Privacy Statement

The protection of your personal data and the security of all patient data are of particular importance to us. This statement fully describes what data this website processes, for what purpose, on what legal basis, for how long, and what rights you have.

1. Data protection at a glance

Who is responsible? International Neuroscience Institute Hannover GmbH (Section 2). Our Data Protection Officer is available for any questions (Section 3).

How do we collect your data? Either you provide it to us, for example via a form, or it arises technically when you visit the website, such as the truncated IP address in the server logs.

What do we use your data for? To operate the website securely, to answer your enquiries, to prepare treatment when you send us a medical request, and to process job applications. We also measure website use on a limited scale to improve the website, using cookieless analytics on our own server without recognising your device and without passing the measurement data to third parties. You can object to this measurement at any time (Section 7). We do not use third-party advertising or tracking services and do not pass data on for advertising purposes.

What rights do you have? Access, rectification, erasure, restriction, data portability, objection, withdrawal of consent, and complaint to a supervisory authority (Section 11).

Cookies? Audience measurement works without cookies. Only when you switch the language does the website store your language choice in a strictly necessary cookie. There is therefore no cookie banner (Section 6).

2. Controller

International Neuroscience Institute Hannover GmbH, Rudolf-Pichlmayr-Straße 4, 30625 Hannover, Germany. Managing Director: Dr. med. Martin Kohnert. Phone +49 511 27092-0, e-mail request@ini-hannover.de. Further details in the Legal Notice (Impressum).

3. Data Protection Officer

Guido Schepers, GS GmbH, Korbweidenweg 13, 48531 Nordhorn, Germany, e-mail info@gsgmbh.de. You may contact him directly with any question about data protection and to exercise your rights.

4. General information

Principles. We process personal data only to the extent necessary to operate this website, answer your enquiries, prepare treatment, or fulfil legal obligations. The website runs on a server located in Germany.

Legal bases. Where you have given consent, Art. 6(1)(a) GDPR is the legal basis, and for health data additionally Art. 9(2)(a) GDPR. Where processing serves to prepare or carry out treatment, we rely on Art. 6(1)(b) and Art. 9(2)(h) GDPR in conjunction with Section 22(1) no. 1(b) of the German Federal Data Protection Act (BDSG). We fulfil legal obligations under Art. 6(1)(c) GDPR. The secure technical operation of the website is based on our legitimate interest under Art. 6(1)(f) GDPR. We name the applicable basis for each processing operation.

Retention. Unless a more specific period is stated in this statement, your data remains with us until the purpose of processing ceases or you make a justified request for erasure, unless statutory retention obligations apply.

Recipients. Within INI, only the staff handling your enquiry have access. External parties receive data only where necessary to fulfil the purpose, where we are legally obliged, or where you have consented. For the server infrastructure we use our hosting provider as a processor under a contract pursuant to Art. 28 GDPR (Section 5); it processes the data solely on our instructions within the European Union and does not use it for its own purposes. Your form entries are delivered to the responsible INI mailbox through our own e-mail system on the same server in Germany; we do not use an additional external e-mail service provider for this.

Withdrawal. You may withdraw any consent given at any time, without giving reasons, with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected. Contact: Section 2 or 3.

Use for other purposes. Before processing your data for a purpose other than the one stated when the data was collected, we will inform you about the new purpose and the other relevant circumstances of the processing (Art. 13(3) or Art. 14(4) GDPR), unless a statutory exception to the duty to provide information applies. Where required, we will obtain your consent beforehand.

5. Hosting and server logs

The website is hosted on a server we operate in the data centre of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. The legal basis for using the hosting provider is our legitimate interest in a secure and reliable provision of the website (Art. 6(1)(f) GDPR).

With every request, the server automatically processes: date and time, the page requested, browser type and version, operating system, referrer URL, and the IP address of the requesting device. The IP address is truncated at the moment the log is written (the last address segment is set to zero), so it cannot be traced back to an individual connection. The logs serve solely operational security and error analysis and are deleted automatically after 90 days. Legal basis: Art. 6(1)(f) GDPR.

All traffic between your browser and our server is encrypted throughout (TLS 1.3, details in Section 10).

