international@lipocura.de
Thank you for your interest in our website. Protecting your personal data is very important to us. Below you will find information about how we handle the data collected when you visit our website and when we provide our services to you. Your data will be processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
The following information provides a simple overview of what happens to your personal data when you visit this website or use our services. Personal data is any data that can be used to personally identify you. Detailed information on data protection can be found in the sections below.
Data processing is carried out by Auxeum UK Ltd. Our contact details can be found in Section 1 below.
Your data is collected in two ways. Firstly, you provide it to us directly (for example, when you complete a contact form or book an appointment). Secondly, some data is collected automatically by our IT systems when you visit our website (for example, your IP address and browser type).
Some data is collected to ensure our website functions correctly. Other data is used to provide you with medical services, to analyse how visitors use our website, and to improve our services.
You have the right to obtain information free of charge at any time regarding the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of your data. You can contact us at any time regarding these and other questions concerning data protection. Further details about your rights can be found in Section 9 below.
We use multiple layers of security to protect your Personal Data including:
Technical safeguards
Operational security
Physical security
AUXEUM UK LTD (Company Number: 17013009) 170 Edmund Street, Birmingham, England, B3 2HB Email: privacy@lipocura.co.uk
You can reach the Data Protection Officer at:
Katherine Williams | Data Protection Officer 170 Edmund Street, Birmingham, England, B3 2HB E-mail: akreaconsultancy@outlook.com
When contacting the Data Protection Officer, please specify the company to which your request relates. Please do not include sensitive information, such as a copy of an ID, with your request.
Description of the data processing and its purpose
When you visit our website, it is necessary for data to be exchanged between your internet browser and our server to enable communication. During an active connection between the internet browser and the web server, the following data is regularly collected:
The purpose of data processing, and our legitimate interest in doing so, is to ensure a stable connection between your browser and our website, the technically error-free operation of our services, and to identify, prevent, and detect attacks on our website. The log files are used to evaluate the stability, functionality, and security of the system.
The processing of this data is absolutely necessary to technically provide you with our website.
Legal basis for data processing
The legal basis for the processing of personal data is Article 6(1)(f) of the UK GDPR.
Recipients
In the context of data processing, your data may be passed on to the following categories of recipients, whom we engage to achieve the purposes mentioned above:
Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
In exceptional cases, for example in the event of security incidents or attacks, data may also be passed on to:
Data processing in third countries
No data processing takes place in third countries.
Retention period
For technical reasons, particularly to prevent attacks on our web server, this data is temporarily stored. After seven days at the latest, the data is anonymized by truncating the IP address at the domain level, so that it is no longer possible to connect it to an individual user.
In exceptional cases, such as (attempted) attacks, data may be retained for longer – namely as long as is necessary for the investigation, legal proceedings or the initiation of legal claims.
Anonymized log data may be stored and processed for longer periods for statistical purposes if necessary.
When you visit our website, information (e.g. your IP address) may be accessed or information may be stored (e.g. cookies) on your terminal device.
This access or storage may involve further processing of personal data within the meaning of the UK GDPR.
If this access to or storage of information is strictly necessary for the technically error-free provision of our services, this takes place on the basis of Article 6(1)(f) of the UK GDPR.
If the processing serves other purposes (e.g. personalizing our website), this is done on the basis of Article 6(1)(a) of the UK GDPR.
You can withdraw your consent for this at any time with future effect.
Any subsequent processing of personal data will also be in accordance with the UK GDPR. This processing is explained separately in our privacy statement.
More information about the processing of your personal data and the associated legal bases can be found in the following sections regarding the specific processing activities on our website.
On this website, we use services that use cookies and similar technologies to store data in your device’s browser and to retrieve previously stored data. Cookies, local storage, pixels, and so-called tags may be used for this purpose.
Cookies are small text files that are placed on your terminal device and can be read.
A distinction is made between session cookies, which are automatically deleted when you close your browser, and persistent cookies, which remain on your device for a certain period of time.
In addition to cookies, we also use your browser’s session storage or local storage, if necessary, to store and read data.
We also sometimes integrate pixels into our websites. Pixels are small, invisible image files that are loaded when a page is opened and can be used to track user activity.
We may also use so-called tags. Tags are small HTML or JavaScript fragments that allow website analytics or user tracking services to distinguish or identify users and track certain user interactions.
