privacy policy

Last updated: November 2026. This English translation is provided for convenience; the German version is legally binding.

This privacy policy informs you, in accordance with Art. 13 GDPR, which personal data is processed when you visit this website or contact us, for what purpose, on what legal basis and for how long – and what rights you have.

1. Controller

Nicolae Olaru
ON-Thera Zentrum
Albert-Roßhaupter-Straße 137
81369 Munich
Germany

Phone: +49 179 2196297
Email: onthera1@gmail.com

We have not appointed a data protection officer because there is no legal obligation to do so (Art. 37 GDPR, Section 38 BDSG). If you have any questions about data protection, please contact us directly.

2. Summary

• This website does not set any cookies and does not use any analytics, tracking or advertising services.
• Fonts, images and videos are delivered by this website's own server. No content is loaded from third-party servers when you visit the website.
• We only process personal data to the extent technically necessary to deliver the pages and when you contact us.

3. Visiting the website and hosting

When you visit this website, your browser technically transmits the following data to our server: IP address, date and time of the request, requested address, previously visited page (referrer), browser type and operating system. This data is processed to deliver the website to you and to ensure the security and stability of the server.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing the website securely and reliably.

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA and delivered via its worldwide delivery network. Vercel processes the access data listed above as a processor in order to deliver the pages and fend off attacks; the data may be processed in the USA. We do not analyse this data ourselves. A data processing agreement under Art. 28 GDPR is in place with Vercel. Vercel is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU Standard Contractual Clauses apply in addition (Art. 46 GDPR). The retention period of the access logs is determined by Vercel.

We have commissioned No More Dots, Turmgasse 17, 92366 Hohenfels, Germany with the technical maintenance of the website; a data processing agreement under Art. 28 GDPR is in place for this as well.

The connection to this website is encrypted using TLS (recognisable by “https://” and the padlock symbol in the browser).

4. Cookies and storage on your device

This website does not set any cookies and does not store any information on your device. A cookie banner is therefore not required. Should we use services requiring consent in future, we will ask you beforehand and update this policy.

5. Contacting us by phone, email or contact form

When you contact us, we process the information you provide (e.g. name, phone number, email address and your message) in order to answer your enquiry and, where applicable, to arrange an appointment.

The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry relates to a treatment or a contract, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries).

Health data: If you share information about your health with us, we process it only to deal with your request and to prepare a treatment, on the basis of your explicit consent (Art. 9 (2) (a) GDPR) or to initiate a treatment (Art. 9 (2) (h), (3) GDPR). Please only share by email or form what is needed to arrange an appointment; we will discuss everything else in person.

Email: Our mailbox is hosted by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Emails are generally encrypted only in transit. For confidential matters we recommend phone or a personal conversation.

Contact form: Your details are transmitted encrypted (HTTPS) to this website at Vercel and forwarded from there to our mailbox by email. To send the email we use the service Resend (Resend, Inc., USA) as a processor; Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the EU Standard Contractual Clauses also apply (Art. 46 GDPR). Nothing is stored on the server. To protect against automated mass submissions, we process your IP address briefly and only in hashed form in memory, for no longer than one hour (Art. 6 (1) (f) GDPR). All fields are mandatory; without this information we cannot process your enquiry.

Storage period: We delete your enquiry once it has been dealt with and no statutory retention obligations apply. If a treatment takes place, the retention periods for treatment records apply (10 years after the end of treatment, Section 630f (3) BGB) as well as tax and commercial retention periods (6 or 10 years).

6. Enquiries about partnership, licensing and succession

We process enquiries from prospective partners, licensees or successors in order to assess and initiate a possible collaboration (Art. 6 (1) (b) GDPR). We treat them confidentially and do not pass them on without your consent, except to advisers engaged by us who are bound to confidentiality (legal or tax advice). If no agreement is reached, we delete the data no later than three years after the last contact.

7. Links to other websites

Our pages contain links to Google Maps (directions and reviews), OpenStreetMap and YouTube. This content is not embedded: only when you click such a link are you forwarded to the respective provider, whose privacy policy then applies.

8. Recipients of your data

Your data is only received by the service providers named in this policy, to the extent necessary for the stated purposes. We do not sell data and do not pass it on for advertising purposes. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

9. Your rights

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

Right to object under Art. 21 GDPR: Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

An informal message to the contact details above is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

10. Obligation to provide data and changes

You are not obliged to provide us with personal data. Without contact details, however, we cannot answer your enquiry. We update this privacy policy when the website or the legal situation changes; the version published here applies.