Privacy Statement

This privacy policy explains which personal data are processed when you visit immune-therapy.vet, for what purposes and on which legal basis. Personal data means any information that can identify you personally. In case of doubt, the German version of this privacy policy prevails.

1. Summary

Without your consent, this website loads nothing from Google or any other third-party server, and we do not set any cookies.
We count which pages are read using our own measurement on our server. It works without cookies and without a permanent identifier; your IP address is only stored in shortened form.
Google Analytics only runs if you choose “Einverstanden” (“I agree”) in the notice window. We never allow advertising cookies or personalised advertising.
YouTube videos are only loaded once you click on the preview image.
Whatever you tell us via a form, by e-mail or by phone is used to answer your enquiry. We do not sell data and do not pass it on for advertising purposes.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection at any time, and you can withdraw any consent you have given (section 13).

2. Controller

The controller responsible for data processing on this website is:

PetBioCell GmbH
Tierarztpraxis für Immuntherapie (veterinary practice for immunotherapy)
Schillerstr. 17
37520 Osterode am Harz, Germany
represented by its managing director Simon Grammel

Phone: +49 5522 9182582
E-mail: info@immune-therapy.vet

You can contact us at this address at any time with questions about data protection or to exercise your rights.

3. Hosting and server logs

This website, its database and our e-mail server run on a server operated by Host Europe GmbH, Hansestraße 111, 51149 Köln, Germany, in a data centre in the European Union. Host Europe processes the data on our behalf.

Each time a page is requested, the web server automatically stores information in log files: your IP address, date and time, the requested address, the previously visited page (referrer), information about your browser and operating system, the status code and the amount of data transferred. If you use the search on this website, your search term is part of the requested address.

We need this information to provide the website securely and reliably and to detect attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. The log files are deleted after 14 days.

On your first visit, a notice window asks whether we may use Google Analytics. Your decision (“Einverstanden” or “Nur das Nötige”, i.e. “only what is necessary”) and its time are stored in your browser’s local storage (entry “it-einwilligung”) so that the window does not reappear on every page. We do not set a cookie for this, and the decision is not sent to our server. The entry remains until you delete the website data in your browser.

You can change or withdraw your decision at any time: the link “Cookie-Einstellungen” (cookie settings) at the bottom of every page opens the notice window again.

In addition, the website stores in your browser’s session storage which campaign brought you here (campaign parameters from the address, such as “utm” parameters or the click identifier of a Google ad) and from which external site you entered our website. This allows subsequent pages and a later enquiry to be attributed to the same source (sections 5 and 8). Session storage is cleared as soon as you close the tab or browser.

The legal basis for storing this information in your browser is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the processing of the session information is based on our legitimate interest under Art. 6(1)(f) GDPR.

5. Our own audience measurement

To understand which content is read and how visitors find us, we run our own audience measurement on our server. It works without cookies, without third-party services and without a permanent identifier. We do not pass the data on to third parties.

When a page is loaded and for certain actions, your browser sends the following to our server:

the type of event: page view, scroll depth (25, 50, 75 or 100 per cent), click on the phone number, e-mail address, buttons or downloads, click on an external link including its target address, start, submission, error or abandonment of a form (only the name of the form and the field, never your input), use of the checklist or questionnaire, newsletter sign-up and start of a video,
the address and title of the page and the previously visited page (referrer, without search terms or other additions),
the device type (smartphone, tablet or computer, derived from the window width) and the language of the page,
where applicable, campaign parameters from the address (“utm” parameters and the click identifier of a Google ad).

Our server stores your IP address only in shortened form (for IPv4 without the last block, for IPv6 only the first four blocks) and computes an identifier for the respective day. It is calculated from the shortened IP address, the browser identification string, the date and a secret random value, and it changes at midnight. The browser identification string itself is not stored. Visits on different days therefore cannot be linked.

We also store the shortened IP address with enquiries submitted via our forms (section 8). In principle, this would allow the page views of a day to be attributed to an enquiry. We use this solely to exclude our own test enquiries and the related page views from the evaluation.

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in improving our website and measuring the success of our advertising. You can object to the measurement at any time (section 13). The data are deleted after 14 months.

If you choose “Einverstanden” in the notice window, we use Google Analytics 4, a web analytics service of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Before that, Google’s script is not loaded at all.

