Privacy policy

This notice explains, under Articles 13 and 14 GDPR, how personal data are processed when you visit this website or contact us.

1 Controller

Medismile Korlátolt Felelősségű Társaság
Henszlmann Imre utca 7., 2. em. 11A. ajtó
1053 Budapest · Hungary
Szervita tér 8, 1052 Budapest
+36 30 101 6510
info@medi-smile.com

No data protection officer has been appointed. For privacy requests, contact the controller at the details above.

2 Technical provision and security logs

The website is provided by the hosting provider Hetzner Online GmbH (in production). The site runs on a Hetzner Cloud server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in the Falkenstein data centre (FSN1), Germany, under a data processing agreement pursuant to Art. 28 GDPR. Processing takes place in Germany; no global CDN is used. When pages are requested, IP address, time, requested URL, referrer, browser and device data, and status/security data may be processed. Purposes are delivery, stability, error analysis, and abuse/attack prevention. Legal basis is Art. 6(1)(f) GDPR; the legitimate interest is secure, functional operation.

Technical providers may process data as processors or — where they determine their own purposes — as independent controllers. Processing outside the European Economic Area cannot be excluded; it follows Art. 44 et seq. GDPR and applicable transfer mechanisms.

Technical logs are kept only as long as needed for security, troubleshooting and legal duties.

3 Cookies and local storage

MEDISMILE shows a cookie consent panel (CMP) so you can choose optional categories. Technically necessary storage (including remembering your choice in localStorage) is always active. Legal basis for necessary processing is Art. 6(1)(f) GDPR and, where applicable, corresponding ePrivacy rules (including § 25 Abs. 2 Nr. 2 TDDDG for visitors from Germany). Optional analytics and marketing categories are offered only with consent (Art. 6(1)(a) GDPR / § 25 Abs. 1 TDDDG where applicable). You can reopen the panel via “Cookie settings” in the footer; withdrawal applies for the future.

Optional analytics (release-gated): when internally released, a privacy-oriented usage measurement tool may load only after the “Analytics” consent. Purpose: understand page and locale usage to improve the site and GEO content — not advertising profiles. No analytics tags are loaded yet (internal release flag off), even if consented.

Optional marketing / Meta Ads (release-gated): when internally released, Meta Pixel and — if configured — Meta Conversions API may be used for Meta Ads campaign delivery measurement and optimisation. Controller/recipient for Meta’s processing is typically Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; processing may involve Meta group companies in the United States (Art. 44 et seq. GDPR / applicable transfer mechanisms). Legal basis: your CMP “Marketing” consent (Art. 6(1)(a) GDPR and § 25 Abs. 1 TDDDG where applicable). Tags load only after that consent and internal release. Marketing tags are not loaded yet (internal release flag off). Planned event types if activated: generic PageView and contact-intent Lead — without health data, diagnoses, treatment details or patient-CRM uploads. Meta’s own notices apply to Meta’s processing: facebook.com/privacy/policy →.

4 Contact

The contact form does not submit or store data on the website server. After your acknowledgement it opens your local email client. Only if you send a message there are the details you chose processed for handling your enquiry. Legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual matters, otherwise Art. 6(1)(f) GDPR and — where expressly given — Art. 6(1)(a) GDPR.

Please do not send health data, records or images via this website or unencrypted email. Arrange a suitable secure channel in advance for medical documents.

5 External content and links

Fonts are bundled at build time via next/font and served from this site; no connection to Google Fonts is made on page load. No map, video or social embeds are included on load. Analytics or Meta marketing tags — if internally released — load only after the matching CMP consent (see § 3). External sites (registers, authorities, 109FIFTY, MEDI-KUSS, Google Maps search links, etc.) are opened only after an active click; their own privacy notices then apply. A Maps click may transmit technical data (such as IP address) to Google.

6 Recipients and retention

Recipients may include technical hosting, CDN, security and email providers and, in individual cases, legally authorised bodies. If marketing tools are internally released and you consent, Meta Platforms Ireland Limited (and Meta group companies as described by Meta) may receive event/measurement data as set out in § 3. Data are deleted or anonymised when the purpose ends and no retention, evidence or defence interests remain. This website itself does not keep patient records.

7 Your rights

Within the legal framework you have rights of access, rectification, erasure, restriction, portability and objection. Consents may be withdrawn with effect for the future. Where processing is based on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

8 Complaints

You may lodge a complaint with a data-protection supervisory authority. Competent in particular is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9. Information: naih.hu →.

9 Security and updates

The site is served over HTTPS and uses technical security headers. No transmission path is fully risk-free. This notice is updated when features, providers or the legal situation change materially.

Last updated: 14 August 2026 — production: CMP + Meta disclosure ready; analytics/marketing tags not loaded.