App privacy policy

As of: 21 August 2026

§ 1 Introduction and scope

(1) Weight Doctors GmbH (“we”, “us”, “our”) operates a mobile application (hereinafter the “app”). With this privacy policy we inform you, in accordance with Art. 12 et seq. of the EU General Data Protection Regulation (GDPR), which personal data we collect when you use the app, for what purposes and on what legal basis we process it, to whom we disclose it, how long we store it and what rights you have.

(2) This privacy policy applies exclusively to the app. For visiting our website, the separate privacy policy published there applies (https://www.weight-doctors.de/datenschutz/). For your medical treatment at our clinics, the patient information on data protection handed out to you there applies in addition.

(3) Personal data is any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), for example name, address, email address, health data or usage behaviour.

§ 2 Controller and data protection officer

(1) The controller within the meaning of Art. 4(7) GDPR is:

Weight Doctors GmbH
Rosemeyerstr. 2–4
44139 Dortmund
Germany

Telephone: +49 (0) 231 58 98 3200
Fax: +49 (0) 231 54 504 901
Email: hallo@weight-doctors.de
Website: https://www.weight-doctors.de

Further details can be found in our imprint at https://www.weight-doctors.de/impressum/.

(2) You can reach our data protection officer at:

Dr. Dennis Lehmkuhl
Weight Doctors GmbH, Rosemeyerstr. 2–4, 44139 Dortmund
Email: datenschutz@weight-doctors.de

If you contact us by letter or fax, please mark your letter “for the attention of the data protection officer”.

§ 3 Which data we process in the app

3.1 Registration and user account

A user account must be set up in order to use the app. In doing so, we process: first and last name, gender, date of birth, height, email address, mobile phone number, language selection, the clinic you have chosen and the date and place of your procedure, as well as your password and further authentication data. Mandatory fields are marked accordingly in the app; without this information, no account can be created. Your password is stored exclusively in cryptographically secured form (hash).

3.2 Health and treatment data

The purpose of the app is to support your weight reduction and your treatment with us. For this purpose we process – to the extent that you use the respective functions – in particular your body weight and weight progress, body fat percentage, body water percentage, bone mass, muscle mass, body mass index, basal metabolic rate and visceral fat.

In addition, the app can process further health and fitness data that you release from your mobile device or a connected activity tracker, such as sleep data, movement data and heart rate. You can voluntarily give us further information about your health and personal situation, including physical and mental pre-existing conditions, your sensations of hunger and fullness and your marital status.

This is health data and therefore special categories of personal data within the meaning of Art. 9(1) GDPR. For the legal basis, see § 5 of this policy.

3.3 Messages and video consultation

Using the app’s messaging function, you can communicate with the clinic you have selected and your treatment team. In doing so, we process the content of these messages, including any attachments you send, the communication partners and timestamps. If you hold a video consultation via the app, we do not access its content; the transmission takes place directly between you and your treatment team.

The members of our treatment team are bound by medical confidentiality (§ 203 StGB). Please do not use the messaging function in medical emergencies – in that case, contact the emergency services (112) or the medical on-call service (116 117).

3.4 Making appointments

If you request, reschedule or cancel appointments via the app, we process the data required for this: the type of appointment requested, location, time period, your contact details and your appointment history.

3.5 Usage and log data

Each time the app connects to our servers, technically necessary data is processed: IP address, date and time of access, function called, amount of data transferred, status code, app version, device type, operating system and its version, and a device- or installation-related identifier. We need this data to provide the app, to ensure its stability and security and to detect misuse.

3.6 Push notifications

If you activate push notifications, we send messages – such as appointment reminders or notices of new messages – via the push services of the operating system providers (Apple Push Notification service, Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland; Firebase Cloud Messaging, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). A pseudonymous push token of your device is stored for this purpose. You can deactivate push notifications at any time in the settings of your device or the app.

3.7 Location data

If you grant us the corresponding permission, we use the location of your device to show you clinics and locations near you and to support pairing with a Bluetooth scale or an activity tracker. You can withdraw location access at any time in your device’s system settings; the app can then still be used with reduced functionality.

3.8 Connected devices and health platforms

If you wish, you can connect the app to a compatible Bluetooth body analysis scale, an activity tracker or to Apple Health or Android Health Connect. In this case, the measurements you have released are transferred into the app. The scope of the release is determined exclusively by you and can be withdrawn at any time in the app or in the settings of the respective health platform. We do not pass any data from the app to Apple Health or Health Connect for advertising purposes.

3.9 Support and customer service

If you contact us via the app, by email or by phone, we process your contact details and the content of your enquiry in order to handle and answer it. We record the matter in our ticket system.