Google Analytics sets cookies (“_ga” and “ga” with an identifier, lifetime up to two years) to recognise your browser across several visits. Among other things, it records the pages visited and their address (including campaign parameters), the time spent, the source of the visit, information about device and browser, the approximate location and interactions on the page. In addition, we report two events: the submission of an enquiry (with the type of form, never its content) and a click on our phone number. According to Google, Google Analytics 4 does not store IP addresses.

We use Google’s Consent Mode. Storage for advertising purposes, sharing of user data for advertising and personalised advertising always remain denied, even if you consent to Google Analytics. Google Signals and the sharing of Analytics data with Google for its own purposes are switched off.

We advertise on Google Ads. To measure the success of our ads, we import the events “enquiry submitted” and “click on the phone number” from Google Analytics into our Google Ads account as conversions. No Google advertising or remarketing code is embedded on our website itself.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time via the link “Cookie-Einstellungen” at the bottom of every page; Google Analytics will then no longer be loaded from the next page view onwards. You can delete cookies that have already been set in your browser. Google deletes event data after two months and user data linked to the cookie identifier after 14 months without a further visit. We have agreed data processing terms with Google.

Google may also transfer data to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework (section 11). Further information: https://policies.google.com/privacy?hl=en.

7. Embedded videos

YouTube

On some pages of this website we embed videos from our YouTube channel. The platform is provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are only loaded once you click on the preview image (two-click solution). Until then, your browser does not connect to YouTube or any other Google server; the preview image is stored on our own server. Only your click loads the video from YouTube. YouTube then receives, among other things, your IP address, information about your browser and device and the address of the page on which you play the video.

We use YouTube in privacy-enhanced mode (youtube-nocookie.com). According to YouTube, in this mode information about visitors is only stored once they play the video. After the video has started, however, YouTube may use cookies or similar technologies (e.g. local storage) on your device and transmit data to other Google services, for example for statistics or to prevent abuse. If you are signed in to YouTube, YouTube can link the playback to your personal account; you can prevent this by signing out of YouTube beforehand. We have no influence on this further processing by YouTube.

The legal basis is your consent, which you give by clicking on the preview image (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). We do not store this decision: it applies only to the video you clicked, and the preview image appears again on your next page view. Our own audience measurement counts that a video was started, without cookies and without a permanent identifier.

Further information on how user data is handled can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=en.

Google is certified under the EU-US Data Privacy Framework (DPF), an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Further information can be found in Google’s certification.

8. Enquiries via our forms

Using the forms on this website, you can describe your animal’s case (in detail or as a short enquiry), send us a general message or ask for a call back. Depending on the form, we process:

your name and contact details (e-mail address and/or phone number, and for a call back the preferred time),
information about your animal (name, species, breed, age, diagnosis, treatment status) and your message,
files you choose to attach, such as findings and images,
the page on which you submitted the form, the previously visited page and, where applicable, the campaign parameters of your visit, together with the route by which you found us derived from them (for example search engine, Google ad or direct access). We do not store the click identifier of a Google ad with enquiries,
the time and your shortened IP address.

The form indicates which information is required; without it we cannot process your enquiry. Your enquiry is stored in our database and sent by e-mail to our practice mailbox. A copy is sent to a mailbox of our management hosted on Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Attached files are stored outside the publicly accessible area and can only be retrieved via a secret link in our e-mail. They are deleted from the server after 180 days.

To evaluate through which channels enquiries arise and to match enquiries with our practice management, we use the AI assistant Claude of Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland, as a processor. In doing so, the time, form, page and source of an enquiry as well as name, e-mail address and phone number may be processed. Processing also takes place on servers in the USA (section 11).

To protect against automated spam submissions, we use a field that is invisible to humans, a minimum time between loading and submitting, and a maximum number of enquiries per shortened IP address and hour. We do not use any third-party services for this.

If you tick the box in the case description allowing your case to be published anonymously as a case study, we also use the information for this purpose, without your name and contact details. You can withdraw this consent at any time.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry serves to initiate or carry out a treatment, and otherwise your consent under Art. 6(1)(a) GDPR, which you give when submitting and can withdraw at any time. The information on the source of your visit and the evaluation with Claude are based on our legitimate interest (Art. 6(1)(f) GDPR) in measuring the success of our advertising and handling enquiries reliably. Information about your animal’s health is not health data within the meaning of Art. 9 GDPR.

We store your enquiry in our database for three years after receipt. If a treatment follows, the retention obligations of the veterinary professional code apply to the treatment records.

