As a Heilpraktiker, a state-licensed non-medical practitioner, you need a privacy policy on your website, even if the site only logs IP addresses. The policy tells visitors who runs the site, what data it collects and why. It also names the legal basis, who receives the data, how long you keep it and which rights visitors have (Art. 13 DSGVO).
Many practitioners copy a template and hope it fits. Most free templates were written for other businesses, or for the patient file in your practice. This guide goes through what your website's policy must say, section by section, and the parts a practice website adds on top.
Does a Heilpraktiker website need a privacy policy?
Yes. The EU's General Data Protection Regulation, known in Germany as the DSGVO, applies as soon as you collect personal data. A website does that on every visit, because the server receives the visitor's IP address, which can count as personal data (CJEU, C-582/14). When you collect data from a person, you must tell them about it at that moment (Art. 13 DSGVO).
The law also sets the tone. The information must be concise, transparent, easy to find and written in clear and plain language (Art. 12 DSGVO). In practice, that means a link called "Privacy" in the footer of every page, one click away.
The privacy policy is not the same as your legal notice. The legal notice names you, your address and your professional details, and it comes from a different law (§ 5 DDG). Most practice websites need both, and most keep them on two separate pages.
Is the website privacy policy the same as patient information?
Search for a template and you will find two kinds of text mixed together. One is the privacy policy for your website. The other is the information sheet about patient data that you hand out in the practice. Both follow the same article of the DSGVO, but they describe different data and belong in different places.
| Website privacy policy | Patient information sheet | |
|---|---|---|
| Who reads it | Anyone who visits your website | Patients who come to your practice |
| What it covers | Server logs, contact form, booking tool, fonts, maps, cookies, newsletter | Patient file, invoices, billing service, letters to other practitioners |
| Where it lives | A page linked from every page of your site | On paper or as a PDF, handed over at the first visit |
| Typical mistake | A generic text that misses the tools your site really uses | A website text handed to patients, which says nothing about the patient file |
Several top search results for a Heilpraktiker template are patient information sheets. One example is the sample text of the Fachverband Deutscher Heilpraktiker in North Rhine-Westphalia. They are useful in the practice. They do not replace the policy on your website, and this guide covers only the website.
What must a privacy policy contain, section by section?
The DSGVO lists what you must tell visitors when you collect their data. There are ten core points, from your contact details to the right to complain. A good template is simply these points, filled in for the tools your website really uses. The table shows each one, with a plain example of what to write (Art. 13 DSGVO).
| Section | What to write | Rule |
|---|---|---|
| Who is responsible | Your name, practice address, email and phone number | Art. 13 (1) a |
| Data protection officer | Their contact details, only if you have one | Art. 13 (1) b |
| Purposes and legal basis | Each purpose with its basis, for example "answering your enquiry, Art. 6 (1) b" | Art. 13 (1) c |
| Legitimate interest | What your interest is, where you rely on one, for example keeping the site secure | Art. 13 (1) d |
| Recipients | Your host, your booking provider, your mailing provider | Art. 13 (1) e |
| Transfers outside the EU | Which provider, which country, and the safeguard that applies | Art. 13 (1) f |
| Storage period | How long you keep each kind of data, or how you decide | Art. 13 (2) a |
| Visitor rights | Access, correction, erasure, restriction, data portability and objection | Art. 13 (2) b |
| Withdrawing consent | That consent can be withdrawn at any time, for the future | Art. 13 (2) c |
| Complaints | The right to complain to a data protection authority | Art. 13 (2) d |
Two more points complete the list. You must say whether visitors have to give the data and what happens if they do not. You must also mention any automated decision-making, which a practice website rarely uses (Art. 13 (2) e and f DSGVO).
The legal bases you will use most
Every purpose needs one legal basis from the DSGVO. For a practice website, four come up again and again (Art. 6 (1) DSGVO):
- Consent (point a): for analytics, a newsletter or anything else the visitor opts into.
- Contract or steps before a contract (point b): for answering an enquiry or booking an appointment.
- Legal obligation (point c): for records you must keep by law.
- Legitimate interest (point f): for server logs that keep the site running and secure.
For the complaints section, you can name the authority of your federal state. The Datenschutzkonferenz lists all German data protection authorities with their addresses.
What does a practice website add to the template?
A practice website usually adds five things a generic template handles badly. They are a contact form that may receive health details, an online booking tool, content loaded from other companies, cookies or analytics, and a newsletter. Each one sends data somewhere, so each one needs its own paragraph in your policy.
