie preferences | 365 days | Essential |
| dr_locale | Language setting | 365 days | Essential |
| dr_theme | Color scheme preference | 365 days | Essential |
| dr_country | Country selection | 365 days | Essential |
| _ga, _ga_* | Google Analytics 4 — distinguishing visitors, audience measurement | up to 24 months | Analytics (consent only) |
| _fbp | Meta Pixel — attribution of ad contacts | 90 days | Marketing (consent only) |
11. Usage analysis of the ordering process
To improve our ordering process, we record which steps of the ordering process are opened, completed or abandoned. This measurement works without cookies and without storing your IP address, under a random session identifier that cannot be traced back to you. Only if you have consented to marketing in our cookie banner and are logged in do we additionally link this measurement data to your customer account and your order in order to understand and improve your use of our service (Art. 6(1)(a), Art. 9(2)(a) GDPR). You can withdraw this consent at any time via the cookie settings; we delete already collected linked data upon request.
12. Supply reminders and newsletter
If you explicitly turn it on in your account or when completing an order, we calculate from your order (pack size, use per product information, the interval between your previous orders or your own input) how long your supply is expected to last and remind you by email before it runs out (at most two emails per order). The emails only name your treatment area, never a product. The legal basis is your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR); you can withdraw it at any time in the patient portal under “My supply” or via the link in every reminder. You receive the general newsletter (magazine topics, service news) only after signing up and confirming your email address (double opt-in); you can unsubscribe via the link in every issue. We log the time and source of your consent and, per email, only the type and delivery result, not the content.
13. Review requests
After a paid order we ask you once by email to review our service on the review platform Trustpilot. The email names neither a medicine nor your treatment area; what is reviewed is solely your experience with our platform. The legal basis is our legitimate interest in customer feedback within the scope of section 7(3) of the German Act Against Unfair Competition (Art. 6(1)(f) GDPR). You may object to the use of your email address for this purpose at any time — with one click on the unsubscribe link in each of these emails or in the patient portal under „Profile“; this incurs no costs other than transmission costs at base rates. We send at most one such request per order and at most one per person within 90 days. For this we store which order a request was sent for and when, and per email only the type and delivery result, not the content. If you click the review link you leave our website; Trustpilot A/S is responsible for the processing on Trustpilot and its privacy policy applies.
14. Patient forum
Anyone with an account in the patient portal can join a forum there to share their experiences. For this we process a name you choose yourself (pseudonym), the time and version of your consent, your topics, posts and reports, and moderation notes (hiding or blocking, each with a reason). Your real name, your email address and your orders are not visible to other members; posts can only be seen by signed-in forum members. Because posts may contain information about your health, the legal basis is your explicit consent (Art. 9(2)(a), Art. 6(1)(a) GDPR), which you give when joining and can withdraw at any time with effect for the future: in the forum via “Leave the forum” or via our support. When you leave, we replace your topics and posts with the note “[removed]” and delete your pseudonym; if you were blocked, we keep only the block record without a pseudonym so that the block remains in place (Art. 6(1)(f) GDPR). You can remove your own posts at any time; they are then no longer shown, but their content is kept for handling reports until your account is deleted. When your account is deleted, we replace your topics and posts with the note “[removed]” and delete your pseudonym. Posts that break the forum rules can be hidden by our team and by moderators we appoint (forum members); moderators can also see hidden posts. You continue to see a hidden post of yours, together with the reason. The person concerned does not learn who reported a post. Every moderation action is logged (Art. 6(1)(f) GDPR).