Privacy policy

The essentials in brief

You can use this website without providing any information about yourself. We do not set cookies on the public pages, do not use analytics or advertising services and do not embed content from third-party providers. Fonts, maps and programs are hosted on our own server.

We only process personal data if you write to us, submit a membership application, use the members' area as a member facility or submit events as an external organiser. What exactly happens is described below.

1. Controller

Medizinischer Versorgungsverbund Müritz e.V., Rosa-Luxemburg-Straße 20, 17192 Waren (Müritz) Phone: 03991 66 48 10 · E-mail: kerstin.brueggmann@email.de Represented by the board (see legal notice).

We are not required to appoint a data protection officer (§ 38 BDSG). Please send any questions about data protection to the address above.

2. Provision of the website and server logs

The website is hosted by [Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen – data centre in Germany; please confirm]. We have a data processing agreement with the provider (Art. 28 GDPR).

When you open any page, your browser transmits technically necessary data to our server: IP address, date and time, requested address, amount of data transferred, status code, browser and operating system, and the previously visited page. This data is needed to deliver the page and to ensure the security of the server (defence against attacks and misuse). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.

Our server or the upstream access server stores this access data in log files for a maximum of [7] days; after that it is deleted. If a security incident is being investigated, we keep the affected entries until the investigation is complete. The data is not combined with other data.

All connections are encrypted (HTTPS).

3. Cookies and storage in the browser

On the public pages we do not set cookies and store nothing on your device. Your language choice is part of the page address.

The website stores something in your browser only in the following cases, each because it is strictly necessary for the service you requested (§ 25(2) No. 2 TDDDG):

• Members' area: after logging in with an e-mail code, a session cookie ("__Host-mvm_member", for this website only and only over encrypted connections, invalid after 2 hours). Its content (your e-mail address and the validity period) is encrypted and protected against tampering. "Log out" ends your sessions on all devices. • Association editorial team: when logging in to the administration, a login cookie of the content management system. • Membership application: until you close the browser tab, your application is kept as a PDF in the browser's session storage so that you can download it on the confirmation page.

4. Visitor counting without personal reference

To see which pages are needed, we count per day how often a page was opened and how often a contact option (phone, e-mail, route, website, appointment booking) was tapped, as well as the language of the page. We do not store any IP address, device ID or cookie; only totals are created. If "Do Not Track" or "Global Privacy Control" is enabled in your browser, we do not count at all.

We also count search terms that returned no results (without any reference to you) in order to identify gaps in the directory. Please do not enter personal information in the search. We delete these search terms after 13 months.

Member facilities receive a report with these totals for their entry by e-mail once a quarter (can be unsubscribed) and can view and download it at any time in the members' area. The board receives the overall figures for the network. The legal basis is Art. 6(1)(f) GDPR (improving the service).

For event pages, we also count the views per event. The organisers of the respective event can see these totals in the members' area – likewise without any reference to individual visitors.

5. Contact form and e-mail

If you write to us via the contact form or by e-mail, we process your name, e-mail address, subject and message in order to answer your enquiry. The information is not stored in a database but forwarded by e-mail to the office.

The legal basis is Art. 6(1)(b) GDPR where membership or a contract is concerned, otherwise Art. 6(1)(f) GDPR (answering enquiries). We delete messages once the enquiry has been dealt with, at the latest after [6 months], unless there is a statutory retention obligation.

Please do not send us any information about your health via the form. We are not a medical practice and cannot answer medical questions.

6. Membership application

For the membership application we process the information from the form (facility, address of the facility, contact details of the applicant and optional professional information). We do not ask for a date of birth or a private address. This creates a PDF that you can download; at the same time, the application is sent by e-mail to the office. It is not stored on our server.

The legal basis is Art. 6(1)(b) GDPR (admission to the association). We keep the documents for the duration of the membership and delete them afterwards, unless statutory retention periods (e.g. up to 10 years for contribution payments under commercial and tax law) prevent this. If the application is rejected or withdrawn, we delete it after 6 months.

7. Spam protection

To prevent forms from being filled in en masse by programs, your browser invisibly solves a small computing task when you submit (ALTCHA, on our own server). There is no picture puzzle, no cookies and no transfer to third parties; no personal data is processed for this.

In addition, we limit how often forms can be submitted or login codes requested with the same e-mail address. For this purpose the address is only kept as a checksum and for a maximum of 24 hours in the server's memory; IP addresses are not used. The legal basis is Art. 6(1)(f) GDPR (protection against misuse).

8. Directory of member facilities

In the directory we publish information about the member facilities: name of the facility, names and roles of the doctors and team members, specialties, services, address, business phone number and e-mail address, website, opening and closing times, photos and accessibility information. The information comes from the association's previous website and is maintained and confirmed by the facilities themselves.

The purpose is to show patients in the region the way to suitable care – this is one of the association's purposes. The legal basis is Art. 6(1)(b) GDPR (membership) or Art. 6(1)(f) GDPR. Anyone named in the directory can object to publication at any time or request a correction; the facility can change its information itself in the members' area.

9. Members' area

Access is granted to up to three people per facility whom the facility (or the office) has registered with name and e-mail address as editors, as well as to the office and to external organisers (section 11). One of the editors is the main address, which writes on behalf of the facility. Instead of a password, we send a code by e-mail. We store the code only in encrypted form (as a checksum); it is valid for 15 minutes, a code in an invitation for 7 days (2 days for organisers). On request, the office can generate a code that is valid for 24 hours. We delete expired codes. Editors can be removed again at any time.

