Privacy policy

This privacy policy explains which personal data are processed when you visit the website www.ortho-hart.at and when you contact our practice, for what purposes and on what legal basis this happens, and what rights you have. It applies to all language versions of the website (German, Czech, English and Russian).

1. Controller

Univ.Prof. Dr.med.univ. Radek HART, Ph.D., FRCS, MHA

Wahlarzt (private physician) for orthopaedics and orthopaedic surgery

Lazarettgasse 25, 1090 Vienna, Austria

E-mail: radekhart23@gmail.com

Please use these contact details for any questions about data protection and to exercise your rights. The website is implemented and maintained on our behalf by DAM Webdesign.

2. Overview

• When you open the website, our server processes the connection data that are technically necessary (section 3).
• Every page loads fonts from Adobe Fonts (section 5) and starts Google Tag Manager. Even without your consent, the Google tag sends measurement data without cookies to Google (section 6).
• Cookies and similar technologies for statistics (Google Analytics), marketing (Google Ads, Meta pixel) the Google Maps maps on the contact pages and the YouTube video on the CV pages are only used with your consent (sections 4 and 7 to 10).
• Without prior consent, only the booking services are loaded: the Calendly booking calendar on the Vienna online booking pages (section 11; it sets its own cookies) and, on the Czech-language booking pages, the Zeeg calendar and the Tally request form (section 12).
• If you call or write to us, we process your details to answer your request and to arrange an appointment (section 13).

3. Hosting and security

The website runs on a server of Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The server is located in a data centre in Frankfurt am Main (Germany). Hostinger and DAM Webdesign process the data only on our behalf (processing under Art. 28 GDPR).

So that your browser can display the pages, the server processes, with every request, your IP address, the address requested, the date and time and the information your browser sends along (e.g. browser type, language, referring page). The web server keeps no access log (no log files of individual page views). Only if a server error occurs while a request is handled is it recorded in the server's system log together with the IP address, the address requested and browser details. This log is deleted automatically after 7 days at the latest.

The connection to the website is encrypted with TLS (HTTPS); unencrypted requests are redirected to the encrypted address.

The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

4. Cookies, consent banner and your choice

Cookies and similar technologies (e.g. your browser's local storage) store information on your device or read it from there. Under Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) this is only permitted with your consent, unless it is strictly necessary for a service you have explicitly requested.

On your first visit the website shows a consent banner. You can choose "Necessary only", "Accept all" or select individual categories under "Settings":

• Necessary (always active): storing your choice.
• Statistics: Google Analytics with cookies (section 7).
• Marketing: Google Ads and the Meta pixel (section 8).
• External media: Google Maps maps on the contact and practice pages (section 9) and the YouTube video on the CV pages (section 10).

Your choice is stored in your browser's local storage under the name dam_cc (selected categories, version and time of the choice). This information stays on your device, is not transmitted to us and remains stored until you delete it. Storing it is strictly necessary so that the website can respect your decision (Section 165(3) TKG 2021; Art. 6(1)(c) and (f) GDPR).

The website uses Google's consent mode. As long as you have not given consent, storage for statistics and advertising and the use of your data for advertising at Google are set to "denied"; Google Analytics and Google Ads then set no cookies (for the measurement signals without cookies see section 6).

Changing or withdrawing your consent: you can withdraw your consent at any time with effect for the future. To do so, click the “Cookie settings” button (the icon at the bottom left of every page) and change your choice. Cookies that have already been set (e.g. by Google Analytics) are removed the same way. Withdrawal does not affect the lawfulness of processing carried out before it.

In addition, the website sets the cookie wp-wpml_current_language. It contains only the code of the selected language (de, cs, en or ru), is a remnant of the website's former technical basis, is not evaluated and is deleted when you close your browser.

5. Fonts (Adobe Fonts)

To display the text, every page loads fonts of the Adobe Fonts service from Adobe's servers (use.typekit.net). Your browser thereby sends your IP address, browser details and the address of the page you are viewing to Adobe. Adobe also counts the page views for the font licence (p.typekit.net). No cookies are set. The fonts are loaded without consent because they are used for a consistent appearance of the website (legitimate interest, Art. 6(1)(f) GDPR).

The provider is Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. Data may be transferred to Adobe Inc. in the USA; Adobe Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). More information: https://www.adobe.com/privacy.html.

6. Google Tag Manager and measurement without cookies

Every page loads Google Tag Manager (container GTM-T8ZMC7QH). It is a tool that controls the other Google and Meta services on this website and takes your choice in the consent banner into account. When it loads, Google receives your IP address and browser details. Tag Manager itself sets no cookies.

