Privacy Statement
As at 6 May 2026
Privacy Policy
Our company puts much emphasis on data protection and data security for our company’s customers and partners, as well as for prospective customers and users of our website. Transparently processing and protecting your personal data are therefore of particular importance to us.
In this statement, we provide you with an overview of how your personal data is collected and processed when you use our website, and of how you can help to improve the protection of your data.
Data controller
Thoraxklinik-Heidelberg gGmbH
Röntgenstr. 1
D-69126 Heidelberg
Telephone: +49 6221 396 0
www.thoraxklinik-heidelberg.de
Data Protection Officer
Jan Alkemade
Alkemade IT-Security e.K.
Egerländer Str. 9
D-61239 Ober-Mörlen
Telephone: +49 6002 939593
Email: jan.alkemade(at)alkemade-it.de
How we process your personal data
When you visit our websites, our web servers automatically store, by default and for system security purposes, the communication data of the requesting computer, the IP address of the requesting device, the web pages you visit on our site, the date, time and duration of your visit, the details identifying your browser and operating system, and the website from which you are visiting us (known as the referrer URL).
Any further personal details, such as your name, address, telephone number or email address, will not be logged unless you provide them voluntarily, for example when registering, taking part in a survey or a competition, for the purpose of fulfilling a contract, or in response to a request for information.
How we use your personal data, and how we share it
If the website provides the option to enter personal or business details (email addresses, names, street addresses), the disclosure of such details by the user is entirely voluntary.
Emails are sent using a contact form. If you send us a message of this kind, your personal data will only be processed to the extent necessary to respond to it. The email is transmitted in encrypted form using the TLS connection protocol.
Any consent you have given may be withdrawn at any time with effect for the future.
How long is your data stored for?
Generally, we store all information you provide to us until the associated purpose – for example, a contractual purpose – has been fulfilled. For example, in the case of enquiries, until they have been dealt with; in the case of newsletters, until you unsubscribe. If the law provides for data to be stored for a longer period, it will be stored in accordance with those provisions.
Should you no longer wish us to use your data, we will, of course, comply with this request immediately (please contact us at the address you will find under “Contact”).
When will your data be deleted?
Stored personal data will be deleted if you withdraw your consent to its storage, if knowledge of the data is no longer necessary to fulfil the purpose for which it was stored, or if its storage is unlawful for other legal reasons. Data held for billing and accounting purposes is not affected by a request for erasure.
Use of cookies
When you visit our website, we use “cookies”. These are small text files that are stored on your computer. Cookies help us to determine the frequency of use and the number of users of our website, and to make our services as convenient and efficient as possible for you.
On the one hand, we use “session cookies”, which are stored temporarily for the duration of your visit to one of our web pages. Secondly, we use “persistent cookies” to record information about visitors who return to one of our web pages.
The purpose of using these cookies is to provide you with an optimal user experience, to “recognise” you and, when you visit the site again, to present you with a website that is as varied as possible and features new content. The content of a persistent cookie is limited to an identification number. Your name, IP address, etc. are not stored. We will not generate any personalised profiles based on your usage behaviour.
You can still use our services without cookies. You can disable cookies in your browser, restrict them to specific websites, or set your browser to notify you whenever a cookie is sent. Please note, however, that if you disable this feature, you should expect the page to be displayed in a limited format and the user guidance to be restricted.
Cookies that are necessary for executing electronic communication processes or for providing specific functions you have requested (e.g. the shopping basket function) are stored on the basis of Art. 6,1 (b) and (f) of the GDPR, insofar as this serves to fulfil a contract, including pre-contractual measures, with you as the data subject.
The website operator has a legitimate interest in storing cookies to ensure that its services are provided in a technically faultless and optimised manner. Where other cookies (e.g. cookies used to analyse your browsing behaviour) are stored, these are dealt with separately in this privacy policy.
What we do to ensure the security of data processing
Our company takes all technical and organisational security measures required to protect your personal data from loss and misuse. Your data is therefore stored in a secure operating environment that is not accessible to the public.
In certain cases, your personal data is encrypted during transmission using Secure Socket Layer (SSL) technology. This means that communication between your computer and our company’s servers uses a recognised encryption method, provided your browser supports SSL.
Legal bases
Where we obtain the data subject’s consent for the processing of personal data, Art. 6,1 (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
Where personal data is processed in order to fulfil a contract to which the data subject is a party, such processing is based on Art. 6,1 (b) of the GDPR. This also applies to processing operations necessary for the implementation of pre-contractual measures.
Where personal data needs to be processed to fulfil a legal obligation to which the controller is subject, such processing is based on Art. 6,1 (c) of the GDPR.
Where the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, such processing is based on Art. 6,1 (d) of the GDPR.
Where processing is necessary to safeguard the purposes of the legitimate interests of the controller or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, such processing is based on Art. 6,1 (f) of the GDPR.
Legitimate interests include, in particular, ensuring the operation and security of the website, analysing how visitors use the website, and making the website easier to use.
Your data privacy rights
The applicable legal provisions grant you the right to obtain, at any time and free of charge, information about your stored personal data, its origin and any recipients, and the purpose of processing this data (Art. 15 of the GDPR).
Where applicable, you also have the right to have inaccurate data rectified (Art. 16 of the GDPR), the right to erasure of such data (Art. 17 of the GDPR), the right to restriction of processing under Art. 18 of the GDPR, the right to object to the processing of your personal data (Art. 21 of the GDPR), and the right to data portability in respect of data you have provided, pursuant to Art. 20 of the GDPR.
With regard to the right of access and the right to erasure, the restrictions set out in Articles 34 and 35 of the BDSG apply.
Furthermore, in the event of breaches of data protection law, you have the right to lodge a complaint with the relevant supervisory authority (Art. 77 of the GDPR).
The supervisory authority responsible for data protection provided by the data controller is:
The State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg
represented by Prof. Dr Tobias Keber
35 Heilbronner Straße
D-70191 Stuttgart
www.baden-wuerttemberg.datenschutz.de
What we do to ensure the security of data processing
Our company takes all technical and organisational security measures necessary to protect your personal data from loss and misuse. Your data is therefore stored in a secure operating environment that is not accessible to the public.
In certain cases, your personal data is encrypted during transmission using Secure Socket Layer (SSL) technology. This means that communication between your computer and our company’s servers uses a recognised encryption method, provided your browser supports SSL.
How you can withdraw your consent to data processing
Many data processing operations can only be carried out with your explicit consent. You may withdraw any consent you have already given at any time. All you need to do is send us an informal email. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by the withdrawal.
Google Analytics
You can prevent Google Analytics from collecting your data by clicking the button below. An opt-out cookie will be set to prevent your data from being collected during future visits to this website. You can undo this by clicking again and help us further improve the website.
Disable Google Analytics
Use and application of YouTube
This website incorporates some YouTube components. YouTube is an online video platform that allows video publishers to upload video clips free of charge and enables other users to watch, rate and comment on them, also free of charge.
YouTube allows all kinds of videos to be published, which is why the platform offers access to full-length films and TV programmes, as well as music videos, trailers and user-generated content.
YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
Every time you visit a page on our website on which a YouTube component (YouTube video) has been embedded, your web browser is automatically prompted by the relevant YouTube component to download a representation of that YouTube component from YouTube.
Further information about YouTube is available at www.youtube.com/yt/about/de/ .
As part of this technical process, YouTube and Google are informed of the specific subpage on our website that you are visiting.
Provided you are logged in to YouTube when you access a subpage containing a YouTube video, YouTube will recognise which specific subpage of our website the data subject is visiting. This information is collected by YouTube and Google and linked to the data subject’s respective YouTube account.
YouTube and Google receive information via the YouTube component whenever the data subject visits our website while simultaneously being logged in to YouTube. This happens regardless of whether you click on a YouTube video or not.
If you do not wish for this information to be transmitted to YouTube and Google, you can prevent this by logging out of your YouTube account before visiting our website.
