Privacy Policy

Memberships & Users

As of: August 2026

The protection of your personal data is of particular importance to Mediora GmbH. We process your data exclusively on the basis of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and other applicable legal provisions.

With this Privacy Policy, we inform you about which personal data we collect, why we process it, to whom data is disclosed, and what rights you have.

1. Data Controller

Mediora GmbH

Zieglergasse 2/2
1070 Vienna
Austria

VAT ID: ATU82358128

Email: info@mediora.com

Phone: +43 1 448 00 60

2. Scope

This Privacy Policy applies to all services provided by Mediora GmbH, in particular

• visiting our health center,
• all memberships,
• the purchase and use of Mediora Credits,
• our online shop,
• our website,
• our mobile applications,
• our appointment booking systems,
• events,
• consultations,
• information sessions,
• newsletters,
• and all other digital services provided by Mediora GmbH.

It applies both to members and to visitors, prospective customers, customers, event participants, and users of our online shop.

3. What Personal Data We Process

Depending on your use of our services, we process, in particular, the following personal data:

Master data

• first and last name,
• date of birth,
• gender (where required),
• address

Contact data

• phone number,
• mobile phone number,
• email address

Contract data

• membership,
• booked services,
• purchased Credits
• payment status,
• contract term,
• vouchers,
• discount promotions

Payment data

• billing address,
• VAT ID (for businesses),
• payment method,
• transaction numbers,
• invoices,
• payment history

As a general rule, Mediora does not store complete credit card data.

Appointment and usage data

To organize your visit, the following may in particular be processed:

• booked appointments,
• applications used,
• consumed Credits
• cancellations,
• attendance times,
• access data

Health-related information

Insofar as this is necessary for the safe use of individual applications, health-related information may be processed.

This includes, for example, but is not limited to,

• known contraindications,
• pregnancy,
• implanted electronic devices,
• allergies,
• and other voluntarily disclosed health restrictions.

Processing takes place exclusively to the extent necessary and in compliance with statutory data protection provisions.

Communication data

When you contact us, we may store, for example,

• emails,
• contact forms,
• phone notes,
• chat messages,
• support requests

Technical data

When you visit our website or use our digital services, the following may be processed automatically:

• IP address,
• browser type,
• operating system,
• language settings,
• device information,
• time of access,
• pages visited,
• referrer URL,
• cookie information

Video surveillance

To protect our visitors, staff, medical equipment and facilities, selected areas of our health center are monitored by video surveillance.

The following areas are not monitored

• treatment rooms with particular privacy requirements,
• sanitary areas,
• and changing rooms.

The retention period is generally a maximum of seven days, unless a longer statutory retention period is required.

4. Purposes of Data Processing and Legal Bases

Mediora processes personal data only to the extent that this is necessary to fulfill contractual obligations, to comply with legal requirements, or on the basis of your consent.

Depending on the type of services you use, processing takes place in particular for the following purposes:

• performing and managing your membership
• managing your Credit account
• processing orders in the online shop
• scheduling and managing appointments
• access and security management
• conducting instruction and training on equipment
• customer service and communication
• invoicing and accounting
• fulfilling statutory retention obligations
• IT security and misuse prevention
• quality assurance
• managing vouchers, discount promotions and events
• handling support requests
• carrying out legally required documentation

Insofar as health-related information is processed, this takes place exclusively

• with your explicit consent,
• insofar as this is necessary for the safe performance of the desired application,
• or on the basis of legal obligations.

Processing takes place in particular on the basis of

• Art. 6(1) (a) GDPR (consent)
• Art. 6(1) (b) GDPR (performance of a contract)
• Art. 6(1) (c) GDPR (legal obligation)
• Art. 6(1) (f) GDPR (legitimate interest)
• Art. 9(2) (a) GDPR (consent to the processing of special categories of personal data)
• Art. 9(2) (h) GDPR (health or social care), insofar as legally applicable.

5. Shared Infrastructure with the Practice of Dr. Leon Golestani

Mediora GmbH and the practice of Dr. Leon Golestani are located at the same site and partly use shared organizational and technical infrastructure.

This includes, in particular:

• reception,
• telephony,
• appointment coordination,
• shared premises,
• network and IT infrastructure,
• security and access systems,
• internal administrative processes, and
• shared medical infrastructure.

Due to this shared infrastructure, personal data, in particular master data, contact data, appointment details and organizational information, is exchanged between Mediora GmbH and the practice of Dr. Leon Golestani, insofar as this is necessary for appointment organization, on-site care, billing, security, or use of the shared infrastructure.

As a general rule, medical treatment data is only made accessible to the practice of Dr. Leon Golestani once a patient or treatment relationship is established with the practice. From that point on, the medical data required for medical care, treatment planning, documentation and safe delivery of treatment is released and processed for the practice within the shared infrastructure.

If you do not wish for medical data already held by Mediora to also be made accessible to the practice of Dr. Leon Golestani once a treatment relationship is established, you must expressly notify us of this before treatment begins. In this case, data access will be restricted accordingly, insofar as this is legally permissible and organizationally possible for the treatment.

The practice of Dr. Leon Golestani is independently responsible under data protection law for processing medical patient data within the scope of the respective treatment relationship. Mediora GmbH remains responsible for the processing of data within the scope of its own services, memberships, applications and administrative processes.

6. IT Systems, Software and Processors Used

To provide our services, we use carefully selected external service providers and software solutions. Insofar as these process personal data on our behalf, this takes place exclusively on the basis of a data processing agreement pursuant to Art. 28 GDPR or another applicable legal basis under data protection law.

Depending on the service used, the following systems, among others, may be used:

Membership Management, CRM and Inventory Management

Odoo

For managing memberships, customer contacts, offers, invoices, inventory management, warehouse management, appointment organization, and internal business processes.

Processed data may include, in particular:

• master data
• contact data
• memberships
• Credit account
• orders
• invoices
• payments
• communication

Online Shop

Shopify Inc.

We use Shopify to operate our online shop and to manage orders, memberships and Credit purchases.

In doing so, the following may in particular be processed:

• name
• address
• email address
• phone number
• orders
• payment information
• delivery data
• IP address
• device information

Further information can be found at:

https://www.shopify.com/legal/privacy

Practice Software

SoftDent

The practice software SoftDent is used to manage medical treatments within the practice of Dr. Leon Golestani.

The processing of medical patient data falls exclusively within the responsibility of the respective practice.

Email and Communication

For our business communication, we use, in particular,

• Google Workspace
• Microsoft 365 / Exchange Online

Through these, in particular

• emails,
• calendars,
• contacts, and
• documents

are processed.

Payment Processing

Depending on the payment method selected, payment processing is carried out by external payment service providers.

These may in particular include:

• Shopify Payments
• Stripe
• PayPal
• SumUp

The privacy policy of the respective payment service provider applies.

As a general rule, Mediora does not receive complete credit card information.

Appointment Management and Member Portal

Internal digital administrative systems are used for appointment booking, member management, Credit management, and booking processes.

In doing so, the following may in particular be processed:

• appointments
• booked applications
• Credit consumption
• waiting lists
• notifications
• membership status

Cloud Storage

Cloud services may be used for the secure storage and management of documents.

These include, in particular:

• Google Drive
• Microsoft OneDrive

Video Surveillance

A digital video surveillance system is operated to secure the health center.

Processing takes place exclusively for security purposes.

IT Service Providers

For the maintenance of our IT infrastructure, external IT service providers may be granted access to personal data, insofar as this is necessary for troubleshooting, maintenance, or system security.

These service providers are contractually obligated to maintain confidentiality and comply with data protection provisions.

The systems and service providers used may change due to technical developments or operational requirements. The respective current overview is set out in the version of this Privacy Policy in effect at the time of data processing.

7. Disclosure of Personal Data

Your personal data will only be disclosed insofar as this is

• necessary to fulfill our contractual obligations,
• necessary to provide the services you have requested,
• required by legal obligations,
• necessary to safeguard legitimate interests, or
• based on your explicit consent

required.

Recipients of personal data may in particular include:

• the practice of Dr. Leon Golestani, within the scope of the shared infrastructure described in this Privacy Policy,
• physicians chosen by you or providing your treatment,
• external medical service providers,
• payment service providers,
• tax advisors and auditors,
• banks,
• insurance companies (where necessary),
• IT service providers,
• software providers,
• hosting providers,
• shipping service providers,
• authorities and courts, where a legal obligation exists.

Your data will not be disclosed beyond this.

8. Data Transfers to Third Countries

Some of the service providers we use (e.g. Google, