Privacy policy

Controller and contact

EPC GmbH – European Prevention Center
Luise-Rainer-Straße 6–10, 40235 Düsseldorf, Germany
Phone: +49 211 838 628 50 · Email: info@epccheckup.com

Data protection contact listed by the practice: Daniel Rankl, Rankl Consulting, Egger Str. 49, 94526 Metten, Germany · dr@rankl-consulting.de · +49 991 28069817.

Hosting and secure delivery

The website is hosted by IONOS. Technical connection data, including IP address, request time, requested address, browser information and error information, may be processed in server logs to deliver and protect the website. Processing is based on our legitimate interest in secure and reliable operation under Article 6(1)(f) GDPR. Connections use HTTPS.

Contact and check-up enquiries

We process your name, email address, enquiry and any optional phone number or company details to respond. The check-up questionnaire also records your selected booking route, employer where applicable, programme interest and preferred appointment dates. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual enquiries and Article 6(1)(f) GDPR for other enquiries.

Messages are transmitted to info@epccheckup.com through Microsoft Graph and the practice’s Microsoft 365 / Exchange Online mailbox. Your email address is used as the reply address. No automatic copy is sent to you. Microsoft processes message and connection data as part of the email service. Information about Microsoft’s processing, including possible international transfers, is available in its privacy statement: Microsoft privacy statement.

Please do not upload medical records or send extensive or particularly sensitive health information through this form. Prescription requests are reviewed by the practice team; submitting a request does not constitute a prescription. Health information needed for medical care is processed under the applicable treatment and confidentiality rules, including Article 9(2)(h) GDPR.

Enquiries are retained for as long as needed to handle them, subject to applicable medical, tax and commercial retention obligations. The website does not store message content in its local abuse-prevention files.

Essential session cookie and abuse prevention

Opening a form creates an essential session cookie named epc_contact to protect submissions against forged requests. It expires with the browser session. It is restricted to the form endpoint and marked HttpOnly, SameSite=Strict and Secure. Form tokens expire after 20 minutes. Abuse prevention temporarily stores a keyed hash derived from the network address and request timestamps, without clear-text IP addresses or message content. The submission limit uses a ten-minute window; stale state files are removed by the service’s cleanup or scheduled server maintenance. These measures protect the service under Article 6(1)(f) GDPR and use technically necessary storage under Section 25(2) TDDDG.

External links and local resources

Fonts and website images are served locally. This website does not load analytics, advertising trackers, external review widgets or embedded third-party videos. Google, Jameda, social media, maps, scientific sources and Doctolib are ordinary external links. The relevant provider receives connection data when you open its website. Online appointment booking takes place directly with Doctolib under its own privacy information.

Your rights

Under the conditions of the GDPR, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw any consent for the future. Contact us using the details above. You may also complain to a supervisory authority, including the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia: www.ldi.nrw.de.