Contact form and email
A patient who writes to you may mention why they want to come. That can be health data, which the DSGVO treats as a special category with stricter rules (Art. 9 DSGVO). Courts read the term broadly. The European Court of Justice counted online pharmacy order data as health data, even for medicines sold without a prescription (CJEU, C-21/23, 4 October 2024).
Three steps keep this part under control:
- Send the form over an encrypted connection. The DSGVO names encryption as one of the security measures to consider (Art. 32 DSGVO).
- Ask only for what you need to reply, such as a name, an email address and a short message.
- Say in the form and in the policy how you handle health details, and which legal basis you rely on.
Which legal basis fits health details in an enquiry is a question to settle with a lawyer for your practice. Many practices ask visitors not to send health details through the form and to bring them to the first appointment instead.
Online booking
An online booking tool collects names, contact details and appointment times. The provider either works on your behalf, which needs a data processing agreement, or acts as its own controller (Art. 28 DSGVO). Its terms say which one applies. Your policy names the provider and its role either way.
You need the same kind of agreement with your web host and your email provider (Art. 28 DSGVO). Most providers offer one in their account settings.
Fonts, maps and videos
Fonts, maps and videos loaded from another company's server send the visitor's IP address to that company. In 2022, the Regional Court of Munich ordered a website operator to pay a visitor 100 euros in damages. The site had loaded Google Fonts from Google's servers without the visitor's consent (Regional Court of Munich I, 3 O 17493/20, 20 January 2022).
Each kind of content has a simple fix that keeps the visitor's data on your side until they choose otherwise.
| Content | Simple fix |
|---|---|
| Fonts | Host them on your own server |
| Maps and videos | Show a placeholder and load the content only after a click |
| Social media feeds and share buttons | Use a plain link, which sends nothing until the visitor clicks |
If a provider is based outside the EU, your policy names the transfer and the safeguard. For a US company, that can be the EU-US Data Privacy Framework, if the company is certified under it. The European Commission recognised the framework on 10 July 2023 (European Commission).
An embedded feed or share button loads from the platform straight away, so it belongs in the policy if you keep it.
Cookies and analytics
Storing or reading information on a visitor's device needs their consent, unless it is strictly necessary for the service they asked for (§ 25 TDDDG). That rule covers cookies and similar technologies. Analytics and marketing tools almost always need consent, so they need a consent banner that works before anything loads.
Your policy lists each tool, what it stores, how long, and that visitors can withdraw consent. A site with no analytics and no third-party content often needs no banner at all (§ 25 (2) TDDDG).
| Tool | Needs consent? |
|---|---|
| A cookie that keeps a booking form working | No, if strictly necessary |
| Analytics | Yes |
| Fonts, maps or videos from another company | Load them only after a click, or ask first |
| Marketing pixels | Yes |
Newsletter
A newsletter runs on consent. You must be able to prove that consent (Art. 7 (1) DSGVO), which is why most mailing tools send a confirmation email first. Your policy names the mailing provider, what you store and how readers unsubscribe.
Do you need a data protection officer?
Most solo Heilpraktiker practices do not. German law requires one when at least 20 people regularly work with personal data on computers (§ 38 (1) BDSG). The DSGVO adds a duty for large-scale processing of health data (Art. 37 (1) c DSGVO). Recital 91 says that processing patient data by an individual health professional is not large scale (Recital 91 DSGVO).
| Situation | Data protection officer required? |
|---|---|
| Solo practice, no staff | Usually no |
| Practice with fewer than 20 people working with personal data | Usually no, unless a special case applies |
| 20 or more people working with personal data on computers | Yes (§ 38 (1) BDSG) |
| Processing that needs a data protection impact assessment | Yes, regardless of size (§ 38 (1) BDSG) |
If you have no data protection officer, leave that section out of your policy. Do not invent one, and do not write "not applicable" as a heading with nothing under it.
Free template, generator or lawyer?
A free template is a fine starting point if you check it line by line against your own website. Generators go a step further, because they build the text from your answers. Neither knows which tools your site really loads. The policy is only correct if it describes what your website actually does.
Some professional associations publish templates for Heilpraktiker. The Union Deutscher Heilpraktiker in Hesse has a public sample for the legal notice and the privacy policy. It notes that its samples are recommendations and do not replace individual advice. Other associations, such as the VFP, keep their templates in a members' area.