You can find more information about the cookies and similar technologies we use below in the descriptions of the various cookie categories and in our consent management platform, which becomes visible when you visit our website. You can give and withdraw your consent via this platform at any time.
You can reopen the platform via the ‘Cookie Settings’ link at the bottom of the website to change your preferences.
Please note that certain parts of our websites may not function correctly if you refuse the use of necessary cookies and similar technologies.
On our websites we use the consent management platform “Usercentrics” from Usercentrics GmbH Sendlinger Straße 7 80331 Munich Germany.
We use this service to manage your consent to the use of cookies and similar technologies, as well as the associated data processing.
When you give consent via the banner of our consent management platform, the following data will be processed by the services:
This data is recorded on the provider’s servers. Cookies are used to store your consent status on your device, allowing it to be read and compared on your next visit.
This way we can check your consent status on future visits to our websites and, depending on your choice, activate or deactivate cookies and similar technologies.
The purpose of this data processing, and our legitimate interest in it, is to centrally manage the cookies, similar technologies, and services integrated on our website. We also want to offer you a simple way to give and withdraw your consent, so that we can comply with our legal obligations to obtain consent and with our accountability obligations under Article 5(2) of the UK GDPR.
To the extent that cookies and similar technologies are used within the framework of this service, or data is stored on or read from your terminal device, this is done on the basis of Article 6(1)(f) of the UK GDPR.
As part of data processing, your data will be passed on to the following recipients: Usercentrics GmbH Sendlinger Straße 7, 80331 Munich, Germany
By integrating the service into our websites, data is transferred to the aforementioned recipient and processed there for as long as is necessary to achieve the stated purposes.
We generally do not store the data processed and made available by this service in our own systems. In individual cases, data cannot, in principle, be stored in our own systems. In individual cases, data regarding the time, status, and content of consent given may be retained for a longer period, if necessary for other purposes as stated in this privacy statement.
On our websites, we use the “Google Tag Manager” service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. Within the UK, the service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
“Google Tag Manager” is a tag management system (Tag Management System; TMS) that allows us to integrate and manage additional website content via JavaScript or HTML code.
This service allows us to place and manage tags on our website. Tags are small pieces of code (such as web beacons, tracking pixels, or similar markers) that allow website analytics or user registration services to distinguish or identify users.
Google Tag Manager does not perform any analysis itself and does not track users. The service is used solely to manage the tags of other tools, such as Google Analytics or similar third-party services.
Because Google Tag Manager is offered by Google and is retrieved from Google’s servers when the page is loaded, technical usage data, including your IP address, is transmitted to Google. This is technically necessary for retrieving the content.
The purpose of this data processing, and our legitimate interest in it, is to easily and efficiently integrate and manage additional services and content on our websites.
The legal basis for using this service is your consent, insofar as you have given it via our consent management platform.
The use of cookies and similar technologies is based on Article 6(1)(a) the UK GDPR. Subsequent processing of personal data is also based on Article 6(1)(a), of the UK GDPR.
Your consent is voluntary and can be withdrawn at any time with effect for the future.
To do this, use the “Cookie settings” link at the bottom of the website to reopen the consent management platform and adjust your preferences.
In the context of the use of this service, the data collected via our websites will be passed on to the following recipients:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
Google LLC, 1600 Amphitheater Parkway, Mountain View, California 94043, USA.
More information about how Google handles personal data can be found at https://policies.google.com/privacy?hl=nl
Your data may be transferred to recipients in third countries, such as the United States. For transfers to the US, the UK-US Data Bridge applies to organisations certified under the UK Extension to the EU-US Data Privacy Framework. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework.
You can find more information about this in the section “General information on data transfers to third countries” above.
The data collected and transmitted through this service will be retained only for as long as necessary to achieve the stated purposes.
We do not store the data processed and made available to us through this service separately in our own systems.
On our websites we use the service “Google Analytics” of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.
Within the UK, the service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
“Google Analytics” uses pseudonymous usage profiles based on identification features such as cookie and device IDs and other data from your end device (e.g. browser fingerprint).
In addition, the service processes usage data, such as the name and address of the requested web page, referring links, the browser and operating system used, and the IP address of the requesting device.
Further processing can be done:
All this data is recorded and analysed. This processing allows Google to pseudonymously recognize website visitors and their devices and assign them to specific demographic segments or target groups.
Users with a Google account can be identified by Google as the same visitor to our websites if they are logged in on multiple devices.
