← Back to home

Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

1. Controller and overview

The controller responsible for data processing on this website is Natalie Sarah Plitt Services (CZ-Wellmed), Hochwiesenweg 17, 73102 Birenbach, Germany. Phone: +49 7161 507 28 85 (also WhatsApp), e-mail: info@mannop.de.

We arrange surgery dates at partner clinics in the Czech Republic and Slovakia. In doing so, we also process health data. This data is specially protected. We only process it insofar as this is necessary for your enquiry or order and you have given your consent (Art. 9(2)(a) GDPR), and we only pass it on if you wish or the booking contract requires it.

The website can be used without providing personal data. Non-essential services (chat, statistics, advertising) are only loaded with your consent.

2. Hosting and server logs

When the website is accessed, the web server processes technically necessary data: IP address, date and time, page accessed, browser type, operating system and referrer URL. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation). The logs are deleted after a short time, usually after 7 days. The hosting provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, with servers in Germany. A data processing agreement in accordance with Art. 28 GDPR has been concluded with IONOS.

3. Cookies, consent management and browser storage

Technically necessary storage (for example for the cookie banner and your settings) is based on § 25(2) TDDDG and Art. 6(1)(f) GDPR. All other services (chat, statistics, marketing) are only loaded after your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your selection at any time via "Settings" in the cookie banner. Withdrawal is effective for the future.

The fonts on this website are stored locally on our server. No connection is made to Google Fonts or other font providers.

4. Contact, enquiries and forms

If you contact us via a form (for example "Request information pack" or "Enquiry"), e-mail, phone or WhatsApp, we process your details (name, contact details, your request) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and, insofar as you provide health information, Art. 9(2)(a) GDPR.

Forms on this website are transmitted encrypted (TLS) and stored encrypted on our server. The notification to us does not contain the content of your details. You receive a confirmation of receipt by e-mail. Please note: normal e-mails are not end-to-end encrypted. Therefore, please send photos and health data via our photo upload if possible.

5. Surgery booking and disclosure to clinics

If you instruct us to arrange a surgery date ("surgery booking"), we process your master data (name, address, date of birth, contact details), details of the desired procedure, clinic and date, as well as details of travel and accommodation. The legal basis is Art. 6(1)(b) GDPR. We process health data on the basis of your express consent (Art. 9(2)(a) GDPR), which you give separately in the surgery booking.

To reserve the date and for the medical assessment, we pass on the necessary data to the partner clinic you have chosen and the doctors working there. The clinics are located in the Czech Republic and Slovakia, i.e. in the European Union. There, the clinics and doctors decide on the treatment data on their own responsibility (the clinic's own privacy notice). For travel services (for example hotel, transfer) we pass on the necessary details to the respective providers.

6. Photo upload

With the photo upload you can send us photos for the medical assessment. We collect your contact details, your desired procedure, your message and the photos. The photos may be health data, including of intimate body regions. We only process them on the basis of your express consent (Art. 6(1)(a), Art. 9(2)(a) GDPR), which you give by ticking a box in the form. The upload is not possible without consent.

How we protect your photos: transmission is encrypted (TLS). When saving, we remove location and camera data from the image files. The files are stored encrypted; access is restricted to authorised persons with a password. We do not send photos by e-mail. To document your consent, we store the time, the version of the consent text and a shortened, non-traceable check value of your IP address.

We only pass on your photos to the partner clinic(s) you wish. Photos for which no booking contract is concluded are automatically deleted after 90 days. You can withdraw your consent at any time with effect for the future and request early deletion (e-mail to info@mannop.de, please quote your reference number). Processing carried out up to that point remains lawful.

Before-and-after examples: We do not show example images of previous patients publicly, but only as part of a personal consultation via a time-limited, personal access code. The images are only used with the written consent of the patients shown. When they are accessed, we log how often a code has been used in order to prevent misuse (Art. 6(1)(f) GDPR).

7. Appointment calendar

The appointment calendar shows free surgery dates at the clinics. It does not process any personal data. If you request a date, your e-mail program or the form opens. Section 4 then applies.

8. Communication channels and systems

We communicate and document your enquiry using the following systems. Where necessary, data processing agreements according to Art. 28 GDPR have been concluded with the service providers.

9. Chat (Tidio)

If you consent in the cookie settings, we load the chat service Tidio. Your chat entries, your IP address and technical data are transmitted to Tidio, including to countries outside the EU. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Please do not enter health data or photos in the chat – use the photo upload for that.