Before you copy anything, make a list of what your site loads. Open your website builder and note the host, forms, booking tool, fonts, maps, videos, analytics and newsletter. Then match every item on that list to a paragraph in the template.
| Option | Good for | Watch out for |
|---|---|---|
| Association template | A simple site with few add-ons | Can miss tools your site uses |
| Online generator | Sites with several tools | Only as accurate as your answers |
| Lawyer | Online booking, health details in forms, several providers outside the EU | Costs money, needs an update when the site changes |
Whichever you choose, review the policy whenever you add a tool. A new booking widget or video is a new recipient, and the old text no longer covers it.
What happens if the privacy policy is missing or wrong?
Several things can follow. The data protection authority can fine you, and a visitor can claim damages. In 2025, the Federal Court of Justice (BGH) confirmed that consumer associations can sue over breaches of the information duties (BGH, I ZR 186/17, press release 59/2025). Competitors can sue over health data processed without consent.
| Who acts | What can happen | Rule |
|---|---|---|
| Data protection authority | A fine; breaches of the information duties sit in the higher fine level, up to 20 million euros for a practice | Art. 83 (5) DSGVO |
| A visitor | A claim for damages, including non-material damage; the Google Fonts case above ended with 100 euros | Art. 82 DSGVO |
| A consumer association | A court claim over missing or wrong information about data collection | BGH, I ZR 186/17 |
| A competitor | A court claim over health data processed without explicit consent, in that case by pharmacies | BGH, I ZR 222/19 and I ZR 223/19, CJEU, C-21/23 |
The most common gap is a policy that no longer matches the website, because a tool was added after the text was written.
A quick check of your own privacy policy
Run through these nine questions once now and again whenever your website changes. Each one matches a duty from the sections above, with the rule behind it. If an answer points to a gap, fix the text or the website before you move on.
- Is the policy one click away from every page, under a clear name? (Art. 12 DSGVO)
- Does it name you as the person responsible, with an address and an email? (Art. 13 DSGVO)
- Does every purpose have a legal basis, and every legitimate interest an explanation? (Art. 6 DSGVO)
- Is every provider your site uses named, from the host to the newsletter tool? (Art. 13 DSGVO)
- Do you have a data processing agreement with each provider that works on your behalf? (Art. 28 DSGVO)
- Does your contact form run over an encrypted connection, and does it say how you handle health details? (Art. 9 and 32 DSGVO)
- Are fonts hosted on your own server, and do maps and videos load only after a click or consent? (Art. 6 DSGVO, Regional Court of Munich I, 3 O 17493/20)
- Does the policy list visitor rights, the right to withdraw consent and the right to complain? (Art. 13 DSGVO)
- Is the legal notice easy to find and one click away from every page? (§ 5 DDG)
This article is general information, not legal advice. Talk to a lawyer who knows data protection law for your own case. The German law texts were read on gesetze-im-internet.de on 14 October 2026.
Frequently asked
Can a Heilpraktiker use a free privacy policy template?
Yes, as a starting point. Some professional associations publish one, and online generators build the text from your answers. Check every paragraph against the tools your website really uses, such as the host, contact form, booking tool, fonts and analytics. The policy is only correct if it describes what your site actually does.
Does a Heilpraktiker need a data protection officer?
Usually not. German law requires one from 20 people who regularly work with personal data on computers (§ 38 BDSG). Recital 91 of the DSGVO says that processing patient data by an individual health professional is not large scale, so the duty for large-scale health data usually does not apply to a solo practice.
Is the privacy policy the same as the legal notice?
No. The legal notice names you, your address and your professional details under § 5 DDG. The privacy policy explains what personal data your website collects, why, and which rights visitors have under Art. 13 DSGVO. Most practice websites need both, and most keep them on two separate pages.
Sources
- Regulation (EU) 2016/679 (DSGVO), Art. 6, 7, 9, 12, 13, 28, 32, 37, 82, 83 and recital 91
- § 25 TDDDG - consent for storing information on devices
- § 38 BDSG - data protection officer
- § 5 DDG - legal notice
- BGH, I ZR 186/17, I ZR 222/19 and I ZR 223/19, 27 March 2025, press release 59/2025
- Court of Justice of the European Union, C-582/14 (Breyer), 19 October 2016
- Court of Justice of the European Union, C-21/23, 4 October 2024
- Regional Court of Munich I, 3 O 17493/20, 20 January 2022 (summary by IHK Wuppertal-Solingen-Remscheid)
- European Commission, EU-US data transfers and the Data Privacy Framework
- Datenschutzkonferenz, list of German data protection authorities
- Union Deutscher Heilpraktiker, Hesse: sample legal notice and privacy notice
Written by
Vitalmyn Team
Editorial team
We are building the ordering service for practitioner recommendations. Here we write down what we learn about recommending, practice finances and advertising law, so you do not have to dig it up yourself.