Our websites use cookies and similar technologies (particularly JavaScript) to store and read data on your device.
More detailed information can be found above under “Data processing in connection with cookies and similar technologies”.
Based on the collected data, Google compiles summary statistics for our use.
These statistics provide insight into what our website visitors are interested in and how they interact with our websites.
We only receive aggregated data from Google – that is, data from which no individual person can be identified.
We use these insights to conduct targeted online advertisements and marketing campaigns within advertising networks, in particular through Google’s advertising services.
The purpose of data processing is to analyse the origin, preferences and interests of our visitors, so that we can optimize our online advertising and content and display advertisements in a targeted manner.
The legal basis for using this service is your consent, provided you have opted in via our consent management platform.
The use of cookies and similar technologies is based on Article 6(1)(a) of the UK GDPR.
Further processing of personal data is also carried out on the basis of Article 6(1)(a) of the UK GDPR.
You can do this via the “Cookie Settings” link at the bottom of the website, which will reopen the consent management platform and change your preferences.
You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout
IP anonymisation
We have activated the IP anonymisation function for Google Analytics on this website. This means that your IP address will be shortened by Google within the United Kingdom or in other countries with adequate data protection before being transmitted to the United States. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
Data retention by Google
Data stored by Google at the user and event level, which is associated with cookies, user identifiers, or advertising IDs, is anonymised or deleted after 14 months. Further details can be found in Google’s documentation on data retention.
As part of the service, the collected data will be passed on to:
More information about how Google handles personal data can be found at https://policies.google.com/privacy?hl=en
Additional information and links can be found in the section “General information on data transfers to third countries” above.
Data collected and transmitted through the service will be retained for as long as necessary to achieve the stated purposes. The data processed by Google and made available to us is generally not stored on our own systems.
On our websites we use the “YouTube” service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.
Within the UK, this service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
This service allows us to integrate videos we have posted on YouTube directly into our website. When you visit a page with an embedded video, the video and its preview are loaded by your browser and temporarily stored in your device’s cache.
Since these videos and previews are provided by Google via the “YouTube” and “YouTube Images” services, technical usage data is sent to Google when the page loads. This includes your IP address, which is necessary to correctly display the content.
By serving videos through Google’s servers, we can guarantee fast video playback without placing additional load on our own web servers. This contributes to improved loading times and user experience.
The integration uses cookies and similar technologies (such as JavaScript) to store or read data on your device.
More information about this can be found under the section: “Data processing in connection with cookies and similar technologies”.
The purpose of this data processing is to make our website visually appealing, technically efficient and resource-efficient.
The legal basis for using this service is your consent, provided you have given it through our consent management platform.
The use of cookies and similar technologies is based on Article 6(1)(a) of the UK GDPR. Subsequent data processing is also based on Article 6(1)(a), of the UK GDPR.
Your consent is voluntary and can be revoked at any time with future effect. To do so, click the “Cookie Settings” link at the bottom of the website to reopen the consent management platform and adjust your preferences.
In the context of the use of YouTube, the collected data will be passed on to the following recipients:
Your data may be transferred to recipients in third countries, such as the United States. For transfers to the US, the UK-US Data Bridge applies to organisations certified under the UK Extension to the EU-US Data Privacy Framework. Google LLC is certified under the UK Extension to the EU-US Data Privacy
You will find additional information about this in the section “General information about data transfers to third countries” above.
By integrating this service, data is sent to the aforementioned recipients and processed there for as long as necessary for the stated purposes. The data processed by the service is not stored separately by us in our own systems.
On our websites we use the Matomo service from InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand.
Within the United Kingdom, the provider within the meaning of Article 27 UK GDPR is represented by:
We use this service to statistically record and analyse the number of visitors to our websites.
Matomo enables us to collect and evaluate, among other things, the following data: statistical values (such as pages visited per session, scroll depth, length of stay, origin of visitors, type of end device), heat maps (graphical representation of clicks on our web pages) and session recordings (playable representations of website usage by individual visitors).
This processing uses cookies and similar technologies, in particular JavaScript, to store and read data on your terminal device.
More information about this can be found under “Data processing in connection with cookies and similar technologies” above.
Based on the insights gained, we want to:
This way we can optimize our websites based on user behavior and improve the performance of our marketing efforts.
For the above-mentioned purposes, Matomo processes the following data on the basis of a pseudonym:
In addition, the following data is stored on the terminal device via cookies:
The legal basis for the integration and use of this service is your consent, insofar as you have given it via our consent management platform.