9. Contact by e-mail or phone

If you write to us by e-mail or call us, we process your information to handle your request. The legal basis is Art. 6(1)(b) GDPR where a treatment is concerned, and otherwise our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). We delete e-mails as soon as they are no longer needed for processing and no statutory retention obligation applies.

Result by e-mail

The symptom checklist and the quality-of-life questionnaire can be completed on this website without any data being transmitted to us; the evaluation runs in your browser. Only if you have the result sent to you by e-mail do we transmit your e-mail address, the species, your name if provided, your answers and the result to our server, together with the page, the previously visited page, campaign parameters where applicable and your shortened IP address. We store this information and send you the result with the PDF template. So that we can answer questions, our practice receives a notification with your information (also to the Microsoft 365 mailbox mentioned in section 8).

As announced when you request the result, a few days after the result e-mail you will receive one further e-mail from our veterinarian with advice on how to proceed, based on your result. You can cancel this message at any time via the link in the result e-mail; it is also not sent if you have sent us an enquiry in the meantime or have unsubscribed from the newsletter.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give when submitting and can withdraw at any time. We store the information for two years; the scheduling entry for the second e-mail is deleted 90 days after it was sent or cancelled.

You will only receive our newsletter if you order it and confirm your subscription via the link in our confirmation e-mail (double opt-in). You can subscribe via the form on the website or when requesting a result from the checklist or questionnaire. We store your e-mail address, the species and area of interest (tumour or autoimmune diseases) if you provide them voluntarily, the page on which you subscribed, the times of subscription and confirmation and your shortened IP address at the time of subscription. The times and the IP address serve as proof of your consent.

We send the newsletter from our own server without a mailing service provider. We do not track whether or when you open a newsletter or click on links in it.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every issue. After you unsubscribe, your address remains stored with the note “unsubscribed” so that we can prove the cancellation and send you no further issues; we delete it after three years. Subscriptions that are never confirmed are deleted after 30 days.

11. Recipients and transfers to third countries

We do not sell personal data and do not pass it on for advertising purposes. The only recipients are:

our hosting provider Host Europe (section 3) as processor for the website, database and e-mail,
Microsoft (section 8) for the mailbox of our management,
Anthropic (section 8) for the evaluation of enquiries with the AI assistant Claude,
Google, if you consent to Google Analytics (section 6) or start a video (section 7),
authorities in individual cases where we are legally obliged to disclose data.

Google, Microsoft and Anthropic may also process data in the USA. Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework (DPF); this means there is an adequacy decision of the European Commission for the USA (Art. 45 GDPR). You can find the certifications at https://www.dataprivacyframework.gov/. For Anthropic, the transfer is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which form part of our data processing agreement.

12. Retention periods

How long we store data is stated in the sections on the individual purposes. In summary:

Data	Retention period
Server logs	14 days
Own audience measurement	14 months
Google Analytics (only with consent)	event data 2 months, user data 14 months
Enquiries via the forms	3 years after receipt
Attached files	180 days
Result of checklist or questionnaire	2 years
Newsletter	until you unsubscribe, then 3 years as proof; never confirmed 30 days
Your decision in the notice window	in your browser until you delete it

Statutory retention obligations, for example under tax or professional law, remain unaffected. If you withdraw consent or request erasure, we delete your data earlier unless such an obligation prevents this.

13. Your rights

You have the right to

obtain access to the data we store about you (Art. 15 GDPR),
have inaccurate data rectified (Art. 16 GDPR),
request the erasure of your data (Art. 17 GDPR),
request the restriction of processing (Art. 18 GDPR),
receive your data in a common, machine-readable format (Art. 20 GDPR),
withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR); processing carried out until then remains lawful.

Simply write to us at info@immune-therapy.vet.

If we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object to the use of your data for direct marketing at any time without giving reasons.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen (the State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany, https://www.lfd.niedersachsen.de/.

No automated decisions

We do not take any decisions based solely on automated processing (Art. 22 GDPR).

14. Encryption

This website is transmitted exclusively in encrypted form (TLS). You can recognise this by “https://” and the padlock symbol in your browser’s address bar. Data you send us via the forms cannot be read by third parties on the way to us. With unencrypted e-mails, complete protection against access by third parties is not possible.

15. Changes to this privacy policy

We adapt this privacy policy when the website or the legal situation changes. The version published here applies; the date of the last change is shown below the text.