As of: 9 October 2026

This privacy policy is required under German law. In case of doubt, the German version (Datenschutzerklärung) prevails. It explains which personal data are processed when you visit this website and when you contact my practice, for what purpose and on what legal basis, and what rights you have. In brief: this website sets no cookies, embeds no third-party analytics, advertising or social media services, and loads fonts and program libraries exclusively from its own server.

1. Controller

The controller responsible for data processing is:

Florian Lampersberger, psychological psychotherapist (Psychologischer Psychotherapeut)
Psychoanalytisch-Psychotherapeutische Praxis Lampersberger
Belgradstraße 9, 80796 München, Germany
Phone: +49 89 20315671
E-mail: mail@praxis-lampersberger.de

2. Hosting and server logs

This website is operated by do.de (Greenmark IT GmbH, Leinstraße 3, 31061 Alfeld, Germany) on servers in Germany. Whenever a page is accessed, the hosting provider processes technically necessary connection data: IP address, date and time, requested address, amount of data transferred, browser and operating system, and the previously visited page. These data are stored in log files in order to provide the website securely and reliably and to detect attacks. They are not combined with other data and, according to the provider, are deleted after four weeks at the latest. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). A data processing agreement under Art. 28 GDPR is in place with the provider.

3. Contacting the practice

Telephone and answering machine. I arrange appointments by telephone only. When you call or leave a message on the answering machine, I process your name, phone number and concern in order to call you back and arrange an appointment. The legal basis is Art. 6(1)(b) GDPR (steps prior to a treatment contract) and, insofar as you share information about your health, Art. 9(2)(h) GDPR. I delete answering-machine messages once the matter has been dealt with.

E-mail. You can write to me by e-mail. Please bear in mind that an unencrypted e-mail is technically a postcard. For information about your health, please use the encrypted form on the contact page or a PGP-encrypted e-mail; my public key is available on the contact page (fingerprint 32BB 2BA8 7B43 5E19 882B 43AC 153E DE47 E868 EDE5). I process e-mails in order to respond to your request (Art. 6(1)(b) GDPR, and Art. 9(2)(h) GDPR for health information) and delete them once they are no longer needed, unless they become part of the treatment records.

Encrypted contact form. The “Send a message encrypted” form on the contact page encrypts your message, including your name, telephone number and e-mail address, in your browser with the practice’s public OpenPGP key. Only the encrypted file is stored on the web server; neither the server nor the hosting provider can read its content. I receive an e-mail notification without any content, retrieve the message and decrypt it at the practice. The encrypted file is deleted after retrieval, automatically at the latest seven days after first retrieval. The legal basis is your consent (Art. 6(1)(a) and, insofar as the message contains health data, Art. 9(2)(a) GDPR).

Rejections. If I cannot offer a therapy place, I reply with a standardised rejection by e-mail or by text message from my mobile phone. It contains no content from your enquiry. When the website is set to “no new patients at present”, you can also request a dated rejection by e-mail yourself on the contact page, for example as proof for an application for reimbursement. Your telephone number or e-mail address is used only for sending and is not stored; only the number of rejections is counted. The legal basis is Art. 6(1)(b) GDPR (responding to your enquiry).

4. ePA assistant and encrypted transmission

On the page about the electronic patient record (ePA) you can create letters, such as objections to your health insurer or a declaration for the practice. Everything you enter is processed only locally in your browser, and the PDF files are created on your device. Your entries are neither transmitted to this website or to third parties nor stored. The only thing counted, anonymously, is that a letter was created – which type of letter, in which language, which basic choice was made and whether the “patient of this practice” box was ticked – and only as a daily total, without cookies, without IP addresses and without any link to you (see section 6).

If you are a patient of the practice and use the “Send encrypted” function, the documents you created, together with your details (name, date of birth if entered, insurance number, address, health insurer, selected options, an optional message and your signature if provided), are encrypted in your browser with the practice’s public OpenPGP key before transmission. Only this encrypted file is stored on the web server. I receive a notification without any content, retrieve the file, decrypt it and add it to your treatment records. The encrypted file is deleted after retrieval, automatically at the latest seven days after first retrieval. The legal basis is your explicit consent under Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR. Consent is voluntary: you can also make your declaration orally at the practice or bring the printed letters. Documents added to the treatment records are subject to the statutory retention period (Section 630f(3) of the German Civil Code).

To prevent misuse, the number of submissions per IP address is counted for at most one hour for both forms. Only an irreversible hash value is used for this; the IP address itself is not stored.

5. Clinic finder and Google ratings

On the “Clinic finder” page you can filter psychosomatic clinics by postcode, type of treatment and other features. Filtering happens in your browser; your entries are not transmitted to this website. So that your selection is kept when you navigate back, the browser stores it in its session storage only for as long as the tab is open; this is necessary for the function you requested (Section 25(2) no. 2 TDDDG). The only thing counted, anonymously, is which filters are used and which clinic websites are clicked (see section 6).

Star ratings from Google Maps are shown for the clinics. This website’s server retrieves them from the Google Places API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The server only transmits the name and address of the clinic concerned; your IP address and other data about you are not passed to Google. Only when you click a link to Google Maps or to a clinic’s website do you leave this website; the privacy policy of the respective provider then applies. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing an informative overview).

