Privacy Policy


LMU Medical Center

Data Protection and Data Security

Where the male form of personal names is used below for ease of reading, this refers to all persons regardless of gender.

Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), as well as other data protection regulations, is:

LMU Medical Center Munich

Public law institution (AöR) represented by:

Chairman and Medical Director

Prof. Dr. Markus M. Lerch

Commercial Director

Markus Zendler

Marchioninistraße 15

81377 Munich

Email: info@klinikum.uni-muenchen.de

Tel.: +49 89 4400 0

Name and Address of the Data Protection Officer

Official Data Protection Officer of the LMU Munich Hospital

Pettekofferstraße 8a

80336 Munich

Email: datenschutz@med.uni-muenchen.de

Tel.: +49 89 4400 52783

Information on Data Processing

We would like to point out that we generally only collect personal data from our users to the extent necessary to provide a functional website and our content and services. Personal user data is only processed based on legal permission or with the user’s consent, unless prior consent cannot be obtained for practical reasons.

Personal user data is generally deleted or blocked once the purpose of the processing has been achieved. If European or national law provides for longer storage due to regulations, laws, or other provisions applicable to the controller, such storage is possible. If a storage period is specified by the designated legal basis and this period expires, the data will be blocked or deleted unless further storage is necessary for the conclusion or fulfilment of a contract or for another legal reason.

Protecting your privacy when visiting our website is important to us. Two types of information are stored when you visit our website:

  • Data that is automatically saved
  • Data that you have voluntarily provided on forms
  • Automatically saved data – user profiles
  • Date and time of the request
  • Requested access medium/function used by the user
  • Input values transmitted by the requesting computer (file name, etc.)
  • Access status of the web server (file transferred, file not found, command not executed, etc.)
  • Name of the requested file
  • URL from which the file was requested/the desired function was initiated
  • Type and version of the browser used
  • Operating system
  • User’s Internet service provider
  • Average time spent on the website
  • Pages accessed
  • Access times
  • Devices used

Every time you visit our website, our system automatically records data and information from the computer system of the accessing computer. The following data is collected:

This data is collected, stored, and evaluated in a pseudonymized, identifiable form. The storage of the IP address by the system is necessary for the purpose of delivering the website to the user’s computer, which is why the user’s IP address must also be stored for the duration of the session. Furthermore, the aforementioned data is collected, stored, and evaluated for the purpose of making our websites more user-friendly and interesting for you. The results of these evaluations are ultimately available in statistical form and are anonymous. The data is also stored in our system’s log files. However, this data is not stored together with other personal data of the user.

The storage of the data and log files is based on the legal basis of Art. 6 (1) DS-GVO. The aforementioned purposes also constitute the legitimate interest in data processing in accordance with the specified legal basis.

The data is deleted when it is no longer necessary for the purpose for which it was collected.

If data is collected solely for the purpose of providing the website, this is the case when the respective session ends. If data is stored in log files, deletion is not necessary, as anonymization takes place immediately, so that the calling client can no longer be assigned.

The user has no right to object to the collection, recording, and storage of this data, as data collection is essential for the provision of the website and data storage in log files is essential for the operation of the website.

Personal data that you provide voluntarily

In order to receive customized services, you will be asked to provide personal data. For this purpose, we provide contact forms (contact, feedback, appointment scheduling) on our website, which can be used to contact us electronically. The data is entered into an input mask, transmitted to us, and stored. Depending on the contact form, different data is collected during this process, but the following is often requested:

  • First and last name
  • Phone number
  • Email address
  • In addition, the following data is stored when the message is sent:
  • User’s IP address
  • Date and time

If you do not wish to provide this information, please understand that you will not have access to the requested functions or information.

Alternatively, you can contact us via the email address provided. In this case, the user’s personal data transmitted with the email will be stored.

Data transmission over the Internet (e.g., when communicating by email) cannot guarantee complete data security due to security gaps. Therefore, we cannot provide complete protection of data against access by third parties. In particular, it cannot be ruled out that unencrypted emails may be read by unauthorized persons during transmission. If you wish to provide or transmit personal or sensitive data (e.g., health data) to us, we therefore advise against sending unencrypted emails. For confidential information, we recommend that you contact us by post or telephone.

By voluntarily providing this data in the contact forms, you as the user declare your consent to the collection and storage of the data entered. Data processing is thus carried out for the purpose of establishing contact in accordance with Art. 6 (1) (a) GDPR on the basis of your voluntary consent.

We only process personal data for the purposes of conversation or processing contact requests. The necessary legitimate interests in processing the data in the event of contact via the contact form or by email are justified.