Even if you have not given consent or have chosen "Necessary only", the Google tag sends measurement signals without cookies to Google Analytics and Google Ads with every page view. They contain the address and title of the page viewed, the referring page, the time, technical details of browser and device, the event measured (e.g. page view, scrolling, viewing the contact or booking page) and a random identifier that is created anew with each page view and not stored. Your IP address is technically transmitted to Google in the process. According to Google, these signals are used to estimate visitor numbers and advertising results statistically; the data are marked as "without consent" and are not used for personalised advertising.

The legal basis is our legitimate interest in measuring reach without cookies (Art. 6(1)(f) GDPR). You can object to this processing at any time (section 15).

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

7. Google Analytics (only with consent to "Statistics")

With your consent we use Google Analytics 4 (measurement ID G-79WEG7RXW7) to understand how the website is used. For this, the cookies _ga and _ga_79WEG7RXW7 with a random identifier are set (storage period up to 2 years). In particular, the following are recorded: pages viewed, time spent, scroll depth, where the visit came from, approximate location (derived from the IP address), device, browser, language and these events: viewing the contact page, viewing the booking pages for first and follow-up consultations, viewing the confirmation pages after a booking, completed bookings in the Calendly calendar, clicks on the online calendar of HR Clinic in Znojmo (Zeeg) and clicks on phone numbers and e-mail addresses. Names, e-mail addresses and phone numbers in page addresses are removed by the website before Google Tag Manager starts; Google Analytics also deletes such details before storing data. According to Google, Google Analytics 4 does not store IP addresses.

Event data are deleted in Google Analytics after 2 months, user-level data (including conversions) after 14 months without new activity; aggregated reports without reference to individual visitors are kept. Google Signals is switched off. Google processes the data as our processor (Google Ads Data Processing Terms). The Analytics data are linked to the Google Ads account of HR Clinic s.r.o., Kotkova 3974/9c, 669 02 Znojmo (Czech Republic), through which ads for our practice are run; they are only used for advertising if you have also consented to "Marketing" (section 8).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). Provider and third-country transfer: as in section 6.

8. Google Ads and Meta pixel (only with consent to "Marketing")

Google Ads

With your consent we use Google Ads to measure whether visits and appointment bookings result from our ads on Google (conversion measurement), and Google may add visitors of this website to audience lists in order to show them ads for our practice later (remarketing). For this, the cookie _gcl_au (90 days) and the entry _gcl_ls in local storage are set; if you arrive via a Google ad, additionally _gcl_aw with the click identifier (90 days). The pages viewed, the events listed in section 7, the identifiers in these cookies and device and browser details are processed. Google is an independent controller for Google Ads (Google Ads Controller-Controller Data Protection Terms). Provider and third-country transfer: as in section 6.

Meta pixel

With your consent we use the Meta pixel (ID 1644187146080070) of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the effect of ads on Facebook and Instagram and to show ads to people who have visited our website. Page views, viewing the contact page, the booking pages and the confirmation pages after a booking, and clicks on phone numbers are transmitted, each with the page address, time, IP address and browser details. For this, Meta sets the cookie _fbp (90 days); if you arrive via a Meta ad, additionally _fbc. Meta may link these data to your Facebook or Instagram account.

We are joint controllers with Meta for collecting these data and transmitting them to Meta (Art. 26 GDPR); the essence of this arrangement is available at https://www.facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing. Data may be transferred to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Information from Meta: https://www.facebook.com/privacy/policy/.

The legal basis for Google Ads and the Meta pixel is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021).

9. Google Maps

On the contact and practice pages we show the location of the practices in Vienna and Znojmo with Google Maps. The map is only loaded once you have consented to "External media" or clicked "Yes, I agree" in the map area. Your browser then sends your IP address, browser details and the address of the page to Google; Google also loads its own fonts. In our test the map set no cookies; Google may, however, use its own cookies, in particular if you are signed in to Google. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). Google is itself responsible for this processing. Provider and third-country transfer: as in section 6. Information from Google: https://policies.google.com/privacy.

10. YouTube video on the CV pages

A YouTube video is embedded on the CV pages (in all four languages). It is only loaded once you have consented to “External media” or clicked the button in the video area, in YouTube's privacy-enhanced mode via youtube-nocookie.com. Your browser then sends your IP address, browser details and the address of the page to YouTube; when the video is played, YouTube may set its own cookies and entries in local storage. The provider is Google Ireland Limited (see section 6), which is itself responsible for this processing. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian TKG 2021). Other videos on the website are stored on our own server and transmit no data to third parties.