6. Audience measurement without cookies

This website uses a self-operated, data-minimising system for audience measurement. For each page view, the only data collected are: the page visited, the referring domain (only for referrals from other websites), the device category (phone, tablet, computer), the language version, the time spent on the page and the scroll depth. No cookies are set and no information is stored in or read from your browser; so that several views on the same day can be counted as one visit, a shortened, irreversible key is derived from IP address and browser identifier together with a random value generated anew each day. The random value is replaced daily, so visits on different days cannot be linked. No IP addresses are stored, no profiles are created and no data are transmitted to third parties; all data remain on this website’s server. In the same way, individual usage events are counted as daily totals only, such as ePA letters created, messages sent via the form, the type of enquiry selected on the contact page, filters used and clinics clicked in the clinic finder, and phone and e-mail links tapped. Individual entries are deleted automatically after 14 months; only monthly totals without any personal reference are kept permanently. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the statistical analysis of the use of this website). Logged-in editors of the website are not counted.

7. Psychotherapeutic treatment

I process data from treatment (personal and insurance details, findings, records) in order to provide and bill the treatment under Art. 9(2)(h) GDPR in conjunction with the treatment contract (Sections 630a et seq. German Civil Code) and to fulfil legal obligations, for example towards the Association of Statutory Health Insurance Physicians and your health insurer (Art. 6(1)(c) GDPR). Everything you entrust to me is subject to professional confidentiality (Section 203 German Criminal Code). I retain treatment records for ten years after the end of treatment (Section 630f(3) German Civil Code), unless other provisions require longer retention. The practice is administered with practice management software; where its provider may have access to data, a data processing agreement is in place.

8. Quality assurance (QSP project)

My practice takes part in the project for quality assurance in psychotherapy conducted by the QSP Institute in cooperation with the Chair of Clinical Psychology at the University of Kassel. Participation is voluntary and requires your separate consent, about which I inform you beforehand. For this purpose, your name, date of birth and e-mail address are transmitted in encrypted form to the QSP Institute so that you can receive the questionnaires; no further personal data are passed on. The questionnaire data are stored in pseudonymised form; only I and the responsible project staff, who are bound by confidentiality, have access. The legal basis is your consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR), which you can withdraw at any time without any effect on your treatment. Further information can be found in the privacy policy of the QSP Institute.

9. Online questionnaires

For diagnostics and for monitoring the course of treatment, I offer questionnaires that you complete on this website via a personal link. Participation is voluntary. You may skip individual questions and, if you prefer, answer the questionnaires on paper or in conversation.

How your answers are protected. Your answers are encrypted in your browser before they are transmitted (end-to-end encryption to the OpenPGP standard with the practice’s public key). Only I can decrypt them, using a private key that is not stored on the web server. The answers are evaluated exclusively on the computer in my practice and stored there in encrypted form. Neither the server operator nor anyone gaining unauthorised access to the server can read your answers.

What is stored on the server, and for how long. For each invitation: when it was created and how long it is valid, the selected questionnaires, the language, the progress status and the pseudonym under which I keep your records, the latter only in encrypted form; the access link and access code only as irreversible check values. For each completed questionnaire: the time and your encrypted answers. The portal does not record your name, contact details or health insurance data. Your answers remain on the server only until I have retrieved them for the practice and are then deleted, after 90 days at the latest. Completed invitations are deleted after retrieval; unused ones no later than 30 days after they expire. To limit repeated failed attempts, your IP address is processed for no longer than one hour as an irreversible check value. Section 2 applies to the server’s access logs.

Storage in the practice. The retrieved answers and their evaluation become part of your treatment records and, like these, are kept for ten years after the end of treatment (Section 630f(3) German Civil Code). At the end you can save your answers as a PDF on your own device; this file is created only on your device. So that you can pause and continue later, your progress is stored on your device while you fill in the questionnaires, encrypted with a key derived from your personal link. It is not transmitted to the server and is deleted once the questionnaire has been submitted, at the latest when the invitation expires (Section 25(2) no. 2 TDDDG).

Legal basis. The processing serves diagnostics and treatment (Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) German Federal Data Protection Act and the treatment contract, Sections 630a et seq. German Civil Code). In addition, you give your explicit consent when you start (Art. 9(2)(a) GDPR). You may withdraw this consent at any time with effect for the future; this does not affect your treatment.

Recipients. The server is operated by my hosting provider in Germany under a data processing agreement (Section 2); the provider has no access to the content of your answers. Your answers are not passed on to third parties, including the QSP institute and providers of artificial intelligence. No transfer to third countries takes place.

10. Coaching clients

For the non-clinical coaching and consulting services, I process the data required to initiate and perform the contract (contact details, appointments, billing data, and notes on the course of the coaching) on the basis of Art. 6(1)(b) GDPR. Content-related notes are additionally protected by criminal-law confidentiality under Section 203 of the German Criminal Code and are never shared with the commissioning organisation — including when a company pays for the coaching. Billing data are retained in accordance with statutory tax obligations (Section 147 AO); all other records are deleted after the coaching ends, as soon as no statutory retention grounds remain.

11. Recipients and transfers to third countries

I only pass on personal data where required by law (for example to your health insurer or the Association of Statutory Health Insurance Physicians), where you have consented, or where I use service providers as processors (hosting, practice software). There is no transfer to countries outside the European Union. There is no automated decision-making, including profiling.

12. Your rights

You have the right of access to the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17) unless a retention obligation applies, to restriction of processing (Art. 18) and to data portability (Art. 20). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR). Where I process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds.

A message to the contact details above is sufficient for any of these requests.

Right to lodge a complaint. You can lodge a complaint with a data protection supervisory authority. The authority responsible for my practice is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

13. Data security

The connection to this website is encrypted throughout with TLS (recognisable by “https://” and the padlock symbol in your browser). Messages and documents you send via the forms are additionally encrypted end-to-end in your browser. Answers from the online questionnaires are decrypted only on the practice computer and kept on the server only until they are retrieved for the practice (Section 9).