top of page

data protection

This privacy policy informs you about the nature, scope, and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offering and the associated websites, functions, and content as well as external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”). With regard to the terms used, such as “processing” or “controller,” we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).


Responsible Person:


Irina Lamprecht / NeuroCoaching

Ilsensteinweg 14

14129 Berlin, Germany

Email address:

Managing Director/Owner: Irina Lamprecht

Link to the imprint:


Types of data processed:


    •    Inventory data (e.g., names, addresses).

    •    Contact data (e.g., email, telephone numbers).

    •    Content data (e.g., text entries, photographs, videos).

    •    Usage data (e.g., visited websites, interest in content, access times).

    •    Meta/communication data (e.g., device information, IP addresses).


Categories of affected persons:


Visitors and users of the online offering (hereinafter collectively referred to as “users”).


Purpose of processing:


    •    Provision of the online offering, its functions, and content.

    •    Responding to contact inquiries and communicating with users.

    •    Security measures.

    •    Range measurement/marketing.


Terms used:


“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.


“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data.


“Pseudonymization” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.


“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.


A “controller” is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.


An “processor” is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.


Relevant legal bases:


In accordance with Art. 13 GDPR, we inform you of the legal basis for our data processing. If the legal basis is not mentioned in the privacy policy, the following applies: The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR, the legal basis for processing for the performance of our services and performance of contractual measures as well as responding to inquiries is Art. 6(1)(b) GDPR, the legal basis for processing for compliance with a legal obligation is Art. 6(1)(c) GDPR, and the legal basis for processing for the protection of our legitimate interests is Art. 6(1)(f) GDPR. If the processing is necessary to protect the vital interests of the data subject or another natural person, Art. 6(1)(d) GDPR serves as the legal basis.


Security measures:


We take appropriate technical and organizational measures in accordance with Art. 32 GDPR to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical access to the data, as well as the access, input, disclosure, availability, and separation thereof. Furthermore, we have established procedures to ensure the exercise of data subjects’ rights, the deletion of data, and the response to data breaches. We also take into account the protection of personal data from the outset, through the use of appropriate hardware, software, and procedures, in accordance with the principle of data protection by design and by default (Art. 25 GDPR).


Collaboration with Data Processors and Third Parties


If we disclose data to other individuals and companies (data processors or third parties), transmit them, or otherwise grant them access to the data within the scope of our processing, this is only done on the basis of legal permission (e.g., if data transmission to third parties, such as payment service providers, is necessary for contract fulfillment pursuant to Art. 6(1)(b) GDPR), if you have consented, if a legal obligation provides for it, or based on our legitimate interests (e.g., when using agents, web hosts, etc.).


If we engage third parties to process data based on a so-called “data processing agreement,” this is done on the basis of Art. 28 GDPR.


Transfers to Third Countries


If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of using third-party services or disclosing/transmitting data to third parties, this is only done if it is necessary to fulfill our contractual obligations, based on your consent, due to a legal obligation, or based on our legitimate interests. Subject to legal or contractual permissions, we only process or have data processed in a third country if the special requirements of Art. 44 et seq. GDPR are met. This means, for example, that processing is based on special guarantees, such as the officially recognized determination of a data protection level equivalent to that of the EU (e.g., for the USA through the “Privacy Shield”) or compliance with officially recognized specific contractual obligations (so-called “standard contractual clauses”).


Rights of Data Subjects


You have the right to request confirmation as to whether relevant data is being processed and to obtain information about this data as well as further information and a copy of the data in accordance with Art. 15 GDPR.


You have the right, pursuant to Art. 16 GDPR, to demand the completion of data concerning you or the correction of incorrect data concerning you.


Subject to Art. 17 GDPR, you have the right to demand that relevant data be deleted without delay, or alternatively, subject to Art. 18 GDPR, to demand a restriction on the processing of the data.


You have the right, pursuant to Art. 20 GDPR, to receive the data concerning you that you have provided to us and to request their transmission to other controllers.


Furthermore, in accordance with Art. 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority.

Right of Withdrawal


You have the right to revoke consent given pursuant to Art. 7 para. 3 GDPR with effect for the future.


Right to Object


You can object to the future processing of data concerning you in accordance with Art. 21 GDPR at any time. The objection can be made in particular against processing for the purposes of direct advertising.


Cookies and Right to Object to Direct Advertising


As “cookies” are called small files that are stored on users’ computers. Different information can be stored within the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after their visit within an online offer. Temporary cookies, or “session cookies” or “transient cookies,” are cookies that are deleted after a user leaves an online offer and closes their browser. In such a cookie, for example, the content of a shopping cart in an online shop or a login status can be stored. “Permanent” or “persistent” cookies are cookies that remain stored even after the browser is closed. For example, the login status can be stored if users visit it after several days. Likewise, such a cookie can store the interests of users, which are used for range measurement or marketing purposes. “Third-party cookies” are cookies offered by providers other than the responsible party operating the online offer (otherwise, if they are only its cookies, they are called “first-party cookies”).


