Privacy policy

This is a translation for your information. Only the German version is legally binding.

Version of 29 October 2026

Under Art. 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), the controller is obliged to inform data subjects about the processing of personal data. This document sets out the privacy policy for the website familienpraxis.tirol and serves to fulfil the information obligations under data protection law pursuant to Articles 13 and 14 GDPR. This privacy policy describes only the processing operations specific to the website.

1. Definitions

To make this privacy policy easier to understand, the terms used are briefly explained below.

1.1. Personal data (“data”) means all data containing information about the personal or factual circumstances of natural persons, for example name, address, email address, telephone number, date of birth, age, gender, social security number, video recordings, photos etc. Data relating to legal persons is not subject to the provisions of the GDPR.

1.2. Special categories of personal data are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic and biometric data, data concerning health or data concerning a person’s sex life or sexual orientation. These data enjoy special protection under Art. 9 GDPR.

1.3. Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.4. Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.5. Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

1.6. Recipient means a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not.

2. Our contact details

Should you have any further questions about this privacy policy, we (Dr. Marco Schönberger and Dr.ⁱⁿ Laura Riepl), as joint controllers of the data processing described here, will be pleased to assist you at the following contact details:

Familienpraxis Tirol – Dr. Marco Schönberger & Dr. Laura Riepl OG
Bahnhofstraße 54
6300 Wörgl
Electronic mailbox: kontakt.familienpraxis.tirol

3. Purposes and legal basis of processing

3.1. Data may only be processed for a specific purpose and only if the processing can be based on an appropriate legal basis. Processing may be justified on the following grounds:

• on the basis of your voluntary consent for a specific purpose – Art. 6(1)(a); Art. 9(2)(a) GDPR
• for the performance of a contract to which you are a party, or in order to take steps prior to entering into a contract where the processing is carried out at your request – Art. 6(1)(b) GDPR
• on the basis of a legal obligation to which we are subject – Art. 6(1)(c) GDPR
• to protect your vital interests or the vital interests of another person – Art. 6(1)(d); Art. 9(2)(c) GDPR
• for the performance of a task carried out in the public interest or in the exercise of official authority vested in us – Art. 6(1)(e) GDPR
• on the basis of a balancing of interests between our interest or the interest of a third party in the processing on the one hand and your interest or your fundamental rights and freedoms on the other – Art. 6(1)(f) GDPR
• processing of special categories of personal data for the purposes of preventive medicine, medical diagnosis, the provision of health care or treatment, and the management of health care systems and services – Art. 9(2)(h) in conjunction with Art. 9(3) GDPR
• processing of special categories of personal data for reasons of public interest in the area of public health (e.g. protection against serious cross-border threats to health) – Art. 9(2)(i) GDPR

3.2. We process your data for the following purposes on the following legal bases:

• Contact and communication data (enquiries by telephone and in writing, date and time of the enquiries, name): These data are necessary to arrange appointments and to answer patient enquiries. Legal basis: Art. 6(1)(a) GDPR; Art. 9(2)(a) GDPR.
• Technical information (IP address, operating system, device information, access data): These data are necessary when the website is accessed in order to ensure IT security as well as stability and operational security. Legal basis: Art. 6(1)(f) GDPR.
• Technical information relating to the use of OpenStreetMap: These data are processed when map material is retrieved. Legal basis: Art. 6(1)(a) GDPR.
• Akutticket (first name and surname, information on the reason for the visit, mobile number if you wish; see section 11): These data are necessary to allocate a place in the acute consultation hours. Legal basis: Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(h) GDPR.
• Entries in the chatbot Klaus (see section 8): These data are processed to answer your organisational questions. Legal basis: Art. 6(1)(a) GDPR; Art. 9(2)(a) GDPR.
• Recording of chat histories (see section 8.6): These data are processed so that the answers can be traced. Legal basis: Art. 6(1)(f) GDPR; where health data arise, Art. 9(2)(f) GDPR.
• Feedback submitted via the feedback form (ratings, text, and if you wish name, telephone number or email address; see section 12): These data are processed to improve our procedures and, if you so wish, to contact you. Legal basis: Art. 6(1)(a) GDPR; Art. 9(2)(a) GDPR.
• Web analytics (shortened IP address, pages accessed; see section 9): These data are processed for the statistical analysis of website use. Legal basis: Art. 6(1)(f) GDPR.
• Protection against misuse (non-reversible check value of the IP address): These data are processed for no longer than one hour in order to prevent excessive requests to the Akutticket, the chatbot and the feedback form. Legal basis: Art. 6(1)(f) GDPR.