The use of cookies and similar technologies is based on Article 6(1)(a), of the UK GDPR. Subsequent data processing is also based on Article 6(1)(a), of the UK GDPR.
Your consent is voluntary and can be revoked at any time with future effect. To do so, use the “Cookie Settings” link or click the fingerprint icon in the bottom left corner of our website to reopen the consent management platform and adjust your preferences.
IP Anonymisation
We use IP anonymisation for our Matomo analytics. This means your IP address is shortened before analysis, so it can no longer be uniquely associated with you.
The data collected via our websites will be passed on to the following recipients in the context of the use of this service:
InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand.
Baseplus DIGITAL MEDIA GmbH, Stadttor 1, 40219 Düsseldorf, Germany (hosting service provider)
More information about the use of personal data by the service can be found here: https://matomo.org/matomo-cloud-privacy-policy .
When using this service, data may be processed in countries outside the United Kingdom (UK), in particular in New Zealand.
New Zealand is an approved jurisdiction under the UK GDPR, meaning that the UK has determined that an adequate level of data protection is guaranteed in New Zealand.
In addition, to ensure the protection of your data when transferred to third countries where no adequacy decision exists, standard data protection clauses approved by the UK’s Information Commissioner’s Office (ICO) are applied in accordance with Article 46(2)(c) of the UK GDPR.
If these provisions prove insufficient, additional technical, organisational, or contractual measures will be implemented. We regularly review the adequacy of these measures and adapt them as needed.
Through the integration of the service, data is transferred to the aforementioned recipients and processed there for as long as necessary to achieve the stated purposes. The data processed by the service is not permanently stored in our own systems.
This website uses Clarity. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, https://docs.microsoft.com/en-us/clarity/ (hereinafter “Clarity”).
Clarity is a tool for analyzing user behavior on this website. Specifically, Clarity records mouse movements and creates a graphical representation of which parts of the website users scroll to most frequently (heatmaps). Clarity can also record sessions, allowing us to view page usage in the form of videos. Furthermore, we receive information about general user behavior within our website.
Clarity uses technologies that enable the recognition of the user for the purpose of analyzing user behavior (e.g., cookies or the use of device fingerprinting). Your personal data will be stored on Microsoft servers (Microsoft Azure Cloud Service) in the USA.
If consent has been obtained, the aforementioned service is used exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 TDDDG. Consent can be revoked at any time. If no consent has been obtained, this service is used on the basis of Art. 6 para. 1 lit. f GDPR; the website operator has a legitimate interest in effective user analysis.
Further details on Clarity’s data protection can be found here: https://docs.microsoft.com/en-us/clarity/faq.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA designed to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF commits to complying with these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/6474.
Data Processing Agreement
We have entered into a Data Processing Agreement (DPA) for the use of the aforementioned service. This is a contract required by data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
To protect our website from unauthorised access and cyberattacks, AUXEUM UK LTD uses the “All-In-One Security (AIOS) – Security and Firewall” plugin. This service is provided by Updraft WP Software Ltd., Tramshed Tech Old Station Building, Queensway, Newport, Wales, NP20 4AX (Company Number: 8570611, VAT Number: 202 1260 80).
Description of data processing and purpose
When using AIOS, your IP address is collected to protect the website from unauthorised access and attacks. The data is stored on our own web server. No data is transferred to the provider of AIOS or to any other third parties.
Processing is based on Article 6(1)(f) of the UK GDPR. This concerns the legitimate interest of AUXEUM UK LTD in ensuring the website is available securely and without interruption.
Recipient
No data is transferred to Updraft WP Software Ltd. or any other third parties. All data is stored locally on our own web server.
The data collected via AIOS will be processed only for as long as necessary for the purposes stated above.
On our website we use the service “Chatling No-Code AI Chatbot” (“Chatling”) from Envision Labs Inc., A4-9131 Keele St, Vaughan, ON, Canada, L4K 0G7.
We use Chatling to provide an automated communication option on our website, to support you with enquiries and to improve your user experience. When you use the chatbot, we process the content of your chat communications as well as technical usage data (such as your IP address and the time of your interaction).
The content of your chat communications is based on the information you choose to enter. Please be aware that if you provide health information or other sensitive personal data through the chatbot, this will be processed by us and by Envision Labs Inc. We recommend that you do not share sensitive personal information through the chatbot unless necessary for your enquiry.
Your data is not used to train the AI application.
This website integrates features of the Instagram service. These features are offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
If you are logged into your Instagram account whilst visiting our website, you can link the content of this website to your Instagram profile by clicking the Instagram button or interacting with Instagram features. This allows Instagram to associate your visit to this website with your user account.
We use Instagram features to increase the visibility of our services on social media and to allow you to share our content easily.
The legal basis for using this service is your consent, provided you have given it through our consent management platform or by interacting with Instagram features. The use of Instagram features is based on Article 6(1)(a) of the UK GDPR. Your consent is voluntary and can be withdrawn at any time with future effect.
To the extent that personal data is collected on our website using Instagram features and forwarded to Meta, we and Meta Platforms Ireland Limited are jointly responsible for this data processing. You can assert your data subject rights regarding data processed by Instagram directly with Meta.
Your data may be transferred to Meta Platforms, Inc. in the United States. For transfers to the US, the UK-US Data Bridge applies to organisations certified under the UK Extension to the EU-US Data Privacy Framework.
Further information can be found in Instagram’s privacy policy: https://instagram.com/about/legal/privacy/
Data processed through Instagram features is not stored separately by us in our own systems.
The legal basis for using this service is your consent, provided you have given it through our consent management platform or by initiating a chat with the chatbot. The use of the chatbot and any processing of personal data (including special categories of personal data such as health data) is based on Article 6(1)(a) and, where special categories of data are concerned, Article 9(2)(a) of the UK GDPR.
Your consent is voluntary and can be withdrawn at any time with future effect by contacting us using the details set out under “Controller” above. If you withdraw your consent, we will cease processing your data through the chatbot, although this will not affect the lawfulness of any processing carried out before your withdrawal.
As part of the use of this service, your data will be transferred to:
Envision Labs Inc., A4-9131 Keele St, Vaughan, ON, Canada, L4K 0G7.
We have entered into a data processing agreement with Envision Labs Inc., which ensures that your data is processed only in accordance with our instructions and that appropriate security measures are in place.
Further information on data processing by Chatling can be found in their privacy policy: https://www.chatling.ai/privacy-policy
Your data will be transferred to Envision Labs Inc. in Canada. Canada is an approved jurisdiction under the UK GDPR, meaning that the UK has determined that an adequate level of data protection is guaranteed in Canada.
Chat data will be stored for a maximum of 30 days and then deleted, unless we are required to retain it for longer to comply with a legal obligation or to respond to your enquiry.
On our website and in connection with our services, we use “WhatsApp Business”, a service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
We use WhatsApp Business to communicate with patients and prospective patients for the purposes of sending appointment reminders and confirmations, and for general communication in connection with the provision of our medical services.
In connection with this service, we process the following data:
Please note that the content of messages sent via WhatsApp Business (including message content and any attached images) is protected by end-to-end encryption. This means that the content of your messages cannot be accessed by WhatsApp Ireland Limited or any other third party. You should always use an up-to-date version of WhatsApp with encryption enabled to ensure that message content remains encrypted.
Please also be aware that, whilst the content of messages is encrypted, WhatsApp Ireland Limited is able to access metadata relating to your communications with us. This includes information about the fact and timing of your communications with us, as well as technical information about the device you are using and, depending on your device settings, location information.
For your security, we reserve the right not to respond to enquiries received via WhatsApp Business where the subject matter requires special confidentiality or where a response via WhatsApp would not meet applicable formal requirements. In such cases, we will direct you to a more appropriate communication channel.
The use of WhatsApp Business and the associated processing of your personal data is based on your explicit consent, in accordance with Article 6(1)(a) of the UK GDPR. Where health data or other special categories of personal data are processed, the legal basis is Article 9(2)(a) of the UK GDPR.
Your consent is voluntary and can be withdrawn at any time with future effect, without giving reasons and without any disadvantage to you. To withdraw your consent, please contact us using the details set out under “Controller” above. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to the withdrawal.
Upon withdrawal of your consent, you may also request the deletion of any data collected in connection with your use of WhatsApp Business, provided that deletion does not conflict with any applicable legal or regulatory retention obligations.
WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
We have entered into a data processing agreement with WhatsApp Ireland Limited, which obliges them to protect your data and not to disclose it to third parties.
Further information about WhatsApp’s terms of service and data protection practices can be found at:
https://www.whatsapp.com/legal/
https://www.whatsapp.com/privacy
https://www.whatsapp.com/legal/business-data-processing-terms
Where the UK-US Data Bridge does not apply or does not provide sufficient protection, we ensure that appropriate safeguards are in place in accordance with Article 46 of the UK GDPR, including the use of the International Data Transfer Agreement (IDTA) or the Addendum to the EU Standard Contractual Clauses, as approved by the UK’s Information Commissioner’s Office (ICO). If these provisions prove insufficient, additional technical, organisational, or contractual measures will be implemented.
Further information can be found in the section “General information on data transfers to third countries” above.
Your data will be retained for as long as is necessary to achieve the purposes described above, or until you withdraw your consent. Upon withdrawal of consent, your data will be deleted unless we are required to retain it for longer to comply with a legal or regulatory obligation.
In providing our medical services, including diagnostic consultations, liposuction surgery, plasma tightening and post-operative care, we collect and process personal data and special categories of personal data about our patients. Special categories of personal data include health data, which attracts a higher level of protection under the UK GDPR.
The personal data we collect from patients includes:
We collect this data for the following purposes:
The processing of your personal data is based on Article 6(1)(b) of the UK GDPR (performance of a contract) and, where applicable, Article 6(1)(c) of the UK GDPR (compliance with a legal obligation).
The processing of special categories of personal data (including health data) is based on Article 9(2)(h) of the UK GDPR, as it is necessary for the purposes of medical diagnosis and the provision of health care and treatment, carried out by or under the responsibility of a medical professional.
Where we collect photographs or images of you for the purposes of your treatment, we will obtain your explicit consent in accordance with Article 9(2)(a) of the UK GDPR prior to collecting such data.
Your personal data will be shared only with authorised clinical and administrative staff involved in your care. We use the following third-party platforms to manage patient data:
Nelly Solutions GmbH, Chausseestraße 29, 10115 Berlin, Germany – patient management and payment processing;
Microsoft Corporation (Microsoft 365 and Microsoft Teams) – for internal communications and, where applicable, remote consultations; and
WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland – for patient communications, including appointment reminders and confirmations, where you have provided your consent to be contacted via WhatsApp Business.
Your data will not be shared with any other third parties without your explicit consent, except where required by law.
Where any of the above third-party providers transfer your data outside the United Kingdom, we will ensure that appropriate safeguards are in place in accordance with the UK GDPR, including the use of the International Data Transfer Agreement (IDTA) or the Addendum to the EU Standard Contractual Clauses as approved by the ICO, or by transferring to an approved jurisdiction.
We will retain your patient data for as long as is necessary for the purposes for which it was collected, and in accordance with any applicable legal or regulatory retention obligations. Medical records are typically retained for a minimum of 10 years.
With your explicit prior consent, we may use photographs or images taken during your treatment (including before and after photographs) for marketing purposes, including on our website and social media platforms.
The processing of your images for marketing purposes is based solely on your explicit consent, in accordance with Article 6(1)(a) and Article 9(2)(a) of the UK GDPR. You are under no obligation to provide this consent, and it will not affect the provision of our medical services to you.
You may withdraw your consent at any time by contacting us using the details set out under “Controller” above. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to the withdrawal.
Images used for social media purposes may be shared on our social media platforms, including Instagram, Facebook, TikTok, and YouTube.
Images used for marketing purposes will be retained for as long as your consent remains in place. Upon withdrawal of consent, we will remove your images from our marketing materials as soon as reasonably practicable.
When you contact us via the contact form or otherwise, we process the contact information you provide (such as your email address and phone number), as well as the content of your message, including any personal data. This processing is carried out to process your request and answer any follow-up questions. Your data will not be shared with third parties unless you have given your express consent.
Your data will be processed based on our legitimate interest in responding to your request, in accordance with Article 6(1)(f) of the UK GDPR. If your request is aimed at entering into a contract, processing will take place on the basis of Article 6(1)(b) of the UK GDPR.
As part of data processing, your personal data will not be provided to third parties.
Your data will not be passed on to organisations or companies established outside the European Union (EU) or the UK.
Your data will be deleted once your request has been processed, no further correspondence is expected and no legal retention obligation applies.
To simplify appointment scheduling, we offer the option to schedule an appointment with a doctor online using the appointment form on our website.
When you use the online appointment form, we process personal data such as your name, contact details (e.g. email address, telephone number and address), the desired appointment date, any information about the desired treatment and technical data (such as IP address and time stamp).
The processing of this data is used to manage and coordinate appointments and to contact you regarding the medical services you require.
Your information will only be shared with authorised employees of our practice who are responsible for processing and managing your appointment request. Where you have provided your consent to be contacted via WhatsApp Business, we may also use WhatsApp Business to send you appointment reminders and confirmations. Further information about our use of WhatsApp Business can be found in Section 3.10A above.
Your data will be processed based on our legitimate interest in responding to your request, in accordance with Article 6(1)(f) of the UK GDPR, and, where your request is aimed at entering into a contract with us, on the basis of Article 6(1)(b) of the UK GDPR. Where special categories of personal data, such as health data, are concerned, processing will be based on Article 9(2)(h) of the UK GDPR (processing for the purposes of medical diagnosis and the provision of health care and treatment).
Your data will not be provided to third parties unless this is necessary for the execution of the treatment or you have given explicit permission for this.
Your data will not be passed on to organisations or companies outside the European Union (EU) or the UK.
Your data will be deleted once your request has been processed, no further correspondence is expected and no legal retention obligations apply.
You can take a lipedema self-test on our website. This test provides an initial indication of whether you may have lipedema.
Test results are sent to you via email using our email service provider, CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany. CleverReach processes your email address and the content of the test results solely on our instructions and in accordance with the UK GDPR.
When using the self-test, we process personal data such as your name, contact details (e.g. email address, telephone number, address) and your answers to questions regarding physical characteristics and health information.
The processing of this data is intended to generate and send the test results, to process your request and evaluate the data, and, if necessary, to contact you regarding the requested medical services.
Your data will only be processed by authorized employees of AUXEUM UK LTD who are responsible for managing your request and test results.
Your data will be processed based on your explicit consent, in accordance with Article 6(1)(a) of the UK GDPR, in conjunction with Article 9(2)(a) of the UK GDPR, insofar as it concerns special categories of personal data (such as health data). Your consent applies to the processing of data for the purpose of conducting the test, sending the results, and any subsequent contact.
Your data will not be provided to third parties.
Your data will not be transferred to organisations or companies outside the European Union (EU) or the UK.
Your data will be deleted once your request has been fully processed, no further correspondence is expected and no legal retention obligations apply.
We process your personal data (title, first name, last name, business email address for business contacts, private email address for consumers) solely to inform you or your organization in a personalized manner via email or our newsletter about our own products, services, events, offers or those of selected partners.
This will only happen after you have given us explicit permission to do so.
If you consent, you also authorize us to process data about whether you received and opened our marketing emails, which links you clicked, and to what extent you read or viewed the content. This newsletter tracking helps us better tailor the content of our emails to your interests.
Your data will be processed based on your consent in accordance with Article 6(1)(a) of the UK GDPR. Your consent is voluntary and can be revoked at any time with future effect. The lawfulness of processing prior to your revocation remains unaffected. You can revoke your consent via the unsubscribe link in every newsletter or via the contact details listed under “Controller.”
We use an external service provider to send and analyse our newsletter:
CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany
This party processes your data exclusively on our behalf and in accordance with the UK GDPR.
No transfer of personal data takes place to organisations or companies outside the European Union (EU) or UK.
We retain your data for as long as necessary for the aforementioned purpose, or until you withdraw your consent. After you withdraw your consent, your data will be deleted unless another legal basis requires further processing (for example, based on tax or commercial law retention obligations).
We process your personal data to the extent necessary to decide whether to enter into an employment relationship with us.
This concerns data that you provide to us in the context of your application, such as general personal data (name, address, contact details), information about your education and professional qualifications, additional or further training and other data that you provide voluntarily.
If an employment relationship is established, we may further process your data for purposes related to the performance or termination of the employment contract or the exercise of rights and obligations under laws or regulations, collective labor agreements or company regulations.
The processing is based on Article 6(1)(b) of the UK GDPR (implementation of pre-contractual measures at the request of the data subject).
If you have given consent for the processing of certain data (such as inclusion in the talent pool), Article 6(1)(a) of the UK GDPR applies. You can withdraw this consent at any time with future effect.
If you are accepted, Article 6(1)(b) UK GDPR applies to further processing, as do any obligations under Article 9 UK GDPR for special data (such as health data).
Origin of the data
Your data is obtained via the application form (website), application by e-mail or post, job sites or professional networks (e.g. LinkedIn) or via recruitment and selection agencies.
Your data may be shared internally with employees involved in the application process. External service providers: Personio and Circular (application management), MS Office 365, and Praxismanager (data management and communication).
Where any of the above service providers process data on servers located outside the United Kingdom, appropriate safeguards are in place in accordance with the UK GDPR.
Use of artificial intelligence
We make limited use of AI-supported systems when processing job applications, for example for managing job applications or analysing resumes.
You can find more information about this in the general section on “Use of Artificial Intelligence” in this privacy policy.
Your data will be retained for as long as necessary to process the application process. We will generally delete your data no later than six months after the end of the process, unless you have consented to a longer retention period (for example, for inclusion in the talent pool), legal retention obligations apply, or data is required for the establishment, exercise, or defense of legal claims.
If you are employed, application data will be included in your personnel file.
After completing the application process, you may be invited to join our talent pool. If you consent, we will retain your information for future vacancies in accordance with the consent form.
Obligation to provide data
Providing personal data is voluntary. However, please note that we cannot conduct an application process without the necessary information.
The processing of your personal data may take place in countries outside the United Kingdom (UK).
For some countries outside the UK, the UK Government has issued an adequacy regulation, meaning that it has determined that an adequate level of data protection is guaranteed in those countries. A current overview of countries with UK adequacy regulations can be found on the ICO’s website.
Where we transfer personal data to a country for which no adequacy regulation exists, we ensure that appropriate safeguards are in place to protect your data, in accordance with Article 46 of the UK GDPR. The safeguards we use include:
the International Data Transfer Agreement (IDTA), as approved by the UK’s Information Commissioner’s Office (ICO); or the Addendum to the EU Standard Contractual Clauses, as approved by the ICO.
You can request a copy of the transfer mechanisms we use by contacting us using the details set out under “Controller” above.
For transfers to the United States, the UK-US Data Bridge applies to organisations certified under the UK Extension to the EU-US Data Privacy Framework. You can check the certification status of a participating organisation via the Data Privacy Framework website.
More details about international data transfers in specific situations can be found in the relevant sections of this privacy notice.
Below you will find information about the rights you have under applicable data protection law in relation to the controller of your personal data:
The right to request information about your personal data processed by us pursuant to Article 15 of the UK GDPR. In particular, you may request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the right to rectification, erasure, restriction of processing, or objection, the right to lodge a complaint, the source of your data (insofar as it was not collected from us), and the existence of automated decision-making, including profiling, and, if applicable, meaningful information about the details thereof.
The right to request the immediate rectification of incorrect or incomplete personal data stored with us pursuant to Article 16 of the UK GDPR.
The right to request the deletion of your personal data stored by us pursuant to Article 17 of the UK GDPR, provided that the processing is not necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the assertion, exercise, or defense of legal claims.
The right to request restriction of the processing of your personal data pursuant to Article 18 of the UK GDPR, if you contest the accuracy of the data, the processing is unlawful but you refuse its erasure, and we no longer need the data but you need it for the assertion, exercise or defence of legal claims, or you have objected to the processing pursuant to Article 21 of the UK GDPR.
The right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format pursuant to Article 20 of the UK GDPR or to request its transmission to another controller.
The right to lodge a complaint with a supervisory authority pursuant to Article 77 of the UK GDPR. In the UK, the relevant supervisory authority is the Information Commissioner’s Office (ICO) (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO, so please contact us in the first instance using the details set out under “Controller” above.
The right to withdraw consent pursuant to Article 7(3) of the UK GDPR: You have the right to withdraw consent to data processing at any time with future effect. Upon withdrawal, we will immediately delete the data concerned, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of processing based on consent up to the point of withdrawal.
Right to object
If we process your personal data based on legitimate interests pursuant to Article 6(1)(f) of the UK GDPR, you have the right to object to the processing of your personal data pursuant to Article 21 of the UK GDPR for reasons arising from your particular situation. If your objection is directed against the processing of your personal data for direct marketing purposes, you have a general right to object without having to provide any particular reasons.
If you wish to exercise your right of withdrawal or objection, please contact the contact details listed above under ‘Controller’.
This privacy notice was last updated on 19.05.2026
Mit dem Laden des Videos akzeptieren Sie die Privacy policy von YouTube.