This is a translation for your convenience. Only the German version is legally binding: Datenschutzerklärung (in German).
Contents
1. General information
We, PharmaCare GmbH (hereinafter PharmaCare), thank you for visiting our website.
In this privacy policy we explain in detail which personal data we process when you use and visit our website, and we inform you of your rights with regard to the processing of your personal data.
We only process your personal data if you have given your express and voluntary consent or if there is another legal basis. We only pass your data on to third parties if you have consented or if we are legally obliged to do so. At PharmaCare, only those employees who need your data to perform their tasks have access to it. They are bound to confidentiality.
2. Contact details and contact persons
Controller
PharmaCare GmbH
Raiffeisenallee 16
82041 Oberhaching
Germany
Legally represented by the managing directors (Geschäftsführer) Werner Bauer and Dirk Bauer
Phone: 089 219 66 88 70
Fax: 089 219 66 88 76
Email: info@pharmacare.de
Data protection officer
You can reach our data protection officer at datenschutz@pharmacare.de or at our postal address, marked “Datenschutzbeauftragter” (data protection officer).
3. Visiting our website
Technically necessary data
When you visit our website, we process and store data that your browser transmits and that result from the internet connection. These data are technically necessary to display the website to you and to operate it in a stable and secure manner. The processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. These data are not combined with other data sources. The following data are stored in so-called log files for 7 days and then deleted:
- IP address
- date and time of the request
- time zone difference to Greenwich Mean Time (GMT)
- content of the request (specific page)
- access status/HTTP status code
- amount of data transferred in each case
- website from which the request comes
- browser
- operating system and its interface
- language and version of the browser software
Hosting
Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. IONOS processes the data listed above on our behalf and on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Delivery and protection by Cloudflare
To make sure our website can be reached quickly and securely, we use the service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Every request to our website passes through Cloudflare servers. In the process, Cloudflare processes the technically necessary data listed above, in particular your IP address, in order to deliver the pages and fend off attacks. The legal basis is our legitimate interest in secure and stable operation pursuant to Art. 6(1)(f) GDPR. Cloudflare processes the data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is therefore covered by an adequacy decision of the European Commission pursuant to Art. 45 GDPR. You can find further information in Cloudflare’s privacy policy at www.cloudflare.com/de-de/privacypolicy.
No cookies, no analytics
Our website does not use cookies or any comparable technologies for visitors. We do not use any analytics or advertising services and do not load any content from other providers; the fonts are also stored on our own server. The exception is YouTube videos – only once you start a video (see YouTube videos). The chat at the bottom right (PharmaCare assistant) runs on our own service in Microsoft Azure and sets no cookies.
Links to social networks
In the footer of every page we link to our profiles on Facebook, Instagram, YouTube and X. These are simple links: when you visit our website, nothing is loaded from these networks and no data are transferred to them. Only when you click a link does the page of the respective provider open; its privacy policy applies there. Please do not send us any information about your health or your supplies via these networks; please use the contact options in section 4 for this.
YouTube videos
On some pages we show videos from our YouTube channel. When you open the page, you initially only see a preview image stored on our own server; nothing is transferred to YouTube. Only when you start a video does your browser load it from YouTube via youtube-nocookie.com. In doing so, YouTube receives, among other things, your IP address, the address of our page and information about your browser, and may use cookies or similar technologies. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may also be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.
The legal basis is your consent, which you give by starting the video (Art. 6(1)(a) GDPR, § 25(1) TDDDG, German Telecommunications Digital Services Data Protection Act); we point this out beforehand below each video. You can also watch the videos directly on YouTube without them being embedded. What Google does with the data is explained in Google’s privacy policy.
Product search
The product search on the “Products” page (Produkte) searches our list of items on our own server. For this purpose, your search term is transferred to our server and, like every address requested, appears in the server log (see “Technically necessary data”). Beyond that, we do not store or analyse search terms; the search does not set any cookies.
4. Contacting us
Phone, fax, post and email
If you contact us by phone, fax, post or email, we process and store the data you provide (such as your email address, your name and your phone number) in the context of performing a contract or as a pre-contractual measure pursuant to Art. 6(1)(b) GDPR.
We delete these data as soon as processing is no longer necessary, or restrict processing if statutory retention obligations apply.
