amedes Medizinische Dienstleistungen GmbH (‘amedes’, ‘we’ or ‘us’) offers unique interdisciplinary medical-diagnostic services for patients, registered doctors and clinics. Handling sensitive data is therefore part of our everyday work. For this reason, compliance with data protection laws and thus the protection of your personal data is an important concern for us. We would like to explain below what data we collect when you use our website at www.fertilityamedes.com (‘website’), how we use your data and what we do to protect your data, as well as your rights in this regard.

1. controller and contact details

The controller within the meaning of the General Data Protection Regulation (‘GDPR’) is

amedes Medizinische Dienstleistungen GmbH
Werner-von-Siemens-Straße 10
37077 Göttingen

Telephone 0800.58 91 669
info(at)amedes-group.com
www.amedes-group.com

You can reach our data protection officer at

amedes Medizinische Dienstleistungen GmbH
Haferweg 40
22769 Hamburg

Telephone 040.33 44 11-9922
E-mail: datenschutz(at)amedes-group.com

2 What data we process, for how long and for what purpose

2.1 Informational use of the website

Scope of processing. If you use our website for informational purposes only, i.e. if you do not provide us with any other information, we only collect the personal data that your browser automatically transmits to our server. When you visit our website, we collect the following data IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request comes, browser, operating system and its interface, language and version of the browser software.

Purpose and legal basis. The purpose of processing is to make it technically possible to access the website and to ensure the stability and security of the website. The legal basis for processing is the protection of our legitimate interests (Article 6(1)(f) GDPR). Our legitimate interest in data processing also lies in the aforementioned purposes.

Duration of storage. The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. We store IP addresses for seven days in order to be able to track misuse.

2.2 Contact form/contact by e-mail

Scope of processing. On our website, we offer you a form that you can use to contact us electronically. In this case, the data entered in the input mask will be transmitted to us and processed. These are: Name, title, specialist group, e-mail address, telephone number, your details in the free text field. The fields marked with an asterisk are mandatory. The optional information helps us to better allocate your enquiry and process it more efficiently. If the message is sent via the contact form, the following data will also be processed: IP address of the user, date and time. Your consent will be obtained for the processing of the data before the message is sent and reference will be made to this privacy policy. You can of course also communicate with us via the e-mail address provided. In this case, the personal data transmitted with the e-mail will be processed.

Purpose and legal basis. The data is processed exclusively to enable us to process your enquiry. The legal basis for processing the data is your consent (Article 6(1)(a) GDPR). The data transmitted to us in the course of sending an email will be processed on the basis of our legitimate interest in ensuring efficient and user-friendly communication and processing of your request as well as reliable documentation for evidence purposes (insofar as necessary for the assertion, exercise or defence of legal claims) (Article 6 (1) (f) GDPR). If you contact us with the aim of concluding a contract, we base the processing of your data on the necessity of processing for the implementation of pre-contractual measures in order to make a decision on the establishment of the contract with you (Article 6 para. 1 lit. b GDPR).

Duration of storage. The data referred to in this subsection will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. This is the case when the respective contact has ended. The contact is ended when your request has been dealt with, e.g. by answering your questions and your request has been fully processed. In individual cases, we may store your data for longer if this is necessary for the assertion, exercise or defence of legal claims or to comply with legal obligations (such as retention obligations).

2.3 Downloading flyers and information material

If you would like to download a flyer or other content from our website, section 2.1 applies accordingly.

2.4 Integration of YouTube

Scope of processing. We integrate YouTube videos on our website, a video service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA). These services are deactivated by default and you can decide for yourself whether you wish to use the respective services. If you activate the respective services (by clicking on the respective buttons), Google will receive the information that you have accessed the page on which the map or video is integrated. In addition, the data mentioned under 2.1 will be transmitted. In this respect, it is irrelevant whether you have a Google user account or not. However, if you are logged into your Google user account, your data can be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. You should only activate the respective services if you agree to the processing of your data by Google.

Purpose and legal basis. Google stores your data as usage profiles and uses them for advertising and market research purposes. Such an analysis is also carried out in particular (even for users who are not logged in) to provide customised advertising and to inform other Google users about your activities on our website. Further information on the purpose and scope of data collection and its processing by Google can be found in Google's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: http://www.google.de/intl/de/policies/privacy. We do not receive any information from Google and do not specifically process your personal data ourselves in connection with the use of Google Maps or YouTube.

The legal basis for any processing by us is your consent (if, for example, data is transmitted to Google or other limited processing takes place as part of the integration of the tools). By activating the respective Google services, you consent to the use of cookies by Google in this regard as well as to the processing of your personal data in this regard (Section 25 TTDSG, Article 6(1)(a) GDPR).