3.3. As a patient, you conclude a treatment contract with either Dr. Marco Schönberger or Dr.ⁱⁿ Laura Riepl. As a rule, the treating doctor in each case is the controller under data protection law for the processing of your personal data for the purpose of treatment. However, within our Ordinationsgemeinschaft (shared practice association) “Familienpraxis Tirol – Dr. Marco Schönberger & Dr. Laura Riepl OG”, your data are also processed by us (Dr. Marco Schönberger and Dr.ⁱⁿ Laura Riepl) as joint controllers. Within our Ordinationsgemeinschaft we use a shared infrastructure. This also includes cooperation across both practices with regard to the operation of the website. We have concluded an arrangement pursuant to Art. 26 GDPR.

4. Recipients

4.1. Recipients support us in complying with statutory or legal obligations, in taking steps prior to entering into a contract and in performing contracts, in services that require your consent, or in carrying out processing operations that are in our legitimate interest. We pass your data on to the following recipients or categories of recipients:

• IT service providers: operation of our IT system, in particular hosting services (Infomaniak), Medflex, Mistral AI, Quickticket, Friendly Captcha, Proton, LimeSurvey and CLICKDOC (online appointment booking) etc.
• Subcontractors: if and to the extent that services are not provided by us and there is a legal ground justifying the processing
• Tax advisers, accountants: processing of data for tax or accounting reasons
• Lawyers, courts, debt collection agencies: where applicable, to enforce or defend claims

4.2. We transmit your data to other recipients only if you have given your express consent to this under Art. 6(1)(a) (or Art. 9(2)(a)) GDPR, if this is legally permissible and necessary under Art. 6(1)(b) GDPR for the performance of a contractual relationship with you, if we are subject to a legal obligation to do so under Art. 6(1)(c) (or Art. 9(2)(c)) GDPR, or if the disclosure is necessary under Art. 6(1)(f) GDPR to safeguard our legitimate interests and for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in your data not being disclosed.

4.3. There is no intention to transfer the data to third countries or to an international organisation.

4.4. Exceptions to this are Switzerland (Infomaniak, see section 6, and Proton, see section 12) and the United Kingdom (OpenStreetMap, see section 10). For both countries there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR, so that an adequate level of data protection within the meaning of the GDPR is ensured.

5. Storage period

5.1. As a rule, data are stored only for as long as is necessary on account of statutory retention obligations. In addition, data may be stored where this is necessary to enforce or defend against claims by third parties. Important storage periods are listed below:

• Retention obligation under company law pursuant to §§ 190, 212 UGB – 7 years
• Retention obligation under VAT law for invoices pursuant to § 11(2), third subparagraph, UStG – 7 years
• Retention obligations under VAT law for export documents pursuant to § 7(7) UStG – 7 years
• Warranty pursuant to § 933 ABGB – 2 years
• General damages pursuant to § 1489 ABGB (actions for compensation) – 3 years/30 years
• Medical documentation obligation pursuant to § 51(3) ÄrzteG 1998 – 10 years

5.2. The following periods also apply to the website: check values used for protection against misuse are kept for no longer than one hour. Records of the chatbot Klaus are deleted automatically after twelve months (see section 8.6). Feedback submitted via the feedback form is not stored on our web server (see section 12).

6. Infomaniak

6.1. We host our servers and databases with Infomaniak. The provider is Infomaniak Network AG, Rue Eugène Marziano 25, 1227 Les Acacias, Switzerland. A data processing agreement has been concluded with Infomaniak. We use server locations within Switzerland exclusively. For Switzerland there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR, so that an adequate level of data protection within the meaning of the GDPR is ensured.

7. Medflex

7.1. To handle written and telephone enquiries, we use the assistance system provided by medflex GmbH. The assistance system comprises, on the one hand, the AI-supported telephone assistant and, on the other hand, the platform for requesting prescriptions, referrals and findings. The purpose of the processing is to answer patient enquiries. Processing is based on your consent, which is obtained when the telephone or written enquiry is submitted.

7.2. We have concluded a data processing agreement with medflex. Data are not transferred to countries outside the EU. Further information on data processing by medflex can be found in its privacy policy at medflex.de/datenschutz.

8. Chatbot Klaus

8.1. We provide a chatbot called Klaus on our website. This chatbot is based on the language model of Mistral AI. The purpose of the associated processing is to answer your organisational questions about the practice (e.g. hours, directions, appointments and prescriptions). For this purpose, your entries in the chatbot are transmitted to Mistral AI. Processing is based exclusively on your consent.

8.2. We have activated the zero data retention setting. Accordingly, data are stored only for the duration of the immediate processing. Neither your entries nor the generated text are used to train Mistral AI’s models.