6. Cookies and local storage

We do not use cookies for audience measurement, advertising or recognition. The only cookie on this website is set when you change the language via the language switch: the website then stores your choice in the “NEXT_LOCALE” cookie (lifetime one year) so that you arrive in the chosen language on your next visit. This cookie contains only the language code, is necessary for the function you requested (Section 25(2) no. 2 TDDDG) and is not used for audience measurement; a cookie banner is therefore not required. No other local storage takes place. An audience-measurement objection stored in earlier versions of this site (“ini-matomo-optout”) continues to be respected if it is still present in your browser. Last technical audit: 7 September 2026.

7. Audience measurement (web analytics)

To shape our website to visitors' needs we use the open-source software Matomo, which runs exclusively on our own server. Measurement is cookieless and involves no cross-device recognition; IP addresses are truncated by their last two segments before storage, and the browser's "Do Not Track" setting is respected. We record pages visited, approximate region of origin (from the truncated IP), browser type, screen size and referrer. No data is transferred to third parties or third countries. Given this data-minimising design, processing is based on Art. 6(1)(f) GDPR (legitimate interest in audience measurement and improving the website); under Section 25(2) no. 2 TDDDG no consent is required, as no information is stored on your device.

Retention. We delete the individual measurement records (visit and page-view data) automatically 90 days after collection. Beyond that we keep only aggregated evaluations without reference to individual visits, from which no conclusions about individual persons can be drawn; they serve comparison over longer periods and are retained for 24 months.

You can object to audience measurement by enabling “Do Not Track” in your browser’s privacy settings, if your browser supports this option. Our analytics respects this signal. The setting applies to the browser in which you enable it.

A previously embedded Google Tag Manager / Analytics component has been completely removed.

8. Contact and forms

You can contact us by e-mail, phone, or via the website's forms. All form data is transmitted encrypted. Your entries are delivered to the responsible INI mailbox; attached files are stored in protected form and made accessible only to authorised INI staff. All form data is deleted from the web server automatically after no more than seven days. Further handling takes place in INI's internal systems under the retention rules applicable there.

Information provided with forms. This privacy statement is linked from our contact, medical request, job application and feedback forms and is available before submission. Information needed for the relevant request is marked with an asterisk (*); all other details are voluntary. You are not legally or contractually obliged to submit a request, application or feedback through this website. Without the information needed for the relevant process, we cannot handle your request, prepare treatment or an appointment, or assess your application.

8.1 General enquiries (contact form)

We process your name, e-mail address, phone number where given, the type of enquiry and your message. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) or (f) (answering general enquiries).

Necessity of your details. You are neither legally nor contractually obliged to provide us with this data. Only the details marked as mandatory (name, e-mail address, type of enquiry and your message) are required; without them we cannot assign or answer your enquiry. Providing a telephone number is voluntary and merely makes a prompt reply easier; you suffer no disadvantage if you do not provide it.

Retention. Form data is deleted from the web server automatically after no more than seven days. At INI we delete the correspondence once your request has been dealt with conclusively and no further queries are to be expected, at the latest three years after the end of the year of the last correspondence (Sections 195, 199 German Civil Code), unless a statutory retention obligation applies for longer.

8.2 Online medical request and appointment request

What data. Master data: name, date of birth, contact details, and details of a person representing you where applicable. Health data as a special category of personal data (Art. 9(1) GDPR): your descriptions of symptoms, diagnoses and previous treatments, plus voluntarily attached documents such as medical letters or reports as PDF or image files, up to three files of 20 MB each. Where applicable, data of third parties you include, such as relatives. Technical: truncated IP address, time, file name and size, log of the upload (success or failure). We deliberately do not accept imaging data (CT, MRI, DICOM media) via the website; after receiving your request, we will provide you with a secure transfer channel.

Voluntariness. The request is voluntary. Without the information, however, we cannot assess your concern professionally or prepare an appointment.

Purposes. Professional assessment of your concern, preparation of treatment or an appointment, queries and communication with you, fulfilment of medical documentation duties, secure operation of the website. Use for research or quality assurance takes place only with your separate explicit consent or on a specific legal basis.