The privacy policy published by YouTube is available at www.google.de/intl/de/policies/privacy/ .
We run a so-called fan page at facebook.com/ThoraxklinikHeidelberg .
When you visit our fan page, various types of data are collected and processed. For some of the processing of your data carried out on www.facebook.com, we and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Facebook Ireland”) are jointly responsible under data protection law; for other data processing operations, either we or Facebook Ireland are solely responsible.
If you contact us on Facebook, we will process your name and any other information you provide to us, either directly or via the comments function. We are solely responsible for the processing of your data. The processing of this data, which you provide to us, is carried out based on your consent in accordance with Art. 6,1 (a) of the GDPR.
Together with Facebook Ireland, we are responsible for Facebook’s “Page Insights” feature, which provides us with aggregated and anonymised details of your use of and interaction with our fan page for statistical analyses.
Follow the link below to view the joint controller agreement pursuant to Art. 26 of the GDPR:
de-de.facebook.com/legal/terms/page_controller_addendum
Facebook Ireland is solely responsible for any further, unilateral processing of your data by Facebook Ireland, in particular with regard to a potential transfer of your data to the USA. Facebook Ireland uses cookies and other technologies to collect data from you.
You can find out the purposes for which this data is processed and the legal basis for such processing in Facebook’s Privacy Policy: facebook.com/privacy/policy/
Please note that Facebook Ireland may collect and process data about you when you visit www.facebook.com even if you do not have a Facebook account or are not logged in to Facebook.
We have an Instagram account.
The party ultimately responsible for processing your data when you visit www.instagram.com is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook Ireland”).
Facebook Ireland uses cookies and other technologies to collect data from you. You can find out the purposes for which this processing is carried out and the legal basis for it in Instagram’s Privacy Policy: help.instagram.com/519522125107875 and Instagram’s information on the cookies it uses: help.instagram.com/1896641480634370 .
Please note that when you visit www.instagram.com, Facebook Ireland may collect and process data about you even if you do not have an Instagram account or are not logged in to Instagram.
However, we do process data that you provide to us via Instagram and which is publicly visible. This data is processed based on Art. 6,1 (f) of the GDPR and serves our legitimate interests in presenting our company in an appropriate and interactive manner.
Facebook Ireland’s “Instagram Insights” feature offers us the opportunity to measure and analyse visitor interactions on our Instagram channel. However, this only gives us access to aggregated and anonymised data, which does not allow us to identify individual users.
We have a website at www.linkedin.com.
When you visit our website, various categories of personal data are processed. For some of the processing of your data carried out on www.linkedin.com, we are jointly responsible with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn Ireland”) under data protection law; for other data processing activities, either we or LinkedIn Ireland are solely responsible.
If you get in touch with us on LinkedIn, we will process your name and any other information you provide to us. We are solely responsible for the processing of your data. The processing of the data you provide to us is based on your consent pursuant to Art. 6,1 (a) of the GDPR.
Together with LinkedIn Ireland, we are responsible for the “Page Insights” feature, which provides us with aggregated and anonymised details of your use of and interaction with our website for statistical analyses.
Follow the link below to view the joint controller agreement pursuant to Art. 26 of the GDPR:
www.linkedin.com/legal/l/page-joint-controller-addendum
LinkedIn Ireland is solely responsible for any further, unilateral processing of your data by LinkedIn Ireland, in particular with regard to a potential transfer of your data to the USA. LinkedIn Ireland uses cookies and other technologies to process your data.
You can find out the purposes for which this data is processed and the legal basis for such processing in LinkedIn’s Cookie Policy: www.linkedin.com/legal/cookie-policy and LinkedIn’s Privacy Policy: www.linkedin.com/legal/privacy-policy .
Please note that LinkedIn Ireland may collect and process data about you when you visit www.linkedin.com, even if you do not have a LinkedIn account or are not logged in to LinkedIn.
Changes to our privacy policy
We update our security and data protection measures as required by technical and legal developments, and amend our privacy policy accordingly. Therefore, please refer to the latest policy version.
Date of the Privacy Policy: 5 May 2026