8.3. We have concluded a data processing agreement with Mistral AI. Mistral AI processes your data within the European Union; we use the EU endpoint exclusively. Further information on data processing by Mistral AI can be found in its privacy terms at legal.mistral.ai/terms/data-processing-addendum.

8.4. You are chatting with an AI assistant – we say so in the chat window before you enter anything. Klaus provides no medical information and does not replace a consultation with a doctor. Please do not enter health data or personal details in the chat. We do not need them there. If you do so nonetheless, that information constitutes health data within the meaning of Art. 9 GDPR.

8.5. Every entry you make is transmitted from our server to Mistral AI – including when the answer then comes from us ourselves: the first step is always a classification of your question by a language model. Opening hours, address, parking, accessibility, appointments, prescriptions and the emergency numbers are answered by our own server from the maintained practice data; the language model does not phrase these answers.

8.6. Recording. We record the course of every chat: your entries, our answers and technical details of the exchange. The conversation content is encrypted immediately. The key needed to read it is not on the web server – that server can create records but cannot open them. After twelve months they are deleted automatically. The purpose of the recording is traceability: if an answer is complained about, we must be able to establish what was actually said. The legal basis is Art. 6(1)(f) GDPR (legitimate interest) and, where health data arise, Art. 9(2)(f) GDPR (establishment, exercise or defence of legal claims). The records contain nothing by which we could assign them to a particular person. We therefore cannot locate an individual conversation, not even on request (Art. 11 GDPR). Your protection here comes from the encryption and the limited storage period.

8.7. Protection against misuse. To prevent misuse and excessive costs, our server records for no longer than one hour how many requests originated from an internet connection. Your IP address is not stored, only a non-reversible check value derived from it. In addition, a service provided by Friendly Captcha GmbH (Am Anger 3–5, 82237 Wörthsee, Germany) checks whether the request comes from a human. Your browser connects to this service only once you open the chat window – not before. Friendly Captcha sets no cookies, but does store technical data in your browser’s local storage (IndexedDB) to avoid repeated checks.

9. Matomo

9.1. We use the software Matomo for the statistical analysis of our website. In the process, certain data such as the IP address of website visitors are collected in anonymised form. The software is used on the basis of the licence terms of the GNU General Public License 3. The software is hosted on our servers. Data are not transferred to countries outside the EU. Further information on data processing by Matomo can be found in its privacy policy at matomo.org/privacy-policy.

9.2. Matomo is configured to work without cookies and to store nothing on your device. Your IP address is shortened before storage; your browser’s “Do Not Track” setting is respected. The legal basis is our legitimate interest in an anonymised analysis of website use (Art. 6(1)(f) GDPR).

10. OpenStreetMap

10.1. On our website we use map material from the OpenStreetMap project to describe how to reach us. This is provided by the OpenStreetMap Foundation (OSMF, St Johns Innovation Park, Cowley Rd, Cambridge CB4 0WS, United Kingdom). The map material is used on the basis of the terms of use and licence conditions published by the OSMF.

10.2. Embedding and using the map material technically requires the OpenStreetMap server to receive the IP address of the respective user in order to deliver the map data to that user’s device. The IP address is processed by OpenStreetMap for this purpose.

10.3. The data processed in connection with the use of OpenStreetMap are stored partly on servers in the United Kingdom (UK) and partly on servers in the Netherlands. For the United Kingdom there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR, so that an adequate level of data protection within the meaning of the GDPR is ensured. Further information on data processing by OpenStreetMap can be found in the privacy policy of the OpenStreetMap Foundation at osmfoundation.org/wiki/Privacy_Policy.

10.4. The map is loaded only when you expressly request it with a click. Your choice is noted in your browser’s local storage so that you are not asked again on every visit.

11. Digital waiting room (Akutticket)

11.1. When you draw an Akutticket via our website, we process your first name and surname, your answers to the questions about the reason for your visit and – only if you activate the text message reminder – your mobile number. The information you provide about the reason for your visit constitutes health data within the meaning of Art. 9 GDPR. The legal basis is Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(h) GDPR (health care).

11.2. These data are transmitted from our web server to Quickticket, with whom a data processing agreement pursuant to Art. 28 GDPR is in place. Your browser does not establish a connection of its own to Quickticket.

11.3. Your ticket can be accessed via a link containing a random identifier. Anyone with this link can view your ticket, cancel it and change the mobile number on file. You should therefore not share the link, and on shared devices you should delete it using the button on the ticket page.

