Privacy policy

Last updated: 6 October 2026

1. Controller

FCL Family UG (haftungsbeschränkt) & Co. KG
Gießereistraße 10
83022 Rosenheim
Germany
Email: kontakt@ai-pointment.de

Represented by its general partner, FCL Family Verwaltungs- UG (haftungsbeschränkt), which is in turn represented by its managing director, Dr. Fabian Christopher Laqua. Further details are given in the legal notice.

No data protection officer is currently designated.

2. Overview

This website sets no cookies of its own, uses no analytics or tracking tools and loads no third-party content. Fonts are served from our own server. Search runs entirely in your browser. Your browser makes no requests to third parties when you visit this website. An expiring exception is error reports to Cloudflare: this feature has been switched off since 22 September 2026 but may still have an effect until 29 September 2026 at the latest (section 4).

Requests to this website are, however, routed through Cloudflare’s network (section 4). This website and the demo are therefore not “hosted exclusively in Germany”: only our own servers are located in Germany, while delivery happens through a worldwide network.

3. Hosting (origin servers)

The origin servers for the website and the demo run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg, Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Web requests reach the servers exclusively through Cloudflare (via an outbound tunnel connection).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the website.

4. Cloudflare (content delivery network and reverse proxy)

Requests to the website and the demo are routed through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects the website against attacks, delivers content and forwards requests to our servers. Cloudflare also receives emails to kontakt@aipointment.de and forwards them to us (section 6). Concretely, for you as a visitor to the website this means:

Cloudflare terminates the TLS encryption. Your browser’s HTTPS connection ends at a Cloudflare server, not at ours. Cloudflare can see and process the content of your requests and of our responses in the clear.
Worldwide processing. Your request is normally handled at the nearest Cloudflare location. Processing outside the EU and the EEA, in particular in the United States, is possible and is not excluded.
Cloudflare’s own logs. Cloudflare collects and stores its own connection and security logs, independently of our server logs. We have only limited influence over their content and retention.
Data processed: in particular IP address, timestamp, requested URL, referrer, user agent and technical connection characteristics.

Details on processing and third-country transfers:

Data processing agreement: Cloudflare’s Data Processing Addendum, which forms part of our contract with Cloudflare.
Transfer to a third country: According to its own statements, Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. Transfers to the United States are therefore based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). Should the certification lapse, Cloudflare provides for the European Commission’s standard contractual clauses, including supplementary measures where necessary.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, attack-protected and reliable provision of the website.

Network error reports (Network Error Logging)

Until 22 September 2026, Cloudflare added the HTTP headers NEL and Report-To to this website’s responses; this feature has been switched off since then. Browsers that visited the website before then may still hold the instruction until 29 September 2026 at the latest. If a network error occurs during that time when accessing the website (for example a failed connection), such a browser may send an error report to Cloudflare (a.nel.cloudflare.com). No reports were requested for successful requests.

Such a report contains in particular the requested address, the referrer, the type of error and technical connection details; your IP address is necessarily transmitted to Cloudflare in the process. According to Cloudflare, the IP address is processed only for the duration of the request to derive the network operator (ASN), country and metro area, and is not stored.

Cookies set by Cloudflare

Cloudflare security features that set cookies (e.g. Bot Fight Mode or Managed Challenge) are not planned. If such features are enabled, Cloudflare may set technically necessary security cookies (e.g. __cf_bm, cf_clearance).

5. Server and proxy log files

The web server that delivers this website logs every request with the following data: IP address (passed on by Cloudflare), date and time, request line (method, requested address, protocol), HTTP status code, amount of data transferred, referrer and user agent. The upstream router in our cluster does not log individual requests.

Purpose: provision of the website, security and error analysis
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security and error-free operation of the website.
Retention of our server logs: the logs are stored only on our server, are not sent to an external logging service and are not archived. They are continuously overwritten once a fixed amount of storage per web server instance (five files of 10 MB each) is used up, and deleted when the instance is replaced, for example when a new version of the website is deployed. There is no fixed period in days; how long an entry remains depends on traffic.
Retention of Cloudflare’s logs: this is governed by Cloudflare’s own rules (section 4). Cloudflare’s privacy policy does not state a specific period.

6. Contact by email

If you contact us by email, we process your details to handle the enquiry.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns the conclusion or performance of a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering your enquiry.
Email provider: our emails are received and stored using the service of Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. The European Commission has adopted an adequacy decision for Switzerland (Art. 45 GDPR).
Forwarding through Cloudflare: emails to kontakt@aipointment.de are received by Cloudflare (section 4) and forwarded to our mailbox at Proton (Cloudflare Email Routing). Cloudflare processes the email in doing so, including sender, recipient, subject and content; processing outside the EU and the EEA, in particular in the United States, is possible here too. For each email, Cloudflare logs in particular the sender, recipient, subject, time, message ID, the outcome of delivery and of the sender checks (SPF, DKIM, DMARC) and a spam classification. According to Cloudflare, this data is retained for 31 days; for Cloudflare’s own logs beyond that, section 4 applies. Our deletion of your enquiry does not affect this log. For processing on our behalf and transfers to third countries, what is said in section 4 applies. Emails to kontakt@ai-pointment.de reach Proton directly, without Cloudflare.
Retention: we delete your enquiry once it has been fully dealt with. If it is a commercial or business letter within the meaning of Section 257 of the German Commercial Code or Section 147 of the German Fiscal Code, we keep it – as well as our reply – for the period prescribed there, as a rule six years from the end of the calendar year in which it was received or sent, and delete it afterwards. The legal basis for this retention is Art. 6(1)(c) GDPR in conjunction with Section 257 of the German Commercial Code or Section 147 of the German Fiscal Code.