Request for a review. After your treatment, we only ask you for a review by e-mail if you have agreed to this (Art. 6(1)(a) GDPR). For this we store your name, e-mail address and the date of the request. Whether and where you leave a review is your decision. You can object to receiving such e-mails at any time; a short reply is sufficient.

10. Statistics and advertising (Google)

Nur mit Ihrer Einwilligung nutzen wir Google Analytics und Google Ads (Anbieter: Google Ireland Limited, Irland, bzw. Google LLC, USA). Sie helfen uns, die Nutzung der Website zu verstehen und die Wirkung von Anzeigen zu messen. Dabei können Cookies gesetzt und Daten an Google übertragen werden, auch in die USA. Rechtsgrundlage ist Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG. Die Übermittlung in die USA stützt sich auf den Angemessenheitsbeschluss (EU-US Data Privacy Framework) beziehungsweise Standardvertragsklauseln. Ohne Einwilligung werden diese Dienste nicht geladen.

11. Partners and external links

On our pages we link to partners, for example for complication insurance (medassure, safe4beauty) and financing (medkred, credit4beauty). By clicking, you leave our website. We do not transfer any data from your enquiries. The respective provider is responsible for processing there; please read its privacy notice. For some links we may receive a commission if a contract is concluded. CZ-Wellmed is neither an insurer nor a lender nor a credit broker on behalf of the provider.

Loan comparison (smava): The smava comparison (smava GmbH, Berlin) is only loaded when you click on "Load loan comparison". Your browser and the data you enter then transmit information to smava. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Reviews (ausgezeichnet.org): Only if you agree in the cookie notice do we embed review widgets from ausgezeichnet.org. Your IP address is transmitted to the provider (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The reviews shown relate to CZ-Wellmed.

12. Newsletter

We only send the newsletter with your express consent using the double opt-in procedure (Art. 6(1)(a) GDPR). We store the time and IP address of the registration as proof. The mailing service provider is CleverReach (Germany). You can unsubscribe at any time.

13. Accommodation booking

For hotel bookings at your request, we pass on the necessary data (name, arrival and departure date, number of persons) to the accommodation or booking platform (Art. 6(1)(b) GDPR).

Booking.com partner links: On our clinic pages we link to the hotel search at Booking.com (Booking.com B.V., Amsterdam, Netherlands). The link contains our partner ID so that Booking.com can attribute a booking to us. We do not receive any data about you. Only when you click do you leave our site; the Booking.com privacy notice then applies. If you book, we receive a commission; the price for you does not change.

14. Social media

We link to our profiles on social media platforms. When you click, you are forwarded to the provider and its privacy notice applies. We only set marketing pixels after your consent.

15. Disclosure, processors and third countries

We only pass on data if you have consented, if it is necessary for the contract or if the law requires it. Recipients are clinics and doctors (section 5), service providers as processors (sections 2, 8, 12), travel providers and, where necessary, tax advisers or authorities. Transfers to countries outside the EU only take place for the services named in this policy on the basis of an adequacy decision, standard contractual clauses or your express consent (Art. 49(1)(a) GDPR).

16. Storage period

We delete data earlier if the purpose no longer applies or you withdraw your consent, unless an obligation to retain it prevents this.

17. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). To do so, write to info@mannop.de.

Objection: Insofar as we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons. Further details can be found in the withdrawal policy and right to object.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Online withdrawal: If you withdraw from a contract using the "Withdraw from contract" function, we process your details to handle the withdrawal, confirm receipt and be able to prove it (Art. 6(1)(c) GDPR). The details are stored with date and time and deleted after the statutory periods have expired.

18. Necessity of the details and decisions

Without the marked mandatory details we cannot process your enquiry or order. There is no exclusively automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

19. Data security

We protect your data with technical and organisational measures: TLS encryption, encrypted storage of sensitive data, access restrictions with passwords and two-factor authentication, data minimisation and regular deletion. No method is completely secure. Please use our photo upload and forms for sensitive details.

20. Minors

Our services are not aimed at persons under 18. We do not arrange operations for minors.

21. Changes, version

We adapt this policy if our services or the legal situation change. Version: October 2026 (version 2026-10). This version corresponds to the consent text in the photo upload and the surgery booking.

We object to the use of the contact details published in the legal notice for sending advertising that has not been expressly requested.