Recipients / transfer to third countries. The recipient of the data is Google Ireland and, if applicable, Google LLC in the USA. The European Commission assumes that there is no adequate level of data protection in the USA.

Possible risks that cannot be ruled out in connection with the transfer of your personal data to the USA are in particular

• You may not be able to sustainably assert or enforce your rights to information and other data subject rights against Google LLC.
• There is a risk that the US state authorities may direct requests for information against Google as the data recipient and that the US state authorities may thus be able to view your personal data without this being subject to the same strict regulations as in the EU. In particular, possible legal protection is not adequately guaranteed in this context.

By activating the respective Google services, you also consent to the transfer of your personal data to Google LLC in the USA (Art. 49 para. 1 lit. a) GDPR). In order to protect your data appropriately, Google LLC undertakes to protect your data on the basis of the EU standard contractual clauses (Art. 46 para. 2, para. 5 GDPR) (see privacy.google.com/busine

sses/processorterms/mccs/). Additional protective measures are also implemented.

To find out more about the recipients of your data, the third countries concerned and the measures we have taken to protect your data, including the possibility of obtaining a copy of the measures, please contact us using the contact details listed in section 1.

You can revoke your consent at any time using the contact details listed in section 1 without affecting the lawfulness of the processing of your data carried out on the basis of your consent until revocation.

Additional special rights of data subjects: You have the right to object to the creation of user profiles, whereby you must contact Google to exercise this right: https://adssettings.google.com/authenticated

2.5 Fertility app

Scope of processing. When you download the amedes app, the required information is transmitted to the respective app store, in particular your user name, email address and customer number of your account, time of download and the individual device identification number. We have no influence on this data collection; it is subject to the terms and conditions of the Google Play Store or Apple Store. We only process the data to the extent necessary to download the app to your mobile device.

If you then use the app on your mobile device, we collect the following personal data IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request comes, browser type, operating system and its interface, language and version of the browser software. We also need your device identification, unique number of the end device (IMEI = International Mobile Equipment Identity), unique number of the network subscriber (IMSI = International Mobile Subscriber Identity), mobile phone number (MSISDN), MAC address for WLAN use, name of your mobile end device and e-mail address.

Purpose and legal basis. We use the data collected when you download the app to make the download technically possible for you. We process the data collected when you use the app for the purpose of enabling the functionality of the app and ensuring stability and security. The basis for use is therefore the fulfilment of the licence agreement between you and us regarding the use of the app resulting from the download (Article 6(1)(b) GDPR) and our legitimate interest in ensuring the functioning and stability of the app (Article 6(1)(f) GDPR).

Duration of storage. The data collected when the app is downloaded is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of the collection of data to enable the download, this is the case when the respective download is completed. The same applies to data collected during the use of the app. We store IP addresses for seven days in order to be able to track misuse.

2.6 Registration for events

Scope of processing. When you register for an event, we require certain data from you depending on the type of event. The registration form indicates which information is required and which is voluntary. The voluntary information helps us to better allocate your registration and process it more efficiently. Your data will not be passed on to third parties. Any exceptions (e.g. in the case of co-operation events) will be clearly communicated when you register.

Purpose and legal basis. We only use your data for the event and to send you information about similar events, to prove that we are authorised to send you this information based on your previous registration and for customer support. If participation in the event is subject to a fee, we must also store your registration and any payment details for tax and commercial law reasons. We base the processing of your data for processing your participation in the event on the necessity of processing for the fulfilment of the contract with you or for the implementation of pre-contractual measures that take place in response to your registration request (Article 6 para. 1 lit. b GDPR). Processing for the purpose of verifying your enquiry is carried out on the basis of our legitimate interest in ensuring and documenting compliance with legal requirements with regard to advertising and customer care (Article 6(1)(f) GDPR). The basis for the storage of e.g. commercial or business letters or accounting documents is the necessity of processing for the fulfilment of tax and commercial law regulations (Article 6 para. 1 lit. c) GDPR i.V.m. § 147 AO, 257 HGB). Your data is also processed to protect our legitimate interests in fulfilling your enquiries, promoting the sale of our products and services through appropriate advertising, as well as the assertion or exercise of legal claims or defence against legal claims (Art. 6 para. 1 lit. f GDPR).