11. Online booking via Calendly (practice in Vienna)

You can book first and follow-up consultations in Vienna online. The booking calendar is provided by Calendly LLC, 115 E. Main Street, Suite A1B, Buford, GA 30518, USA. It is loaded on the booking pages as soon as the page opens, so that you can see and book free appointments.

Already when the calendar loads, Calendly receives your IP address, browser details and the address of the page. Calendly sets its own cookies and storage entries (in our test, among others, OptanonConsent for 1 year, __cf_bm for 30 minutes and _cfuvid until the end of the browser session) and includes services that Calendly itself uses for operation and security (among others Cloudflare, OneTrust, Stripe and Google reCAPTCHA; Stripe sets the cookie m).

When you book an appointment, Calendly processes your first and last name, your e-mail address, the appointment chosen and, if you want an SMS reminder, your mobile number. You receive a confirmation by e-mail. Calendly processes these data on our behalf (Art. 28 GDPR). Data are transferred to Calendly in the USA; Calendly LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Information from Calendly: https://calendly.com/legal/privacy-notice.

After the booking, Calendly forwards you to our confirmation page. Personal details that Calendly appends to the address of the confirmation page are removed by the website before any measurement or advertising service is loaded.

The legal basis for loading the calendar is our legitimate interest in a working online booking (Art. 6(1)(f) GDPR); the cookies needed for it are necessary for the booking service you have opened (Section 165(3) TKG 2021). The legal basis for the booking itself is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); insofar as the booking shows that you are seeking medical treatment, additionally Art. 9(2)(h) GDPR. The booking data remain stored in our Calendly account for as long as they are needed to manage appointments.

12. Appointments in Znojmo (HR Clinic)

On the Czech-language pages, you can book an appointment online with HR Clinic s.r.o., Kotkova 3974/9c, 669 02 Znojmo, Czech Republic. The booking calendar of the Zeeg service (zeeg.me) is embedded directly in the booking pages and loads when the page opens; Zeeg then receives your IP address, browser details and the address of the page. The details you enter when booking are received by HR Clinic s.r.o. HR Clinic s.r.o. is responsible for bookings in Znojmo; its own privacy policy applies.

For appointment requests in Znojmo, the form of the Tally service (Tally BV, Belgium) may also be embedded. The details entered there are processed by HR Clinic s.r.o. to handle your request; HR Clinic's own privacy notice applies.

So that technical drop-outs can be detected, Tally may also store entries that have not been sent yet as an incomplete request.

To detect technical problems in the request form, we count, per practice and day, views of pages with a Tally form, forms displayed, moves to a further form page and submissions. We store only aggregated daily counts, no IP addresses, visitor identifiers or form answers. This count sets no cookies and stores nothing in the browser. It is separate from Tally's processing of your entries.

13. Contact by phone and e-mail

If you call us or write an e-mail, we process your contact details and the content of your message in order to answer your request and arrange an appointment. We process health data only insofar as they are needed for the appointment and treatment. The legal bases are Art. 6(1)(b) GDPR (preparing and performing the treatment contract) and, for health data, Art. 9(2)(h) GDPR (health care under medical confidentiality); where you send us health data on your own initiative before a treatment relationship exists, this is based on your explicit consent (Art. 9(2)(a) GDPR).

Our e-mail mailbox is hosted on Google's Gmail service; e-mails to us are therefore stored on Google's servers, including outside the EU, for example in the USA (for the certification of Google LLC see section 6). Please only send medical reports or other sensitive documents if you accept this channel; otherwise bring them to your appointment.

Enquiries that do not lead to treatment are deleted once they have been dealt with and no statutory retention obligation applies. Information that becomes part of the medical records is kept for at least 10 years in accordance with Section 51 of the Austrian Physicians Act 1998 (Ärztegesetz 1998).

14. Links to other websites

The website contains links to other services, e.g. to our Facebook page, to the doctor profile on Prelomed, to Wiener Privatklinik, to Google Maps and to scientific publications. These contents are not embedded in our pages; data are only transmitted when you click a link, and the operator of the linked site is responsible for it.

15. Your rights

Under the GDPR you have the right to

• access the data processed about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21),
• withdraw consent you have given, with effect for the future (Art. 7(3)); section 4 explains how to do this on this website.

Please use the contact details in section 1. Statutory retention obligations, in particular for medical records, may prevent erasure.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority (Art. 77 GDPR). In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, phone +43 1 52 152-0, e-mail dsb@dsb.gv.at, www.dsb.gv.at. You may also contact the supervisory authority of the EU member state in which you live.

16. No automated decision-making

We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR).

17. Obligation to provide data

You are not obliged to provide us with personal data. Without your name and contact details, however, we cannot arrange an appointment.

As of: October 2026