Photos can be uploaded in the members' area, for example of the practice team. Please only upload photos to which you hold the rights and whose publication the people shown have agreed to. We remove location data and other metadata when uploading.

We log all changes – to the entry, to news items, job advertisements and events, to registrations and access – with the time, name and e-mail address of the editor, so that it is clear who changed what and so that changes can be undone. The log can be seen by the editors of the respective facility and by the office; the office receives a daily summary e-mail about this. We store scheduled changes until their scheduled time and preview versions for no more than one day. We delete the log after 2 years.

To protect the data, we also log access: logins to the members' area and to the administration, blocked login attempts, downloads of participant lists and reports, and the sharing of participant lists – each with the time, name and e-mail address of the person acting. These entries can be seen by the office and by the person concerned; like the change log, we delete them after 2 years. Further deletion periods: shared participant lists 3 months after the event, applied or discarded scheduled changes after 30 days, the e-mail address of the person who posted news items and events after one year, photos and files no longer in use 30 days after upload.

Once a year we ask by e-mail for the information to be confirmed. The legal basis is Art. 6(1)(b) and (f) GDPR (supporting members, correct information in the directory, traceability).

10. News, job advertisements and events

For posts from the members' area, we publish which facility they come from. If another editor (not the main address) writes, the post shows "Posted by" with the registered name. Editors' e-mail addresses are not public.

In job advertisements, the facility can name a contact person with a business phone number and e-mail address. Applications go directly by e-mail or phone to the facility, not to the association; no applications are transmitted via this website. We delete expired advertisements 3 months after expiry.

Events can be submitted by member facilities and external organisers (section 11); they only appear once the office has approved them. Whoever submitted an event is informed of its approval or rejection by e-mail. The public event page shows the organiser stated and, where applicable, "Posted by" with the name of the person who submitted it; their e-mail address is not public.

For event venues, we determine the location on the map from the address. If the address is not already known in the directory, we query the Nominatim service of the OpenStreetMap Foundation (United Kingdom; adequacy decision of the EU Commission). Only the address of the venue is transmitted, no data about visitors.

11. Access for external organisers

The office can set up access to the members' area for organisers outside the association. For this we store the name, organisation, e-mail address, optionally a phone number, who sent the invitation and whether the access has already been used. The invitation is sent by e-mail with a code that is valid for 2 days; after that, organisers log in like members with a code sent by e-mail.

With this access, organisers can submit, change and delete their own events, view and download the view counts of their event pages, and view, add, cancel and download as a list the registrations for their events (section 12). They cannot see any other data in the members' area.

Access ends automatically 30 days after the organiser's last event; the office can extend it or end it immediately. We delete the access data 1 year after the access has expired or ended; published events remain without any link to the access. The legal basis is Art. 6(1)(b) GDPR (use of the access) and Art. 6(1)(f) GDPR (traceability and protection against misuse).

12. Registration for professional events

Member facilities can register online with binding effect for professional events (for practice teams and specialist staff). Registration can be made by any person registered as an editor after logging in with an e-mail code; the organiser or the office can also enter a registration on behalf of the facility, for example after a phone call. For this we process the registered facility, the names of the participants, the number of people, an optional note and the e-mail address of the person registering. This information can be seen by the office and by the organiser of the respective event (a member facility or an external organiser); they can download the list of participants and cancel registrations. The person registering receives a confirmation by e-mail. Please do not enter any health information in the note.

For events for patients and interested members of the public, there is deliberately no online registration via this website, because even registering for a health topic can allow conclusions to be drawn about a person's health (special categories under Art. 9 GDPR). For those events, please register directly with the organiser if necessary.

The legal basis is Art. 6(1)(b) GDPR (participation in the event). We delete registrations 3 months after the event.

13. Sending e-mails

We send login codes, confirmations and reports via [the association's e-mail service provider – please add] as a processor (Art. 28 GDPR). The content is limited to the information required for the respective purpose.

14. Translations

We also provide the content of this website in English, Ukrainian, Polish, Russian and Arabic; the translations are machine-generated. If the editorial team uses an external service for this (planned: DeepL SE, Cologne, as a processor), only the website texts to be translated are transmitted, no data about visitors.

15. Location for "Near me"

If you select "Use my location" in the search and your browser asks for permission, your location is used only in your browser to sort the results by distance. It is not transmitted to us and not stored.

16. Links to other providers, calendar and sharing

Links to other websites (e.g. appointment booking with Doctolib, pharmacy emergency service, 116117.de, map services for directions, WhatsApp when sharing) open in a new tab. Data is only transmitted to the respective provider once you click such a link; that provider is responsible for it.

Calendar entries, the calendar subscription for professional events and the subscriptions for news and jobs are loaded directly from our server; only the access data described in section 2 is generated. The QR code on printouts is generated in your browser.

If you share a link to this website (e.g. via WhatsApp, Signal or e-mail), the respective service retrieves the title, short description and a preview image from our server. We do not pass on any data about you; the provider of the respective service is responsible for processing within that service.

17. Recipients and transfers to third countries

Your data is received only by the association's office and board, for event registrations additionally by the organiser of the respective event (section 12), as well as by the service providers named above, insofar as this is necessary for the respective purpose. No data is transferred to countries outside the EU (exception: section 10, without data about you). There is no automated decision-making and no profiling.

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): Insofar as we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation – for example to being named in the directory.

To do so, contact the office informally (section 1). You can also lodge a complaint with a data protection supervisory authority; the authority responsible for us is: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin, www.datenschutz-mv.de.

Last updated

October 2026. We will adapt this statement if the website or the legal situation changes.