Callback via the form
Using the “Request a callback” form, you can ask us to call you back. For this purpose we process your name, your phone number and your preferred time and, if you provide them, your request and your customer number. The details are not stored on the website but sent as an email to our customer service. To send it, we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, on the basis of a data processing agreement pursuant to Art. 28 GDPR.
To protect against misuse, we check technical characteristics when the form is submitted, such as the time taken to fill it in, and count the requests per internet connection. For this we store a checksum of your IP address, not the address itself, for no longer than one hour. We do not set any cookies for this.
The legal basis is Art. 6(1)(b) GDPR where your request concerns or initiates a contract with us; otherwise it is our legitimate interest in answering requests quickly and preventing misuse (Art. 6(1)(f) GDPR). We delete your details as soon as your request has been dealt with, unless retention obligations prevent this.
PharmaCare assistant (AI chat)
With the chat button at the bottom right you can write to the PharmaCare assistant. The assistant is an artificial intelligence (AI), not a person. It answers general questions using the content of this website. On request it passes the chat on to our customer service; a member of staff (first name only) then replies in the same window. If nobody is available, you can request a call back.
Which data: your messages, the replies, the page on which you opened the chat, the language and the time. We do not store your IP address; we only derive a code from it that changes daily, to limit misuse. Before the chat is passed on to customer service, the name we should use for you if you wish (optional, you can stay anonymous). For a call back, also your name and phone number. Please do not share health details, insurance numbers or other personal data in the chat; we discuss personal matters by phone.
Where and how long: the chat runs in Microsoft Azure in Frankfurt (region Germany West Central). The AI replies are generated by a language model from OpenAI operated by Microsoft in Azure; processing takes place only in data centres in the EU (Azure “Data Zone EU”). OpenAI does not receive your messages, and they are not used to train AI models. To detect abuse, Microsoft may keep inputs for up to 30 days in the EU. We delete the chat history after 7 days. If the chat is passed on to our customer service or you request a call back, the history is also stored in Microsoft Teams with our staff. After a chat with our staff has ended, we file it in Microsoft Teams for the head of customer service (quality assurance, follow-up questions) and delete it there automatically after 30 days. Microsoft is our data processor.
Cookies: none. So that the chat continues when you change page, your browser keeps a random chat ID for this tab only (session storage); it disappears when you close the tab.
Legal basis: Art. 6(1)(b) GDPR where it concerns preparing or providing your supply, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering your questions quickly). Use is voluntary; you can always reach us by phone as well.
If you contact us via the messaging service WhatsApp, we use your phone number to communicate with you via WhatsApp. In addition, we process other personal data stored with WhatsApp, in particular your first name and surname, your device, your profile picture and messages and files that you send us via the app.
Purpose and scope: We process your mobile number to identify you. We use your name and profile picture, as provided by WhatsApp, for display purposes. We store your communication with us as conversation content in text form so that we can use it as context for later conversations. This also includes delivery and read receipts; they serve to ensure smooth receipt and to clear out inactive contacts. Your messages are read by our customer service team; they are stored on secured PharmaCare mobile devices.
Recipients and transfer to third countries: If you contact us via WhatsApp, WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, also processes your data under your terms of use with WhatsApp. WhatsApp collects data independently; the purpose and scope of this collection and the further processing by WhatsApp are beyond our control. WhatsApp Ireland is the controller for the service within the meaning of the GDPR, and the competent supervisory authority is the Irish Data Protection Commission. WhatsApp also stores data in countries outside the EU, in particular in the USA, and, as part of the Meta group, exchanges it with other services of the group; we have no influence over this. You can find more details in WhatsApp’s privacy policy at www.whatsapp.com/legal/privacy-policy-eea.
Storage period: We use the data exclusively to communicate with you and delete them at your request or at the latest when they are older than twelve months. You can also request deletion directly from WhatsApp.
Legal basis: The processing of the information and personal data that you provide to us via WhatsApp is based on our legitimate interest in offering you a messaging service as a means of contact (Art. 6(1)(f) GDPR). If you contact us in order to perform a contract or take pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR.
Signal
We offer the Signal messenger as a way for customers and interested parties to contact us. The provider is Signal Messenger LLC, 650 Castro Street, Suite 120-223, Mountain View, CA 94041, USA. When you use Signal, the terms of use and privacy policy of Signal apply, which you have agreed to yourself. We have no influence on the data that Signal processes when you use it.
Data processed by Signal: Messages, images and calls are end-to-end encrypted; the message history is stored on the devices, not by Signal. According to Signal, it processes your phone number, technical keys and identifiers; contacts are only matched in encrypted form. Signal transfers encrypted data and metadata to the USA and other countries where it operates servers. More information: signal.org/legal.
Processing by PharmaCare: We see the name and, where applicable, the phone number you provide in Signal, and the content of your messages. Only if you want to be supplied do we need your contact details such as phone number and address. We treat all chats confidentially; we delete chat histories older than twelve months.
Legal basis: The processing of information and personal data you provide to us via Signal is based on our legitimate interest in offering you a messenger service as a way to contact us (Art. 6(1)(f) GDPR). If your contact serves the performance of a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. Please only send health data such as photos of prescriptions if you agree to them being transmitted via Signal; alternatively, use the post or our upload.
5. Data processing to comply with legal obligations
As a rule, we delete or block personal data as soon as the purpose of the processing no longer applies. However, it may be necessary to store personal data beyond that point, for example because of legal obligations.
Retention periods for business records
Under commercial and tax law requirements, we are obliged to retain the address, payment and order data of our business partners for ten years. This processing is a legal obligation for us; the legal basis is Art. 6(1)(c) GDPR.
Reporting obligations (pharmacovigilance)
If we receive information or a report in connection with the use of our medicinal products, we are legally obliged to record it in a structured way and forward it to the competent medicines regulatory authorities.
In doing so, we process personal data of the person making the report and of the patients concerned. The legal basis is compliance with statutory obligations to monitor the safety of medicinal products pursuant to Art. 6(1)(c) and Art. 9(2)(i) GDPR in conjunction with Implementing Regulation (EU) No 520/2012.
The data are transferred to appropriately authorised bodies solely to clarify the facts and to fulfil the reporting obligations. We store them for the duration of the marketing authorisation of the medicinal product and for a further ten years thereafter.
6. Data transfer to or access by third parties
In the course of our business, we use service providers and partners on the basis of our legitimate interests, for example IT service providers to provide and maintain our hardware and software, printing service providers, debt collection agencies or other service personnel.
In this context, our business partners may also gain knowledge of personal data. We therefore appropriately oblige our partners to maintain confidentiality and data secrecy, and we limit their access to personal data to a minimum.
We have carefully selected and commissioned our service providers; they are bound by our instructions and are checked regularly. Other recipients may be bodies to which you expressly consented to the transfer when your data were collected, or to which we must transfer personal data because of a legal obligation.
7. Your rights
Under the General Data Protection Regulation (GDPR, Datenschutz-Grundverordnung, DSGVO), you have various rights, which arise in particular from Art. 15 to 18, 20 and 21 GDPR.
Right of access
Pursuant to Art. 15 GDPR, you can request information about your personal data processed by us. Please be specific about your request so that we can compile the necessary data more easily. In certain circumstances, your right of access may be restricted under statutory provisions, in particular § 34 BDSG (German Federal Data Protection Act).
Right to rectification
If the information concerning you is not (or no longer) accurate or is incomplete, you can request its rectification or completion pursuant to Art. 16 GDPR.
Right to erasure
You can request the erasure of your personal data under the conditions of Art. 17 GDPR. Whether you are entitled to this depends, among other things, on whether we still need the data to fulfil legal obligations.
Right to restriction of processing
Within the scope of Art. 18 GDPR, you have the right to request that the processing of data concerning you be restricted.
Right to object
Pursuant to Art. 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of data concerning you. However, we cannot always comply with this, for example if legal provisions oblige us to process the data.
Right to data portability
Pursuant to Art. 20 GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller, provided that the processing is based on your consent or on a contract with us and is carried out by automated means. Where technically feasible, you can also request that we transmit the data directly to another controller.
Withdrawal of consent
If you have consented to the processing of your data, you can withdraw this consent at any time with effect for the future.
Right to lodge a complaint
If you wish to exercise your rights or have questions about data protection, please contact our data protection officer by email at datenschutz@pharmacare.de or at the postal address given above.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority, www.lda.bayern.de).
As of: September 2026