Privacy policy

Data controller

Röntgen am Kai Priv. Doz. Dr. Kalmar & Priv. Doz. Dr. Riegler Fachärzte für Radiologie OG
Körösistraße 9, 8010 Graz, Austria
Phone: 0316 840 90 50

The essentials at a glance

This website does not use cookies, tracking or analytics tools (only our own online appointment booking sets technically necessary cookies, see below). No content from third parties is loaded when you visit the site – even the fonts are delivered from the same server as the website. The website and online appointment booking run on the practice's own server in Vienna; what is processed there is described below under “Hosting” and “Online appointment booking”.

Hosting

The website is hosted on the practice's own server with netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany; the server itself is located in the data centre in Vienna, Austria (the same server used for online appointment booking). The server deliberately does not keep a log of the pages visited. Only if a request ends in a technical error does it record the error together with the IP address, date and time, the address requested and the browser type, so that we can identify and fix faults and attacks. These error entries are deleted after no more than 14 days. The legal basis is our legitimate interest in secure and stable operation (Article 6(1)(f) GDPR). netcup processes the data only on our behalf and according to our instructions (data processing agreement under Article 28 GDPR); the data is not transferred to any country outside the EU.

Storage in your browser

Only if you switch between light and dark mode yourself is your choice stored in your browser's local storage (entry “theme”), so that it is remembered on your next visit. Nothing is stored unless you make this choice. The entry stays on your device, is not transmitted to us, and can be deleted at any time via your browser settings.

Links to other websites

Our website contains links, for example to Google Maps (directions), to the patient portal portal.marc.at, or to information pages run by third parties. These services are only loaded once you click the link; from that point on, the respective provider's privacy policy applies.

Contact by email or phone

If you contact us, we process your information in order to deal with your enquiry (Art. 6(1)(b) GDPR – establishing or performing the treatment contract; for health data, Art. 9(2)(h) GDPR). We delete general enquiries once they have been dealt with and no further questions are expected. If your enquiry relates to an examination or treatment, it becomes part of the medical records and is kept for 10 years (Section 51 of the Austrian Medical Act (Ärztegesetz 1998), Art. 6(1)(c) GDPR). We do not pass on your data without your consent unless we are legally obliged to do so.

Online appointment booking

You can book an appointment online for a DEXA scan (bone density scan, body composition scan) (termin.roentgen-am-kai.at (opens in a new window)); please book mammogram appointments by phone. For online bookings, we process your first name, surname and date of birth (so we can identify you correctly), mobile number and email address (for appointment confirmation, queries and reminders), your social insurance number on a voluntary basis (it makes registration and billing easier), the examination you have chosen, the appointment, and, for DEXA scans, the billing method. The examination you choose counts as health data; we deliberately do not provide a free-text field for symptoms. We need your name, date of birth, mobile number and email address to make the booking: without this information, online booking is not possible – you can then arrange the appointment by phone instead.

We use this data to schedule, prepare and confirm your appointment (Art. 6(1)(b) GDPR, and for health data Art. 9(2)(h) GDPR – we are bound by medical confidentiality). To protect the booking system against misuse, we briefly process your IP address in working memory without storing it (Art. 6(1)(f) GDPR). The booking page only sets technically necessary cookies (to protect the forms, plus a login cookie within the practice's own area); there are no analytics tools and no content from third-party servers. We automatically delete the data from online bookings 90 days after the appointment, even if the appointment was cancelled; backup copies are overwritten after 14 days. If we transfer the appointment into our practice system, the statutory retention period for medical records applies there (10 years, Section 51 of the Austrian Medical Act (Ärztegesetz 1998)).

Reminder about your appointment by SMS and email

If you have an appointment with us, we remind you of the day and time two working days in advance – by SMS if we have a mobile number stored for you, and by email if we have an email address stored for you. The reminder does not contain any details about the examination. You can cancel the appointment by replying “ABSAGE” to the SMS or email, or via the link in the reminder, and stop any further reminders by replying “STOP” – or simply let us know by phone at any time. The legal basis is the performance of your treatment (Art. 6(1)(b) and Art. 9(2)(h) GDPR). We delete the data used for the reminder no later than 30 days after the appointment.

Service providers for the website, online booking and reminders

These service providers process data exclusively on our behalf and in accordance with our instructions (data processing agreement under Art. 28 GDPR); no data is transferred to countries outside the EU:

• Server for the website and online booking: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany – the server itself is located in a data centre in Vienna, Austria. For the cancellation link, it only stores a check value for the link, plus the date and time, no name. It receives replies to the SMS reminder together with the mobile number, the text and the time, until our practice computer retrieves them; replies that are not retrieved are deleted after 14 days.
• SMS delivery: Missus GmbH (firmensms.at), Ulrichsweg 53/2, 8045 Graz, Austria – processing within the EU (Frankfurt). It only receives your mobile number and the text of the SMS, does not store the text, and immediately shortens the number by removing the last three digits.
• Email: via the practice's mailbox with netcup GmbH (web hosting, address as above) – the mail server is located in a data centre in Germany.

Evaluation of X-ray images using AI software

To evaluate X-ray images, we use AI software that runs exclusively locally within the practice. The images are not transmitted to the software manufacturers or any other third parties for this purpose. You can find out more in our guide Artificial intelligence in radiology.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR – server error logs, protecting online booking against misuse), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert, exercise or defend legal claims.

If you believe that the processing of your data breaches data protection law, you can lodge a complaint with the supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.