Privacy policy

for the website DRIPSTRO (www.dripstro.at) – vitamin infusions & Haemolaser – of Pflegstro GmbH. We process personal data only on the basis of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), the Telecommunications Act 2021 (TKG 2021) and the relevant professional regulations.

As of: October 2026 · Deutsche Fassung (if the two versions differ, the German version applies)

1. Controller

Data protection contact: Stefanie Schmelzer, managing director, at office@dripstro.at, +43 681 10447544 or by post to the address above. Please send all questions about your data and about the rights listed under section 14 to her.

2. Principles and overview

We process personal data only to the extent necessary to provide this website, answer your request or prepare and carry out a treatment – or where you have expressly consented. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

3. Hosting and server log files

When you open this website, your browser sends technically necessary data to the server of our hosting provider. The server log files store: IP address, date and time of access, page requested, amount of data transferred, browser type and version, operating system and, where applicable, the previously visited page.

Purpose and legal basis: technical operation, stability and defence against attacks; legitimate interest under Art. 6(1)(f) GDPR. This data is not combined with other data sources.

Retention: log files are deleted after 12 months at the latest, unless they are needed to investigate a specific security incident.

Hosting provider: Infomaniak Network AG, Rue Eugène Marziano 25, CH-1227 Les Acacias (GE), server location Switzerland. A data processing agreement under Art. 28 GDPR is in place with the provider. Our email mailbox is operated by the same provider. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR), so its level of data protection is recognised as equivalent to that of the EU.

4. Cookies, consent and fonts

Without your consent, this website sets no cookies and loads no content from third-party servers. The font (Montserrat), all images, icons and the map are delivered from our own server – there is no connection to Google Fonts or other services. There are no social media plugins, like buttons or embedded posts.

Cookie banner (consent management)

On your first visit, a banner asks whether you agree to Google Analytics. You can accept all services, reject all or choose individually; nothing is pre-selected. Google's scripts are only loaded after you consent. If you reject or make no choice, no connection to Google is made and the website remains fully usable.

We store your choice locally in your browser (local storage entry “pflegstro-consent” with your choice and the time) for 12 months so that we don't have to ask you on every page. This storage is technically necessary and permitted without consent under § 165(3) TKG 2021; it is not transferred to us or to third parties. The legal basis is our legitimate interest in respecting your decision (Art. 6(1)(f) GDPR). After 12 months we ask again.

Legal basis for Google Analytics: your consent under § 165(3) TKG 2021 (storing and reading cookies) and Art. 6(1)(a) GDPR (processing the data).

Withdrawal: you can withdraw or change your consent at any time with effect for the future – via “Cookie settings” at the bottom of every page or right here. When you withdraw, we delete the cookies set by Google in your browser. This does not affect the lawfulness of processing up to that point.

Open cookie settings

5. Google Analytics

With your consent (category “Statistics”) we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand how the website is used – for example which sections are read, how visitors find us and whether the request form works.

Data processed: pseudonymous ID (cookie ID), pages viewed, date and time, length of visit, source of the visit (e.g. search engine or ad), approximate location (country, region – derived from the IP address), device type, operating system, browser and screen size, and events such as “request sent” or “phone number clicked”. The contents of the request form (name, contact details, chosen infusion, message) are not sent to Google. Google Analytics 4 does not store IP addresses; for access from the EU the IP address is only used to determine the approximate location and is then discarded.

Settings: Google Signals (cross-device analysis) and the use of Analytics data for personalised advertising are switched off.

Cookies and retention: _ga and _ga_<ID> to distinguish visits – 12 months. Event data is automatically deleted in Google Analytics after 14 months.

Processor and transfers: Google processes the data as our processor under the Google Ads Data Processing Terms (Art. 28 GDPR). Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, so the European Commission's adequacy decision applies (Art. 45 GDPR).

Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021), which you can withdraw at any time via the cookie settings. More information: Google privacy policy.

6. Google Search Console

We use Google Search Console to see how our website is found in Google Search. No Google software is embedded on this website for this; no data about you is collected or sent to Google when you visit. Google only provides us with aggregated search statistics (e.g. search terms, number of clicks) that do not identify individuals.

7. Appointment request form

If you send us an appointment request using the form, we process the data you enter:

Purpose: handling your request, arranging an appointment and getting back to you.

Required details: we need your name and phone number to reach you about an appointment; without them we cannot handle your request. All other details are optional. There is no statutory or contractual obligation to provide us with data.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Where your details allow conclusions about your health – for example choosing a particular infusion or information in the message field – they are special categories of personal data. We process these on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give by ticking the consent box before sending. You can withdraw this consent at any time with effect for the future (see section 14). Please only include the health information in the message field that you want to share in advance – everything else we discuss in person.

Transfer and storage: the request is sent encrypted (TLS) to our web server and forwarded from there directly by email to office@dripstro.at. It is not stored permanently on the web server. To schedule appointments, we pass your name, phone number and preferred date on to Dr. Gerhard Niemeck's practice (see section 11). The form contents are not sent to Google or other analytics services; with your consent we only count that a request was sent.