Duration of storage. We delete your data in the case of business letters and other tax-relevant documents by 31 March of the seventh calendar year after they are created, and in the case of accounting documents by the eleventh calendar year after they are created. For event purposes, we delete your data three months after the end of the event; for the purpose of sending information as soon as you object or we finally stop sending information; for the purpose of customer support as soon as you object or by 31 March of the fifth calendar year after the end of the last event for which you registered or in which you participated, or after your last other expression of interest; for the purpose of proving your registration by 31 March of the fourth calendar year following the last sending of information.

2.7 Cookies

Our website uses cookies. Cookies are text files that are stored on your computer by your Internet browser. These cookies contain a string of characters that enables your browser to be uniquely identified when you return to the website. For example, some elements of our website require that the accessing browser can be identified even after a page change in order to provide you with the desired functionalities. In these technically necessary cookies, user identification data is stored and transmitted for this purpose. We also set other cookies, for example for statistical and marketing purposes, which are only set if you give your consent. When accessing our website, the user is informed about the use of these cookies and has the opportunity to give their consent to the processing of the personal data used in this context. In this context, reference is also made to this privacy policy. In addition, the user can subsequently revoke or grant their consent at any time via our cookie settings, or customise their selection with regard to the use of cookies.

You can access more information about which cookies we use, for what purposes they are used and for how long they are stored at any time via the cookie settings.

You can also set your browser so that the storage of cookies is generally prevented. Once cookies have been set, you can delete them at any time. You can find out how all this works in detail in the help function of your browser. Please note that a general deactivation of cookies may lead to functional restrictions on our website.

Purpose and legal basis. We use cookies that are technically absolutely necessary to enable the operation of the website. Depending on the cookie settings you have made (and your consent in this regard), we also use other cookies for statistical or marketing purposes:

• Technically necessary cookies are used to enable the technical operation of a website and to make it functionally usable for you. They are used on the basis of our legitimate interest in offering a technically flawless website. However, you can generally deactivate the use of cookies in your browser.
• Statistics cookies collect information about how websites are used in order to improve their attractiveness, content and functionality. They are only used with your consent and only as long as you have not deactivated the respective cookie.
• Marketing cookies originate from external advertising companies and are used to collect information about the websites visited by the user. They are only used with your consent and only as long as you have not deactivated the respective cookie.

Insofar as the technically necessary cookies we use allow us to draw conclusions about you personally, we base the processing of your data on the necessity of processing to safeguard our legitimate interest in the technically flawless and secure operation and smooth functionality of our website (Article 6 (1) (f) GDPR). Your consent is not required for the use of technically necessary cookies in accordance with Section 25 (2) No. 2 of the German Data Protection Act (Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei Telemedien - TTDSG).

Statistics and marketing cookies are only used if you give your consent (Section 25 (1) TTDSG and Article 6 (1) (a) GDPR). By accepting statistics and/or marketing cookies, you also consent to the processing of your personal data in this regard. Your consent is voluntary and can be given or revoked at any time for the future by accessing the cookie settings. The withdrawal of your consent does not affect the lawfulness of the processing of your data based on your consent before its withdrawal.

Duration of storage. Cookies are stored on your computer. The duration of storage can be found in the overview in the cookie settings.

a. Google Analytics

Scope of processing. This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland. (parent company: Google LLC, USA). Google Analytics uses cookies (see section 2.11). By setting these cookies, it is possible to analyse the activities of a user independently of the use of different devices by assigning a user ID to Google. If you have given your consent, Google stores cookies on your end device to enable your use of the website to be analysed. This provides us with various usage data, such as page views, length of visit, browser type/version, operating systems used, host name of the accessing computer (IP address), time of the server request and origin of the user (referrer URL).

The information generated by the cookie about the use of our website is transmitted to a Google server in the USA and stored there. IP anonymisation has been activated on this website so that the IP address of Google users within member states of the European Union or in other signatory states to the Agreement on the European Economic Area is shortened beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

We have concluded an order processing contract with Google for the use of Google Analytics. When configuring Google Analytics, care was also taken to ensure that Google acts as a processor and may not use the data for its own purposes. However, data may be transferred by Google to third parties if Google is legally obliged to do so.

You can find more information on how Google handles user data in Google Analytics here. You can find an overview of data protection at Google here. Google's privacy policy can be found at the following link: https://policies.google.com/privacy?hl=de&gl=de.

Purpose and legal basis. Google will use the data on our behalf to analyse the use of our website and to compile reports on its use for us. We analyse and use the data solely on the basis of statistical and aggregated information. In particular, this information helps us to better understand how users use our website, where users come from, which pages they visit and how long users remain on our website. This enables us to improve our website and functionalities and make our offering more interesting for you as a user. If necessary, the data is also used to provide us with chargeable services. The legal basis for the use of Google Analytics is your consent. By accepting the corresponding cookies, you also consent to the processing of your personal data in this regard (Section 25 (1) TTDSG, Article 6 (1) (a) GDPR). You can revoke your consent at any time with effect for the future via our cookie settings.