Legal bases. Health data requires a twofold check: a general basis under Art. 6(1) GDPR and an exemption from the processing prohibition under Art. 9(2) GDPR. Processing is based on your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give via the separate, unticked mandatory fields directly on the form, and, insofar as it concerns preparing treatment, on Art. 6(1)(b) and Art. 9(2)(h) GDPR in conjunction with Section 22(1) no. 1(b) BDSG. For queries by unencrypted e-mail we obtain a separate consent. We fulfil documentation and retention obligations under Art. 6(1)(c) GDPR (Section 630f of the German Civil Code, professional law). The secure operation of the upload function is based on Art. 6(1)(f) GDPR.

Consent and withdrawal. You see the full consent text directly on the form before you submit it. You may withdraw your consent at any time with effect for the future (contact: Section 2 or 3). Data already included in the treatment record is subject to statutory retention periods and can only be deleted after they expire. As evidence of your consent, the time and the text version of the declarations you confirmed are transmitted to INI together with your request and retained there for three years after the end of processing (Art. 7(1) GDPR).

Recipients. Within INI Hannover, the medical team and patient admissions handle your medical request. All persons involved are bound by medical confidentiality. Section 4 also applies to the technical processing. No automated decision-making takes place.

Security of files. Uploaded files are automatically scanned for malware; files that do not match the permitted formats or are identified as harmful are rejected and not stored. All other files are stored encrypted and are accessible only to authorised INI staff.

Information about other persons. If you send us data about other persons, for example relatives or a person representing you, we ask you to inform these persons in advance about the transfer and to make this privacy statement available to them. We process such data only insofar as it is necessary to assess your request, and inform the persons concerned on request about the processing in accordance with Art. 14 GDPR, unless this would conflict with medical confidentiality or involve disproportionate effort.

Retention.

After the respective periods expire, the data is deleted or destroyed.

8.3 Job applications

Via the application form we process the contact details you provide, your cover letter and your CV (PDF), insofar as necessary to decide on establishing an employment relationship. Legal basis: Section 26(1) BDSG, Art. 6(1)(b) GDPR, and, where you have given separate consent, Art. 6(1)(a) GDPR. Within INI your data is passed only to persons involved in handling your application. Application documents are deleted after the procedure is completed, at the latest six months after rejection or withdrawal of the application; retention serves evidentiary purposes in the event of a legal dispute (Art. 6(1)(f) GDPR). If you have consented to inclusion in our applicant pool, we retain your documents for up to two years from the date of consent; consent is voluntary and may be withdrawn at any time. If your application is successful, the data is further processed for the purposes of the employment relationship.

8.4 Feedback

We process voluntary feedback about your stay for quality assurance (Art. 6(1)(f) GDPR). Please do not include health data here.

9. Third-party services

The website loads no content from external servers: fonts are served locally (no Google Fonts), and there are no embedded maps, videos or social media elements. On the contact page you will find a link to Google Maps; only when you click it do you leave our website, at which point Google's privacy terms apply.

10. Security of transmission and storage, backups

Transmission between your browser and our server is always encrypted in line with the current state of the art. Files from forms are stored encrypted (Section 8.2). Access to the website's administration area is specially protected. Access is logged with truncated IP addresses. A deletion and backup concept is in place and documented.

For resilience we create encrypted backups regularly. Form data is held in them only briefly and deleted automatically after no more than seven days. Backups are never analysed and serve solely to restore the overall system.

Please do not send health data by ordinary e-mail. Use the form provided for this purpose.

11. Your rights as a data subject

You have the right to:

Right to object (Art. 21 GDPR). Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not engage in direct marketing.

Exercising these rights is free of charge. Please contact the controller (Section 2) or the Data Protection Officer (Section 3). We respond without undue delay and at the latest within one month of receiving your request (Art. 12(3) GDPR). To prevent unauthorised disclosure, we may request proof of identity (Art. 12(6) GDPR).

Automated decision-making. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

Right to lodge a complaint. Without prejudice to any other remedy, you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority of your place of residence or of the controller's seat: The State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, phone +49 511 120-4500, e-mail poststelle@lfd.niedersachsen.de.

12. Version and changes

Version: 7 September 2026. We will amend this statement if the website or the legal situation changes.