3.10 Error analysis

To improve stability, we process crash reports as well as device and operating system information. This processing takes place only if you have given us your consent when first starting the app or in the app settings. You can withdraw your consent at any time with effect for the future in the app settings.

We do not use any third-party advertising, tracking or profiling technologies for marketing purposes in the app. We do not sell your health data.

§ 4 Purposes and legal bases of processing

Where we base processing on a legitimate interest under Art. 6(1)(f) GDPR, we have first checked that your interests, fundamental rights and freedoms do not override it. We will inform you of the result of this balancing on request.

§ 5 Health data and consent

(1) The app processes health data. Under Art. 9(1) GDPR, processing it is in principle prohibited and permitted only if one of the exceptions in Art. 9(2) GDPR applies.

(2) We base the processing of your health data in the app on your explicit consent under Art. 9(2)(a) GDPR, which you give separately when setting up your user account – that is, not merely by using the app. Where the processing takes place in the context of your specific treatment with us, we additionally base it on Art. 9(2)(h) GDPR in conjunction with § 22(1) no. 1(b) BDSG (processing by or under the responsibility of medical personnel who are subject to professional secrecy).

(3) Your consent is voluntary. You can withdraw it at any time with effect for the future without this causing you any disadvantage for your treatment. You can declare the withdrawal in the app settings or send it informally to datenschutz@weight-doctors.de. The withdrawal does not affect the lawfulness of the processing carried out up to that point. After withdrawal, we delete the data concerned, unless a statutory retention obligation or another legal basis precludes deletion (see § 9).

(4) The app is not a substitute for medical advice, diagnosis or treatment.

§ 6 Access to functions of your device

For individual functions, the app needs access to permissions on your device. Access only takes place after you have granted it in your operating system’s permission dialogue, and it can be withdrawn at any time in the system settings:

The storing of information on your device and access to it are governed by § 25 TDDDG. For access that is not technically strictly necessary, we obtain your consent.

§ 7 Recipients of your data

(1) Within our company, only those persons who need it to fulfil the purposes stated above have access to your data. Medical personnel are additionally bound by medical confidentiality (§ 203 StGB).

(2) We use carefully selected service providers who process your data on our behalf and in accordance with our instructions (processors under Art. 28 GDPR). We have concluded data processing agreements with them. The categories are as follows: development, maintenance and technical operation of the app, hosting and data centre services, sending of push notifications, emails and text messages, ticket and support systems, appointment and practice management, and error analysis. These service providers have access to your data solely to provide the respective service and are bound to confidentiality.

(3) If you select a clinic or location in the app or are being treated there, we pass the data required for your treatment on to the respective facility. Recipients can in particular be:

Westfalenklinik Fachklinik für Plastische und Ästhetische Chirurgie GmbH, Rosemeyerstr. 2–4, 44139 Dortmund
Weight Doctors Worldwide GmbH, Rosemeyerstr. 2–4, 44139 Dortmund
Hair Doctors GmbH, Rosemeyerstr. 2–4, 44139 Dortmund
AKH Alster-Klinik Hamburg GmbH, Rothenbaumchaussee 7, 20148 Hamburg
Klinik am Seestern GmbH, Am Seestern 4, 40547 Düsseldorf
Lincura GmbH, Hauptmarkt 11, 90403 Nuremberg
Main-Tauber-Klinik GmbH, Rotkreuzstr. 2, 97877 Wertheim
Bürgerspital Wertheim gGmbH, Rosemeyerstr. 2–4, 44139 Dortmund
Medisch Centrum Waalre B.V., Van Dijklaan 9, 5581 WG Waalre, Netherlands

(4) Data is transferred to other third parties only if you have consented, if this is necessary to perform the contract or if we are legally obliged to do so. This may in particular be the case towards courts, law enforcement and supervisory authorities, and also to prevent misuse and fraud and to protect the security of our users.

(5) In the event of a merger, a company acquisition or a transfer of business units, your data may pass to the acquiring legal entity. We will inform you before your data is transferred and becomes subject to a different privacy policy. The legal basis is Art. 6(1)(f) GDPR.

(6) The app is obtained via the app store of the respective operating system provider (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland, or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The respective store operator is responsible for the data processing that takes place there during download; we have no influence over it.

§ 8 Transfer to third countries

Your data is processed on servers within the European Union or the European Economic Area. Your health data is not transferred to third countries.

When push notifications are sent via the services of Apple and Google, processing in the USA may occur in individual cases. This takes place on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework under Art. 45 GDPR and, in addition, on the basis of the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR. You can obtain a copy of the respective safeguards on request at datenschutz@weight-doctors.de.

§ 9 Storage period and deletion

(1) We store your personal data only for as long as is necessary for the stated purposes or as statutory retention periods require.

(2) In detail:

• Account and master data: for as long as your user account exists.
• Health and progress data recorded in the app, and measurements from connected devices: until you delete the data or your account or withdraw your consent.
• Messages with your treatment team: two years; where they form part of the treatment records, the periods in the next item apply.
• Treatment records: as a rule 10 years after the end of treatment (§ 630f (3) BGB, § 10 (3) MBO-Ä); longer in cases regulated by law.
• Log and security data: as a rule 30 days, in cases of misuse until the matter has been clarified.
• Documents relevant under commercial and tax law: 6 or 10 years (§ 257 HGB, § 147 AO).

(3) To determine the appropriate storage period, we take into account the amount, nature and sensitivity of the data, the risk of unauthorised use or disclosure, the purposes of processing and the applicable legal requirements.

(4) Deletion of your account: You can delete your user account and the data associated with it at any time in the settings of your user account in the app. Alternatively, an informal message to datenschutz@weight-doctors.de. is sufficient. After deletion, your data cannot be restored. Data that is subject to statutory retention obligations is blocked for the duration of those obligations and then deleted.

§ 10 Data security

(1) We take technical and organisational measures under Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. These include in particular the encryption of all connections between the app and servers (TLS), a role-based authorisation concept, logging of access, and regular review and updating of our measures in line with the state of the art.

(2) Please protect your access yourself: use a strong password used exclusively for this app, made up of upper- and lower-case letters, digits and special characters, activate the device lock (PIN, Face ID or Touch ID) and do not pass on your login details. We cannot be held liable for access to your account that results from your login details being passed on or from an inadequately protected device. If you suspect that your account is being misused, please contact us immediately.

(3) Despite the greatest care, no data transmission over the internet and no storage can be absolutely secure.

§ 11 No automated decision-making

Automated decision-making, including profiling, under Art. 22 GDPR does not take place in the app. Evaluations and progress charts in the app serve solely for your own information and do not replace a medical assessment.

§ 12 Links to third-party services

This privacy policy applies exclusively to the app. The app may contain links to websites that are not operated or controlled by us. If you follow such a link, you reach the offering of the respective third party. We have no influence over its content and data processing and accept no responsibility for it. We recommend that you read the privacy policy of every offering you visit.

§ 13 Your rights

You have the following rights towards us with regard to the personal data concerning you:

1. Access (Art. 15 GDPR) – confirmation of whether and which data we process, as well as information on purposes, categories, recipients, storage period, origin and the existence of automated decision-making.
2. Rectification (Art. 16 GDPR) – correction of inaccurate data and completion of incomplete data. You can change your master data yourself in the app at any time.
3. Erasure (Art. 17 GDPR) – erasure of your data, provided no exception (in particular statutory retention obligations) precludes it.
4. Restriction of processing (Art. 18 GDPR).
5. Notification (Art. 19 GDPR) – information on the recipients to whom we have communicated a rectification, erasure or restriction.
6. Data portability (Art. 20 GDPR) – release of the data you have provided in a structured, commonly used and machine-readable format, or its direct transmission to another controller, where technically feasible.
7. Objection (Art. 21 GDPR) – see the separate notice below.
8. Withdrawal of consent given (Art. 7(3) GDPR) – at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point.
9. Complaint to a supervisory authority (Art. 77 GDPR).

To exercise these rights, an informal message to datenschutz@weight-doctors.de. is sufficient. To protect your data, we may ask for proof of identity before replying.

Right to object under Art. 21 GDPR
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Competent supervisory authority
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf
Telephone: +49 (0) 211 38424-0, email: poststelle@ldi.nrw.de

Irrespective of this, you can contact the supervisory authority of your habitual place of residence or workplace.

§ 14 Minors

The app is intended for people aged 18 and over. We do not knowingly collect data from children and young people below this age limit. If you, as a parent or legal guardian, find that a minor has sent us data without your consent, please contact datenschutz@weight-doctors.de – we will then delete the data immediately.

§ 15 Changes to this privacy policy

We reserve the right to amend this privacy policy in order to adapt it to changed functions of the app, changed legal requirements or changed regulatory practice and case law. The current version is available in the app and on our website. We will inform you of material changes in advance in the app or by email. Where the changes concern processing that is based on your consent, we will obtain your consent again.

§ 16 Contact

If you have any questions about this privacy policy or the processing of your data, you can reach us at:

Weight Doctors GmbH, Rosemeyerstr. 2–4, 44139 Dortmund
Email: hallo@weight-doctors.de · Telephone: +49 (0) 231 58 98 3200

Data protection officer: Dr. Dennis Lehmkuhl · datenschutz@weight-doctors.de

Date of this privacy policy: 21 August 2026