Some web forms on the website send data to a secure data room at Dracoon (https://www.dracoon.com), where it is stored for a short period of time for secure retrieval by the LMU Clinic in accordance with the legally applicable deletion periods.

Under certain circumstances, it may be necessary for us to pass on your personal data to third parties for the purposes of medical treatment, cost assurance, in particular by health insurance companies, social insurance carriers, and social welfare agencies, for scientific and statistical purposes, for research and teaching purposes (if these are anonymized or pseudonymized (without a direct reference to the data subject)). During remote maintenance of technical equipment, our partner companies (Infopark, Codeandconcept) may have access to stored data for administrative purposes. We require our business partners to also comply with the statutory data protection regulations.

Furthermore, we will only disclose your data if it concerns requests from official bodies, in particular law enforcement and supervisory authorities, and/or if we are otherwise legally obliged to do so.

Here too, the data will be deleted when it is no longer required for the purpose for which it was collected. Personal data from the contact form input mask and data sent by email will generally be stored on the intranet of the University of Munich Medical Center in the email archive or clinical workstation system in accordance with the statutory deletion periods applicable there.

The data will only be stored long-term if the contact request leads to a treatment relationship. The duration of storage is then based on the treatment relationship or legal storage obligations, which, for example, amount to 15 years after completion of treatment for personal data collected in the context of treatment. Longer storage periods may result from other legal bases.

Right of revocation and objection

The user has the right to revoke their consent to data processing at any time and the right to object to the processing of personal data. In such cases, it will no longer be possible to continue the conversation.

The revocation of consent or objection to processing must be declared to the controller in writing, by telephone, or by email.

In the event of revocation or objection, the personal data stored for the purpose of contacting the user will no longer be processed, unless the clinic can demonstrate compelling legitimate grounds for the processing that outweigh the interests, rights, and freedoms of the user, or the processing serves to assert, exercise, or defense of legal claims, or the user’s rights are restricted on a legal basis.

Cookies

Cookies are automatically generated text files that are stored on the user’s device, such as a PC, laptop, or smartphone, and saved by your browser without causing any damage to the device.

We use so-called session cookies to facilitate the use of our websites. These cookies are stored for the duration of your visit and are automatically deleted after your visit.

In addition, cookies are used on the website by Matomo (log file analysis) to analyze the user’s surfing behavior. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again. However, this does not give us any direct knowledge of the user’s identity. See section III – Matomo for more information.

Donation tools (Fundraisingbox: https://secure.fundraisingbox.com, Enterbrain: https://enterbrain.gmbh) also store a session ID from the payment provider for the donation tool.

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 (1) lit. f GDPR. The aforementioned purposes also constitute our legitimate interest in the processing of personal data in accordance with Art. 6 (1) lit. f GDPR.

For the processing of personal data using cookies for analysis purposes, the legal basis is Art. 6 (1) lit. a GDPR, provided that the user has given their consent.

However, once cookies have been stored on the user’s computer and transmitted to our website, the storage or transmission can be restricted or deactivated by adjusting the settings in the user’s browser. If cookies have already been stored, they can be deleted at any time, including automatically. Furthermore, the user can obtain information about the setting of cookies through appropriate browser settings, grant acceptance for the use of cookies only in individual cases, specify a general exclusion or an exclusion only for explicitly named cases for the acceptance of cookies, and set the automatic deletion of cookies when closing the browser.

Web analysis by Matomo

This website uses Matomo for web analysis. For this purpose, a so-called “cookie” is stored on your computer for identification purposes, and usage information (including your abbreviated IP address) is transmitted to the server and stored for usage analysis purposes after it has been anonymized. The information generated by the cookie about your use of the site will not be disclosed to third parties.

If you do not agree to the storage and evaluation of the usage information generated on the “University of Munich Hospital” website, you can object to this below. In this case, a so-called deactivation cookie will be stored in your browser, which means that Matomo will not collect any session data.

Please note: If you delete your cookies, this will also delete the deactivation cookie and you will have to store it again.

Changes to the privacy policy

Changes to this privacy policy may become necessary due to changes in legal or regulatory requirements or due to the further development of our website and the services we offer. The current privacy policy can be accessed and printed at any time on the website at: www.lmu-klinikum.de

Our websites may contain links to other external websites. This privacy policy does not extend to these linked websites.

If you have any questions about data protection, please send an email to datenschutz@med.uni-muenchen.de.

LMU Medical Center

Marchioninistr. 15

81377 Munich

Ziemssenstr. 5

80336 Munich

089 4400 – 0