PRIVACY POLICY
1. Controller
The controller responsible for processing your personal data is:
Eva Hinterleitner
Währinger Straße 138/15, 1180 Wien
Email: info@eva-hinterleitner.com
Phone: +43 664 382 11 88
Protecting your data is important to me. I process personal data exclusively on the basis of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG 2021). In this statement I inform you which data I process and for what purposes. This English translation is provided for convenience only; the German version is legally binding.
2. Visiting the website and hosting
This website is operated on the Wix platform (Wix.com Ltd., Nemal Tel Aviv St. 40, Tel Aviv, Israel). When you visit the website, technically necessary data is processed, such as your IP address, date and time of access, browser type and operating system. This is required to provide the website securely and functionally.
The legal basis is my legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). The European Commission has issued an adequacy decision for Israel. Where Wix transfers data to the USA, this is done on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses.
3. Cookies
This website uses cookies. These are small text files that are stored on your device.
Technically necessary cookies are required to operate the website, for example for the shopping cart, appointment booking or saving your cookie settings. They are set on the basis of Section 165(3) TKG 2021 and Art. 6(1)(f) GDPR.
All other cookies, for example for statistics or marketing, are only set with your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the cookie settings at the bottom of the page.
4. Google Analytics
With your consent, this website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to evaluate website usage statistically. IP addresses are not stored by Google Analytics 4. The data is deleted after 14 months. A transfer of data to the USA is possible; it takes place on the basis of the EU-US Data Privacy Framework.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.
5. Contacting me
If you contact me via the contact form, email, phone or WhatsApp, I process your details (e.g. name, email address, phone number and your message) in order to handle your enquiry and answer any questions.
The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR) or my legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).
For email I use Google Workspace (Google Ireland Limited, Dublin, Ireland).
If you contact me via WhatsApp, your data is also processed by WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland); a transfer to the USA is possible. Please do not send me medical reports or other sensitive health information via WhatsApp. Please bring these to your appointment instead.
6. Appointment booking and online sessions
7. Treatments and health data
8. Online shop, gift cards, payment and shipping
9. Customer account
10. Newsletter
11. Links to Social Media
12. Embedded YouTube videos
13. Recipients and storage period
14. Your rights
For appointment bookings made via the website, I process your name, contact details, the booked appointment, and the selected service. Bookings are made through the Wix booking system. Online sessions take place via Zoom (Zoom Communications, Inc., San Jose, USA). In this case, your name, IP address, and audio and video data are processed. The sessions are not recorded. Data is transferred to the USA based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. The legal basis for this processing is the performance of the contract (Art. 6 para. 1 lit. b GDPR).
As part of treatments in my practice, I also process health data, such as information from the initial consultation, findings, and the course of treatment. As a physiotherapist, I am subject to statutory confidentiality obligations and professional documentation requirements. The legal basis for this is Article 9(2)(h) GDPR in conjunction with the professional regulations (MTD Act) and the performance of the treatment contract (Article 6(1)(b) GDPR).
During online sessions (Emotion Code®, Body Code®, Belief Code®), I record your concerns and the session results in notes and send them to you afterward via email. These notes may contain information about your health and well-being. I process them based on your explicit consent (Art. 9 para. 2 lit. a GDPR), which you can revoke at any time with effect for the future. I retain the notes for up to three years after the last session to prepare for follow-up sessions and delete them after that time, or earlier if you revoke your consent.
I will not disclose your health data to third parties unless I am legally obliged to do so or you have expressly consented.
When you place an order in our online shop or purchase a gift card, I process your name, billing and shipping address, email address, and order and payment details. Payment processing is handled by Wix Payments & SumUp. Payment data is processed directly by the respective payment service provider; I do not receive complete card details. For shipping purposes, I forward your name and delivery address to Austrian Post AG. The legal basis for this processing is the performance of the contract (Art. 6 para. 1 lit. b GDPR) and compliance with tax and commercial law retention obligations (Art. 6 para. 1 lit. c GDPR).
You can create a customer account on the website. Your name, email address, and password will be stored so you can view your bookings and orders. The legal basis for this is the performance of the contract (Art. 6 para. 1 lit. b GDPR). You can delete your account at any time.
When you subscribe to my newsletter, I process your email address for the purpose of sending the newsletter.
Registration takes place via the double opt-in procedure:
You will receive an email in which you confirm your registration.
To document your registration, I will store the time of registration and your IP address. Emails will be sent via info@eva-hinterleitner.com.
The legal basis is your consent (Art. 6 para. 1 lit. a GDPR in conjunction with § 174 TKG 2021). You can unsubscribe from the newsletter at any time via the unsubscribe link in each issue or by email.
This website contains links to my profiles on Instagram and YouTube. These are simple links. Data is only transferred when you click on the link and access the respective platform. The privacy policies of the respective providers apply there.
This website embeds videos from the YouTube platform (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you play a video, data such as your IP address, information about your device, and the page you are visiting are transmitted to YouTube; YouTube may set cookies in the process. If you are logged into your Google account, YouTube can associate your visit with your account. Data may be transferred to the USA; this is done on the basis of the EU-US Data Privacy Framework. The videos are only loaded with your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent at any time via the cookie settings at the bottom of the page.
Your data will only be shared with the service providers named in this statement, insofar as this is necessary for the stated purposes, and with my tax advisor to fulfill legal obligations. Data processing agreements are in place with service providers who process data on my behalf.
I only store your data for as long as it is necessary for the respective purpose or as required by law.
– Treatment documentation: ten years after the MTD Act
– Notes from online sessions: up to three years after the last session or until you withdraw your consent.
– Invoices and accounting documents: seven years according to § 132 BAO
– Inquiries without a subsequent contract: until fully processed, then they will be deleted.
You have the right to information, rectification, erasure and restriction of processing of your data, the right to data portability and the right to object to processing.
You can revoke your consent at any time with effect for the future.
Please contact us regarding this.
info@eva-hinterleitner.com
If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority:
Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.
As of October 2026