We may use temporary and permanent cookies and provide information about this in our privacy policy. If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. The exclusion of cookies can lead to functional restrictions of this online offer. A general objection to the use of cookies used for online marketing purposes can be declared for a large number of services, especially in the case of tracking, via the US-American site or the EU site Furthermore, the storage of cookies can be achieved by deactivating them in the browser settings. Please note that in this case, not all functions of this online offer may be used.

Deletion of Data


The data processed by us will be deleted or its processing restricted in accordance with Articles 17 and 18 of the GDPR. Unless expressly stated otherwise in this privacy policy, data stored by us will be deleted once it is no longer necessary for its intended purpose and there are no legal retention obligations preventing deletion. If the data is not deleted because it is required for other lawful purposes, its processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.


In accordance with legal requirements in Germany, data is retained for 10 years in particular according to §§ 147 (1) AO, 257 (1) No. 1 and 4, (4) HGB (books, records, management reports, accounting documents, commercial books, documents relevant for taxation, etc.) and 6 years according to § 257 (1) No. 2 and 3, (4) HGB (commercial letters). According to legal requirements in Austria, data is retained for 7 years in particular according to § 132 (1) BAO (accounting documents, invoices/receipts, accounts, receipts, business papers, statement of revenue and expenses, etc.), for 22 years in connection with real estate, and for 10 years for documents relating to electronically provided services, telecommunications, broadcasting, and television services provided to non-entrepreneurs in EU member states and for which the Mini-One-Stop-Shop (MOSS) is used.


Healthcare Services


We process the data of our clients/patients, interested parties, and other contracting parties or partners (collectively referred to as “patients”) in accordance with Art. 6 (1) lit. b) GDPR in order to provide them with our contractual or pre-contractual services. The data processed, the nature, scope, and purpose and necessity of their processing, are determined by the underlying contractual relationship. The processed data generally includes inventory and master data of the patients (e.g., name, address, etc.), as well as contact data (e.g., email address, telephone, etc.), contract data (e.g., services used, purchased products, costs, names of contact persons), and payment data (e.g., bank details, payment history, etc.).


As part of our services, we may also process special categories of data in accordance with Art. 9 (1) GDPR, in particular information about the health of patients, possibly with reference to their sex life or sexual orientation. For this purpose, we obtain an explicit consent from the patients in accordance with Art. 6 (1) lit. a., Art. 7, Art. 9 (2) lit. a. GDPR if necessary, and process the special categories of data otherwise for healthcare purposes on the basis of Art. 9 (2) lit h. GDPR, § 22 (1) No. 1 b. BDSG.


If necessary for the fulfillment of the contract or legally required, we disclose or transmit the data of patients as part of communication with medical professionals, to third parties involved in the fulfillment of the contract as required or typically, such as laboratories, billing agencies, or comparable service providers, provided that this serves the provision of our services in accordance with Art. 6 (1) lit b. GDPR, is legally required according to Art. 6 (1) lit c. GDPR, serves our or the patients’ interests in efficient and cost-effective healthcare as a legitimate interest according to Art. 6 (1) lit f. GDPR, or is necessary according to Art. 6 (1) lit d. GDPR to protect the vital interests of the patients or another natural person or within the scope of consent pursuant to Art. 6 (1) lit. a., Art. 7 GDPR.


The data will be deleted if the data is no longer required for the fulfillment of contractual or legal duties of care and handling of any warranty and comparable obligations, whereby the necessity of retaining the data is reviewed every three years; otherwise, the statutory retention obligations apply.




When contacting us (e.g., via contact form, email, telephone, or via social media), the user’s details are processed for the purpose of handling the contact request and its processing in accordance with Art. 6 (1) lit. b) GDPR. The user’s details may be stored in a customer relationship management system (“CRM system”) or similar request organization. We delete the requests if they are no longer necessary. We review the necessity every two years; furthermore, the statutory archiving obligations apply.


Social Media Presence


We maintain online presences within social networks and platforms to communicate with customers, interested parties, and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply. Unless otherwise stated in our privacy policy, we process users’ data if they communicate with us within social networks and platforms, e.g., by posting on our online presences or sending us messages.


Integration of Third-Party Services and Content


We use third-party content or service offerings based on our legitimate interests (i.e., interest in the analysis, optimization, and economic operation of our online offering within the meaning of Art. 6 (1) lit. f. GDPR) to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).


This always presupposes that the third-party providers of this content perceive the IP address of the users, since without the IP address they could not send the content to the browser of the respective user. The IP address is thus necessary for the display of this content. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain technical information about the browser and operating system, referring web pages, visit times, and other information about the use of our online offering, as well as may be linked to such information from other sources.


Google Analytics


This website uses features of the Google Analytics web analytics service. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses so-called “cookies”. These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. The storage of Google Analytics cookies is based on Art. 6 (1) lit. f DSGVO. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising.

bottom of page