7. Cookies, analytics and third-party content

We set no cookies of our own on this website, perform no audience measurement or analytics, and embed no third-party content (e.g. fonts, maps, videos or social media plugins). On possible Cloudflare security cookies, see section 4.

For display and navigation, the website stores two entries only locally in your browser. They remain on your device and are not transmitted to us or to third parties:

starlight-theme (local storage): the colour scheme you set using the “Light”, “Dark” or “Auto” selector; with “Auto” the value stays empty. The entry is written when a page loads and whenever you change the selection, and remains stored until you delete the site data in your browser.
sl-sidebar-state (session storage): which groups of the page navigation are open and how far it is scrolled, so that the navigation is preserved when you move between pages. The entry is written when you open or close a group, when you leave a page and when the tab moves to the background, and is deleted when you close the browser tab.

Storing them is permitted without consent under Section 25(2) no. 2 TDDDG, as it is strictly necessary to provide these website functions that you use.

8. Demo (demo.aipointment.de)

The demo works exclusively with synthetic data. There is no analytics, and no third-party content is embedded.

To protect against cross-site request forgery, the demo sets a technically necessary cookie (_streamlit_xsrf). It is a session cookie and is deleted when you close your browser.

The demo also stores entries solely in your browser’s local storage. The entries themselves remain on your device and are not transmitted to us or to third parties:

stActiveTheme-/-v2: the colour scheme in use. This entry is written automatically when you open the demo.
sidebarWidth: the width of the sidebar.
stSidebarCollapsed-: whether the sidebar is collapsed or expanded.

The latter two are written when you adjust the sidebar. All entries remain stored until you delete the site data in your browser. The demo stores nothing in session storage.

Both the cookie and the local entries are permitted without consent under Section 25(2) no. 2 TDDDG, as they are strictly necessary to provide the service you explicitly requested.

Legal basis for processing the cookie: Art. 6(1)(f) GDPR. Our legitimate interest is protecting the demo against abusive requests.
Other cookies, analytics or third-party content: none

What the demo receives from you

The demo computes on the server. When you change a value, your browser transmits the values you have set to our server — without that transmission the demo cannot show a result. In a typical session this is around twenty values: the numbers and selections in the interface.

The demo is prefilled with synthetic example values and list fees from the public German fee schedules and explicitly invites you to replace them with your own figures. What is transmitted is therefore exactly what you enter — which may be your own business metrics. There are no free-text fields, and file uploads are disabled and additionally blocked at the ingress; personal data or patient data cannot be entered through the interface.

In addition, already when you open it and then on every recalculation, your browser sends technical information about your environment:

your time zone and its offset from universal time
your browser’s preferred language, including region (such as de-DE)
the colour scheme reported by your browser
whether the application is displayed embedded
the address you opened

This information comes from the browser’s standard interfaces and is sent automatically by the software in use. We do not use it to recognise you, we build no profile from it, and we do not combine it with other data. Like every request to this website, it reaches us via Cloudflare (section 4).

The demo’s server does not log individual accesses; only startup and error messages are logged.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is being able to display the demo at all.
Storage period: the transmitted values exist only in memory for the duration of your session. We do not store them permanently and place them in no database.

9. Recipients of your data

Recipient	Role	Place of processing
Cloudflare, Inc.	CDN and reverse proxy, forwarding of emails to `kontakt@aipointment.de`, processor	worldwide, incl. outside EU/EEA
Hetzner Online GmbH	hosting of the origin servers, processor	Germany
Proton AG	email reception and storage	Switzerland

Data is disclosed to other third parties only where we are legally obliged to do so.

10. Is providing data required?

Merely visiting this website does not oblige you, by law or by contract, to provide personal data. Processing your IP address and connection data is technically unavoidable for the page to be delivered to your browser.

If you contact us, we need the contact details you provide in order to answer your enquiry. You are not obliged to provide them, but without them we cannot handle the enquiry.

11. No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR does not take place.

12. Your rights

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

To exercise your rights, an informal message to kontakt@ai-pointment.de or to the postal address in section 1 is sufficient.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

The supervisory authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA; Bavarian Data Protection Authority)
Promenade 18, 91522 Ansbach, Germany (street address)
Postfach 1349, 91504 Ansbach, Germany (postal address)
Website: lda.bayern.de