Retention: if no appointment results, we delete your request no later than six months after the last contact. If a treatment takes place, the information becomes part of the records (section 11).

8. Spam protection of the form

To prevent the form from being misused for spam, we use our own spam protection without third-party services. No captcha provider is used, no cookies are set and no data is sent to external servers. The protection consists of three parts:

• Invisible extra field: a field that only automated programs fill in. No personal data is processed.
• Time check: we check whether a plausible amount of time has passed between opening the page and sending the form.
• Proof of work: your browser solves a small calculation in the background, which our server checks. You won't notice it; for mass sending it becomes uneconomical.

Rate limiting: to stop repeated automated requests, we count requests per internet connection. Your IP address is not stored for this; only a shortened check value (HMAC) created with a secret key, from which the IP address cannot be read. It is only taken into account for one hour and then deleted automatically. Legal basis: legitimate interest in abuse-free operation under Art. 6(1)(f) GDPR.

9. Map and external links

Map: the map in the contact section is a static image on our own server. No interactive map is embedded and no connection to a map service is made when the page loads. The image is based on map data from OpenStreetMap (© OpenStreetMap contributors, ODbL), downloaded once.

External links: this website contains links to other websites – for example “Plan your route” (OpenStreetMap), the website pflegstro.at, the Austrian legal information system and the Data Protection Authority. No data is sent to these providers when you simply view our page. Only when you click a link do you leave our website; from then on the privacy policy of the respective provider applies.

10. Contact by phone and email

If you call us or send an email, we process the data you provide (name, phone number or email address, content of your enquiry) to deal with your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries); for health information Art. 9(2)(h) GDPR in conjunction with professional regulations. Please note that unencrypted emails could be read by third parties in transit; for sensitive information we recommend calling us.

11. Treatment and patient data

If a treatment takes place (initial consultation, blood test, infusion, Haemolaser), we process the data required for it: personal details, medical history, reports and lab results, prescribed and performed measures, progress notes and billing data.

Legal basis: Art. 9(2)(h) GDPR (health care) in conjunction with § 5 Austrian Health and Nursing Care Act (GuKG – duty to keep records), Art. 6(1)(b) GDPR (treatment contract) and Art. 6(1)(c) GDPR (statutory retention obligations). This information is needed for safe treatment and must be documented by law; without it we cannot carry out the treatment.

Two controllers: the medical services are provided by Dr. Gerhard Niemeck, general practitioner, Beatrixgasse 11, 1030 Vienna, under his own responsibility. He keeps the medical records under § 51 Austrian Physicians Act 1998 as an independent controller; Pflegstro GmbH keeps the nursing records. For the joint treatment, both exchange the necessary data (doctor's order, record of administration).

Other recipients: for a blood test, the sample is sent with the details needed for the analysis to Labor Doz. DDr. Stefan Mustafa, Gruppenpraxis Greiner & Partner, Fachärzte für med. und chem. Labordiagnostik OG, Ziehrerplatz 9, 1030 Vienna, which carries out the analysis as an independent controller. We do not send any data to your private insurance – you receive the invoice from us and submit it yourself.

Retention: nursing and medical records must be kept for at least 10 years by law (§ 5 GuKG, § 51 ÄrzteG); billing records for 7 years (§ 132 BAO).

12. Recipients and transfers outside the EU

Your data is only received by: our staff, where they deal with your request or treatment; our hosting provider as processor (section 3); Dr. Gerhard Niemeck and the commissioned laboratory (section 11); our tax advisers as part of the accounting; and – only with your consent – Google for Google Analytics. Beyond that, we only pass on data where we are legally obliged to do so.

Transfers outside the EU: only if you consent to Google Analytics can usage data be transferred to Google LLC in the USA, on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified. The website and email – and therefore your form requests – are operated by our hosting provider in Switzerland (section 3), which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). All other data – in particular treatment data – is processed within the EU.

13. Retention periods

14. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR) to the data we process,
• Rectification (Art. 16) of inaccurate data,
• Erasure (Art. 17), unless statutory retention obligations apply,
• Restriction of processing (Art. 18),
• Data portability (Art. 20),
• Objection (Art. 21) to processing based on legitimate interests (see below),
• Withdrawal of consent (Art. 7(3)) at any time with effect for the future – this does not affect the lawfulness of processing up to that point. The easiest way to withdraw your consent to Google Analytics is via Cookie settings.

Simply contact us at office@dripstro.at or by post at the address above. If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the supervisory authority:

15. Data security

This website is delivered exclusively over an encrypted HTTPS connection (TLS); the form is also transmitted in encrypted form. We take technical and organisational measures to protect your data against loss, misuse and unauthorised access and adapt them to the state of the art. As the website runs as a static site without a database or content management system, its attack surface is also considerably smaller than that of conventional websites.

16. Changes

We update this privacy policy when our services, the tools we use or the legal situation change. The version published here applies. If you have any questions about data protection, please contact us at office@dripstro.at.