This privacy policy explains which personal data we process when you visit the website one4.health, for which purposes, and which rights you have. It applies to the public website.
Last updated: September 2026
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
One4 Health gGmbH
Am Aukopf 4
69118 Heidelberg
Germany
Phone: +49 6221 3549038
Email: support@one4.health
Commercial register: Local Court (Amtsgericht) of Mannheim, HRB 759438
For privacy-related enquiries, please contact: support@one4.health
This website uses no tracking cookies, no analytics or marketing services, and no embedded third-party content. All content — including fonts and videos — is served via our own website infrastructure; no content is loaded from external platforms (e.g. font, map, or video services).
On your first visit, a cookie notice informs you that we only use strictly necessary cookies; you can revisit your choice at any time via the "Cookie settings" link in the footer.
We use two technically necessary cookies: one4_locale stores your language selection (German/English) for 12 months, and cc_cookie stores your choice from the cookie notice for 182 days.
Both cookies are strictly necessary to provide the service you request (displaying the website in your language, or remembering your cookie choice) and therefore do not require consent (Section 25 (2) no. 2 of the German TDDDG).
This website is provided via the infrastructure of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (hosting and content delivery network). Technical operation of the website is carried out on our behalf by DHC GmbH, Alte Leimengrube 14, 68526 Ladenburg, Germany. Data processing agreements pursuant to Art. 28 GDPR are in place with both service providers. Cloudflare generally serves content via data centres within the European Union; for possible transfers to the USA, see Section 7.
When you access the website, the web server automatically processes the following data in so-called server log files: the IP address of the requesting device, the date and time of access, the page or file accessed, the volume of data transferred and the HTTP status code, browser type and version, the operating system, and the referrer URL (previously visited page).
This processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring the stable and secure operation of the website and in defending against attacks. Log files are deleted after 3 months, unless a specific security incident requires longer retention.
If you use our contact form, we process the data you provide: first name, last name, email address, organisation (if provided), subject, and the content of your message. The same applies to enquiries you send us directly by email.
The purpose of this processing is to handle and respond to your enquiry. The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6 (1) (f) GDPR (our legitimate interest in responding to enquiries addressed to us).
The details you enter in the form are not stored in a database but sent as an email to our mailbox and processed there. The technical dispatch is carried out by Scaleway S.A.S. as a processor via its Transactional Email service. In this context, the sender and recipient addresses, the subject and the content of your message as well as the time and delivery status are processed; processing is permanently configured to the Paris region (France).
We delete your enquiry 12 months after its final processing, unless statutory retention obligations apply or the enquiry results in a business relationship.
Please do not submit health data or other sensitive information via the contact form. For the exchange of sensitive medical information, we will agree on a suitable, secure channel with you separately.
The “Clinic Login” page is a pure directory: it redirects you to your institution's One4 platform. No personal data is collected on the website itself in this process.
To operate the website we engage DHC GmbH, Alte Leimengrube 14, 68526 Ladenburg, Germany (technical operation of the website), Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (hosting and content delivery network), and Scaleway S.A.S., 8 rue de la Ville l'Évêque, 75008 Paris, France (technical dispatch of the email triggered by the contact form, Paris region) as processors.
Data processing agreements pursuant to Art. 28 GDPR are in place with all processors. Your data is not transferred to any other third parties unless we are legally obliged to do so.
Through the use of Cloudflare, personal data (in particular IP addresses and technical connection data) may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF); these transfers are therefore covered by an adequacy decision of the European Commission (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) are agreed in the data processing agreement with Cloudflare.
The dispatch of the contact form email via Scaleway is permanently configured to the Paris region (France) and therefore to the European Union; we do not initiate any transfer to a third country in this context.
Beyond this, personal data is not transferred to countries outside the European Union or the European Economic Area.
Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.
As a data subject, you have the right of access to the personal data we process about you (Art. 15 GDPR), to rectification of inaccurate data (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), and to data portability (Art. 20 GDPR).
Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Art. 6 (1) (f) GDPR.
To exercise your rights, an informal message to support@one4.health is sufficient.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority responsible for us is:
The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany
Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
https://www.baden-wuerttemberg.datenschutz.de
We will update this privacy policy whenever data processing on this website changes — for example, due to new features. The version published here applies.
