# Privacy Notice

Last updated: 31 August 2026

In short: we only store your language selection in a cookie if you select a language from the language menu. We do not incorporate any advertising or cross-site tracking. To measure reach, we use the cookie-free service Fathom Analytics, and we count how often links to medical practices are clicked on our own server — neither of which uses persistent user identifiers. We serve fonts from our own server. We explain in detail below which third-party providers receive data in this process.

## Data Controller

The data controller for this website is iconic.one GmbH, Scanbox #09285, Ehrenbergstr. 16a, 10245 Berlin, Germany, email datenschutz@lokalmed.de.

## Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, technically necessary data is processed: IP address, date and time, URL accessed, referrer, browser and operating system identifiers. Vercel processes this data as a data processor on our behalf. Where data is transferred to the USA in this context, the transfer is based on Vercel’s certification under the EU-US Data Privacy Framework and on EU Standard Contractual Clauses (Art. 46 GDPR).

Our content interface (api.lokalmed.de) and the database are hosted by DigitalOcean, LLC in a data centre in Frankfurt am Main. Images and other media files are delivered from DigitalOcean’s object storage (Spaces) at the same location. In this context too, DigitalOcean, acting as a data processor, processes the technically necessary connection data.

The legal basis is Article 6(1)(f) of the GDPR — our legitimate interest in secure and stable operation. The logs are retained only for as long as is necessary for operational and security purposes and are not combined with other data.

## Language preference, no cross-site tracking

When you select a language from the language menu, we store only the language code (such as ‘de’ or ‘en’) in the ‘lokalmed\_locale’ cookie for one year. It applies only to the respective website host and all its paths (Path=/). HttpOnly prevents access via JavaScript, Secure restricts transmission to HTTPS, and SameSite=Lax restricts transmission in cross-website requests. The cookie contains no user identifier and is not used for analytics, advertising or profiling. We do not set a cookie when automatically detecting the browser language.

The cookie is used solely to ensure that your explicitly selected language is applied when you subsequently visit the homepage. We base the storage of this data on Section 25(2)(2) of the TDDDG and the processing on Article 6(1)(f) of the GDPR (legitimate interest in providing the selected language); we do not use a consent banner for this purpose. You can change your selection in the language menu or delete the cookie in your browser settings. Links containing a language code will remain in the linked language regardless of this.

We use two cookie-free methods to measure reach: the analytics service Fathom Analytics and our own server-side click statistics for links to medical practices. Both operate without cookies, without permanent user identifiers and without cross-day recognition; the details are set out in the following two sections.

## Reach measurement (Fathom Analytics)

We use Fathom Analytics, a privacy-focused analytics service provided by Conva Ventures Inc., 26 Bastion Square, Third Floor Burnes House, Victoria, British Columbia, V8W 1H9, Canada. Fathom operates without cookies or persistent user identifiers and provides us exclusively with aggregated statistics: pages viewed, referring page, device type, country, and events defined by us — such as when an appointment link has been clicked — without any reference to your personal identity.

When the analytics script is loaded, your browser transmits your IP address to Fathom for technical reasons; this is not stored for analysis purposes. Fathom processes visits from visitors in the EU via its EU Isolation infrastructure on servers located in the EU; for Canada, there is also an adequacy decision by the European Commission (Art. 45 GDPR).

The legal basis is Article 6(1)(f) of the GDPR — our legitimate interest in measuring the use of this website whilst minimising data collection.

## Fonts

We serve the fonts used (Fraunces and Manrope) from our own server. There is no connection to Google Fonts or any other font CDN, so no data is transferred to third parties.

## Map display (Geoapify)

On the ‘Map & search’ page, we load Geoapify map tiles from KEPTAGO LTD, N. Nikolaidi & T. Kolokotroni, ONISIFOROU CENTER, 2nd Floor, 8011 Paphos, Cyprus. In doing so, your browser transmits your IP address and the map section displayed to Geoapify, as this is technically necessary. Map data is provided by OpenStreetMap contributors.

The legal basis is Article 6(1)(f) of the GDPR — our legitimate interest in a fully functional proximity search. KEPTAGO LTD is a Cypriot company. Maps are delivered through the standard maps.geoapify.com endpoint. Geoapify states that it uses Cloudflare (Cloudflare, Inc., USA, and Cloudflare Germany GmbH, Germany) for this delivery; it is therefore not restricted to EU infrastructure. The map is only loaded on the search page, not on any other pages.

In its data processing agreement, Geoapify undertakes to make transfers to third countries only where the conditions of Articles 44 et seq. GDPR are met and to put appropriate, legally binding data-protection arrangements in place for subcontractors. The published agreement does not, however, identify the specific transfer mechanism used for Cloudflare, Inc. or state how a copy of the relevant safeguards can be obtained.

## Location detection

You can use your location on the map page. This function is triggered solely by your active selection; your browser will ask for your permission beforehand. The coordinates are used only within the browser to orientate the map; they are transmitted to our server solely as a search centre point and are not stored there.

## Search enquiries

Your entries in the location and advice search are transmitted to our own server (api.lokalmed.de) in order to calculate results. We do not create user profiles for this purpose and do not store the search terms permanently beyond the technical server logs.

## Click statistics for practice links

Links to medical practices — such as booking links or the practice’s website — go via our own server (api.lokalmed.de), which redirects you directly to the destination. We count the click so that we can measure how many visitors we refer to a practice.

The following data is stored: the time, the practice clicked on and the type of link, the destination address, the referring page within our website, browser and operating system identifiers, the browser’s preferred language, the country of origin (where technically available) and a pseudonym that changes daily. This pseudonym is derived mathematically from technical connection data, changes automatically every day and cannot be traced back to you personally nor linked across multiple days. Your IP address is not stored in the process; no user profiles are created. Automated access (such as search engine bots) is flagged and filtered out of the statistics.

When redirecting users, we add referral information to the destination URL (so-called UTM parameters, e.g. ‘utm\_source=lokalmed.de’) so that the practice can recognise that the visit originated via our site. The legal basis is Article 6(1)(f) of the GDPR – our legitimate interest in measuring the referral performance of this website and providing evidence of this to practices.

## Contact via email

If you contact us by email, we will process your details in order to deal with your enquiry (Article 6(1)(b) or (f) of the GDPR). We will delete the correspondence as soon as it is no longer required and provided there are no statutory retention periods that prevent us from doing so.

## Data relating to doctors and medical practices

This website publishes professional information about doctors and medical practices: name, professional title, areas of specialisation, languages, as well as the practice’s address and contact details. The legal basis is Article 6(1)(f) of the GDPR — the public interest in accessible healthcare.

Data subjects may object to the publication at any time (Article 21 of the GDPR) or request rectification. An informal message sent to the address above is sufficient; we will review the matter and respond promptly.

## Your rights

You have the right to access, rectify, erase, restrict the processing of, and data portability, as well as the right to object to processing carried out on the basis of legitimate interests.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State where you are resident or where the alleged infringement took place.

## No automated decision-making

No automated decision-making, including profiling, within the meaning of Article 22 of the GDPR takes place. The order of the search results is determined solely by the distance from the selected map centre.

## Changes

We will amend this notice if the processing changes — for example, if we introduce audience measurement or other services. The version published here at any given time shall prevail.