11.4. To prevent misuse, our server records for no longer than one hour how often tickets have been drawn from an internet connection. Your IP address is not stored, only a non-reversible check value derived from it.

12. Feedback form

12.1. You can use our feedback form to give us feedback on your visit: an overall rating, if you wish ratings of individual areas, and a text. You may voluntarily provide your name and telephone number so that we can call you back, or an email address for a written reply. Without these details your feedback remains anonymous. The purpose of the processing is to improve our procedures and, if you so wish, to contact you.

12.2. Please do not enter any health data in the form. If you do so nonetheless, that information constitutes health data within the meaning of Art. 9 GDPR. Processing is based on your consent (Art. 6(1)(a) GDPR; Art. 9(2)(a) GDPR), which you give before submitting and which you can withdraw at any time with effect for the future.

12.3. After a rating of 1 to 3, we ask you whether we may call you back. If you leave the page at this point, or if the form remains unanswered for five minutes, the feedback you have already given is transmitted without contact details.

12.4. Your feedback is transmitted by our web server to the practice as an email and is not stored on the web server. The email is sent and received via the Proton Mail service of Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. For Switzerland there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR. In the practice, the feedback is kept only for as long as is necessary to deal with it.

12.5. To prevent misuse, our server records for no longer than one hour how often feedback has been sent from an internet connection. Your IP address is not stored, only a non-reversible check value derived from it.

13. Patient survey (LimeSurvey)

13.1. For our patient survey at umfrage.familienpraxis.tirol we use the software LimeSurvey. The survey is anonymous unless you voluntarily give your name. Processing is based on the consent you give at the start of the survey (Art. 6(1)(a) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

14. Cookies and local storage

14.1. This website sets no cookies. For its operation, individual entries are stored in your browser’s local storage, such as your consent to loading the map (section 10.4) or technical data from Friendly Captcha (section 8.7). Our Cookie policy describes which entries these are and how you can delete them.

15. Information on your rights

15.1. Right of access. You have the right to obtain confirmation as to whether personal data are being processed; where that is the case, you have the right of access to those personal data. This covers the following information: the purposes of the processing; the categories of personal data; the recipients or categories of recipients; where possible, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period; the existence of the right to request rectification or erasure of the personal data concerned or restriction of processing by the controller, or to object to such processing; the existence of the right to lodge a complaint with a supervisory authority; any available information as to the source of the data; the existence of automated decision-making, including profiling.

15.2. Right to rectification. You have the right to obtain from the controller the rectification of inaccurate personal data and the completion of incomplete personal data.

15.3. Right to erasure. You have the right to obtain from the controller the erasure of personal data without undue delay where one of the following grounds applies: The personal data are no longer necessary in relation to the purposes for which they were collected. You withdraw the consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing. You object to the processing (Art. 21(1) GDPR) and there are no legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR. The personal data have been unlawfully processed. The personal data have to be erased for compliance with a legal obligation. The personal data have been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR. The right to erasure does not apply to the extent that processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation; for the performance of a task carried out in the public interest; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; for the establishment, exercise or defence of legal claims.

You do not have the right to erasure of personal data processed in the course of medical activities, pursuant to Art. 17(3)(b) GDPR and on account of the statutory documentation obligation under § 51 Ärztegesetz 1998.

15.4. Right to restriction of processing. You have the right to obtain restriction of processing where one of the following applies: the accuracy of the personal data is contested, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; the controller no longer needs the personal data, but they are required by you for the establishment, exercise or defence of legal claims; you have objected to processing pursuant to Art. 21(1) GDPR, pending the verification whether the legitimate grounds of the controller override yours.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

With regard to the processing of personal data in the course of medical activities, the right to restriction of processing is excluded pursuant to § 3b(2) Ärztegesetz 1998.

15.5. Right to data portability. You have the right to receive the personal data which you have provided to a controller in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means. In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

15.6. Right to object. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data which is based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

With regard to the processing of personal data in the course of medical activities, the right to object is excluded pursuant to § 3b(2) Ärztegesetz 1998.

15.7. Right to withdraw consent. You have the right to withdraw consent given pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

15.8. Right to lodge a complaint. You have the right to lodge a complaint with the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Wien, T.: 00431521522569, www.dsb.gv.at, if you consider that the processing infringes applicable data protection law.

15.9. Exercising your rights. You can exercise your rights as a data subject against Dr. Marco Schönberger as well as against Dr.ⁱⁿ Laura Riepl.

16. Other information

16.1. The provision of personal data is in part required by law or necessary for entering into a contract. As a rule, you are not obliged to provide the data. If you do not provide the data, it is not possible to conclude a contract.

16.2. There is no automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR.