Privacy Policy

1. Controller

Kronenapotheke Teltow Susanne Schleyer e.K. Ruhlsdorfer Straße 3, 14513 Teltow Germany Email: hormone@praeventivmanufaktur.de Phone: +49 3328 4219334

2. Collection and processing when submitting a prescription

When you submit a prescription via our form, we process the following personal data: title, first and last name, address (street, postcode, city), email address, optional telephone number, your message and the uploaded prescription (PDF or image file) including the health data contained therein.

The legal basis is Art. 6 para. 1 lit. b GDPR (contract initiation/fulfilment) and for health data Art. 9 para. 2 lit. h GDPR in conjunction with § 22 para. 1 no. 1 lit. b BDSG (healthcare by members of a healthcare profession subject to professional secrecy).

The purpose of processing is to review your request, prepare an offer, manufacture the individual formulation and deliver or make it available for collection.

3. Storage of prescription files

Uploaded prescriptions are stored encrypted in a private storage area and are only accessible to authorised pharmacy staff. They are not passed on to third parties, except to service providers within the scope of order processing (see section 10) and to shipping service providers for delivery.

4. Retention period

We retain prescriptions and related documents in accordance with pharmacy law retention obligations (§ 22 ApBetrO). Tax-relevant documents are subject to the retention periods of the German Fiscal Code (up to 10 years). After expiry of the statutory retention periods, your data will be deleted.

5. Confirmation and status emails

After submitting the form, you will receive an automatic confirmation of receipt at the email address provided. In the further course, we will inform you by email about the processing status (e.g. payment link, manufacture, dispatch). The legal basis is Art. 6 para. 1 lit. b GDPR. Dispatch is carried out via a technical service provider as part of order processing.

6. Customer account

You can optionally create a customer account. We process your email address, an encrypted stored password and your master data (title, name, address, possibly telephone number) so that your requests can be assigned and forms can be pre-filled. The legal basis is Art. 6 para. 1 lit. b GDPR. Alternatively, login via Google is possible; in this case we receive your email address and name from Google (Art. 6 para. 1 lit. b GDPR). You can have your account deleted by email at any time; statutory retention obligations for prescription and billing documents remain unaffected.

7. Payment processing

Payment is processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. When the payment link is called up, name, address, email address, invoice amount and payment data are transmitted to Stripe and processed there for payment processing and invoicing. We do not receive payment data (e.g. card data) ourselves. The legal basis is Art. 6 para. 1 lit. b GDPR. A transfer to the USA may take place; it is secured by EU standard contractual clauses. Further information: stripe.com/privacy.

8. Cookies and local storage

We only use technically necessary cookies or local browser storage – for example for your login to the customer account and for storing your selection in the privacy notice. We do not use analytics, tracking or marketing cookies. The legal basis is § 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR (provision of a functional website).

9. Server log files

When you access the website, technically necessary data (IP address, date and time, page accessed, browser and system information) is automatically processed to ensure delivery and security of the website. The legal basis is Art. 6 para. 1 lit. f GDPR; the data is stored for a short time and then deleted.

10. Processors and hosting

To operate the website and process the submitted data, we use the following service providers with whom order processing contracts exist under Art. 28 GDPR or – in the case of Stripe – independent responsibility for payment processing:

• Supabase (database, file storage and authentication, servers within the EU)
• Lovable (hosting of the website and technical email dispatch)
• Stripe Payments Europe Ltd. (payment processing and invoicing)
• DHL / Deutsche Post AG (dispatch of formulations, if selected)

11. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). You can revoke any consent given at any time with effect for the future (Art. 7 para. 3 GDPR). You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) – the competent authority is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

12. Provision obligation and automated decisions

The provision of your contact and prescription data is required for processing your request; without this information we cannot review and manufacture an individual formulation. Automated decision-making including profiling under Art. 22 GDPR does not take place.

13. Data security

Transmission is encrypted (TLS/HTTPS). Only authorised employees subject to pharmacy law professional secrecy have access to prescription data.

14. Contact for data protection questions

If you have any questions about the processing of your personal data, please contact team@ka-teltow.de.