Duration of storage. The usage data collected via Google Analytics is automatically deleted every month after 14 months.

Recipients / transfer to third countries.

When using Google Analytics, it cannot be ruled out that Google LLC in the USA may also have access to the stored data. The data protection laws in the USA do not offer a level of protection comparable to European laws that would be considered appropriate by the European Commission. In particular, it cannot be ruled out that US authorities (e.g. security authorities in the USA) could gain access to your data in the USA without the US laws granting you adequate legal protection. By consenting to the use of the analytics cookies described, you also consent to the transfer of your personal data to Google LLC in the USA (Art. 49 para. 1 lit. a) GDPR). In order to protect your data appropriately, Google LLC also undertakes to protect your data on the basis of the EU standard contractual clauses (Art. 46 para. 2, para. 5 GDPR) (see privacy.google.com/busine

sses/processorterms/mccs/). To find out more about the recipients of your data, the third countries concerned and the measures we have taken to protect your data, including the possibility of obtaining a copy of the measures, please contact us using the contact details listed in section 1.

Special rights of data subjects: You can prevent tracking by Google Analytics by allowing only necessary cookies in the cookie banner.

You can also permanently prevent the collection of your data by installing the following browser plug-in: https://tools.google.com/dlpage/gaoptout?hl=de.

Please note that you will have to repeat the above process if you use a different device or browser.

You can find more information on how Google Analytics handles user data in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

3. recipients of personal data

We share your data with the following categories of third parties and other recipients in the scenarios below:

3.1 Service providers, business partners and affiliated companies

We transfer your data to carefully selected partner companies and other service providers, including amedes Group companies affiliated with amedes, who are contractually obliged to act as processors in accordance with the relevant data protection regulations. For example, we may pass on your personal data to our service providers and affiliated companies that provide us with technical services (hosting, IT support), marketing services or other business processes. These companies may only use your personal data insofar as this is necessary for the provision of the services commissioned by us. Your data will not be sold to third parties or marketed in any other way. You can obtain further information about the recipients of your personal data at any time on request from amedes using the contact details given in section 1.

3.2 Law enforcement authorities, courts, supervisory authorities, government agencies or other third parties

We may also disclose your personal data to these parties if we believe that this is necessary to comply with a legal or regulatory obligation or to protect and defend our rights or the rights of third parties, for example if we are obliged to cooperate with authorities in connection with legal investigations. We will endeavour to inform you of such requirements insofar as this is legally or officially permissible and reasonable.

4. rights of data subjects

In accordance with the statutory provisions, you have the right to

• To request information about the personal data processed about you and a copy of this data (right of access);
• to request the rectification of inaccurate data and, taking into account the purposes of the processing, the completion of incomplete data (right to rectification); please let us know whether your data and, if applicable, which of your data that we store has changed so that we can correct or update the corresponding data.
• to request the erasure of your data if there are legitimate grounds for doing so (right to erasure);
• to demand the restriction of the processing of your data, provided that the legal requirements are met (right to restriction of processing)
• to receive the data provided by you in a structured, commonly used and machine-readable format and to transmit those data to another controller or, where technically feasible, to have them transmitted by us (right to data portability); and
• not to be subject to a decision based solely on automated processing, unless the legal requirements for this are met. Automated decision-making does not take place at amedes.

You also have the right to object, on grounds relating to your particular situation, to processing of your data which is necessary for the purposes of the legitimate interests pursued by amedes or by a third party (right to object).If personal data is processed by us for direct marketing purposes, you have the right to object to this processing at any time without the need for special reasons.

If your data is processed on the basis of consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing of your data based on consent before its withdrawal.

To exercise your rights and to revoke any declaration of consent, please contact amedes using the contact details listed in section 1.

You also have the right to lodge a complaint with a supervisory authority at any time, without prejudice to any other legal remedies.

5. security

amedes has implemented appropriate technical and organisational measures to protect your personal data. In particular, in cases where you send personal data to us, amedes offers you the option of transmitting the information in encrypted form. This encryption protects the confidentiality of the data exchange between you and our web server and helps to prevent misuse of the data, e.g. by eavesdropping. We use SSL (Secure Socket Layer) encryption technology. This is a recognised and widely used technology for protecting personal data.