بيانات النشر

Last updated: 09 February 2026

1) Controller

Practice / Controller: PD Dr. Ralf Herwig – German Medical Center
Address: Building 27, Dubai Healthcare City (DHCC), Dubai, United Arab Emirates
Email: office@profherwig.com

Phone: +971 55 549 5036

Privacy contact: office@profherwig.com
(subject: “Privacy”)

​

2) Scope

This Privacy Policy explains how we process personal data when you use our website, contact us, book appointments (“Book Online”), and—where enabled—make payments related to online bookings.

​

3) Website platform & hosting (Wix)

Our website is built and hosted on Wix, which provides website hosting, security, and core site functionality. To operate and secure the site, technical data may be processed. Wix may use sub-processors to deliver its services.

Legal basis (where GDPR applies): legitimate interests in secure and functional website operations (Art. 6(1)(f) GDPR).

​

4) What data we process and why
4.1 Website visits (server / access data)

Data categories: IP address (technical), date/time, pages accessed, referrer URL, browser/device information, error logs and security events.
Purpose: website delivery, IT security, abuse prevention, troubleshooting, stability.
Legal basis (where GDPR applies): legitimate interests (Art. 6(1)(f) GDPR).

4.2 Contact requests (forms, email, phone)

Data categories: name (if provided), email address, phone number (if provided), message content, communication metadata.
Purpose: responding to your request, scheduling/coordination, communication.
Legal basis (where GDPR applies): contract/steps prior to contract (Art. 6(1)(b) GDPR) and/or legitimate interests (Art. 6(1)(f) GDPR).

Important note: Please do not submit highly sensitive medical information through general website contact forms unless a secure, dedicated channel is explicitly provided for that purpose.

4.3 Online bookings (Wix Bookings)

If you use “Book Online”, we process the data necessary to manage your appointment.
Data categories: booking and contact data (e.g., name, email, phone, appointment details; any notes you voluntarily submit).
Purpose: appointment reservation, appointment management, service delivery, related communication.
Legal basis (where GDPR applies): contract/steps prior to contract (Art. 6(1)(b) GDPR).

Health data: If you provide information that qualifies as health data (special category data), we process it only to the extent necessary and in line with applicable legal requirements and safeguards (including relevant DHCC healthcare data protection rules where applicable).

4.4 Payments for online bookings (Stripe / PayPal)

Where payment is enabled for bookings (e.g., deposit, service fee, no-show fee), payment processing is handled by Stripe and/or PayPal.

Stripe/PayPal process payment and security data (e.g., payment method details, transaction data, fraud prevention) under their own privacy frameworks.

We typically receive only the information required to reconcile the booking (e.g., payment status, amount, transaction reference).

We do not store full card details on our systems.

Legal basis (where GDPR applies): contract (Art. 6(1)(b) GDPR).

​

5) Cookies & similar technologies

Wix may place cookies and similar technologies that are necessary for security, session management and core site functions. Depending on your site configuration, additional cookies may be used for optional functionality.

Essential cookies: required for the site to function (and for secure booking flows).

Non-essential cookies (e.g., analytics/marketing): used only if enabled and, where legally required, only after consent via a cookie banner/settings.

Note: Payment providers (Stripe/PayPal) may use technically necessary cookies or comparable mechanisms during the payment process.

​

6) Recipients / categories of recipients

We use service providers as processors and, in some cases, independent controllers:

Wix (hosting, security, website functions; including sub-processors)

Stripe and/or PayPal (payment processing, where payment is enabled)

​

7) International data transfers

Because our practice is located in the UAE and web/payment services are operated via global infrastructure, personal data may be transferred to countries outside the EU/EEA (e.g., UAE, the United States, and other locations where providers/sub-processors operate). Where GDPR applies, recognized safeguards (e.g., standard contractual clauses and additional technical/organizational measures) may be used as appropriate.

​

8) Retention

We retain personal data only as long as needed for the purposes described above, or as required by applicable law and professional/medical record obligations.

Contact requests: until completion plus a reasonable follow-up period

Booking/transaction records: as required for service, accounting, and compliance

Clinical documentation (if applicable): according to applicable healthcare documentation and retention requirements in the relevant jurisdiction (including DHCC context where applicable)

​

9) Your rights

Where the GDPR applies, you may have rights to access, rectification, erasure, restriction, data portability, objection, and the right to withdraw consent (where processing is based on consent). Additional rights may exist under applicable UAE data protection frameworks.

To exercise your rights: office@profherwig.com

​

10) Security

We implement appropriate technical and organizational measures (e.g., TLS encryption, access controls, role-based permissions) to protect personal data against unauthorized access, loss, misuse, or alteration.

​

11) Changes to this Privacy Policy

We may update this Privacy Policy from time to time (e.g., due to technical or legal changes). The current version will always be available on our website.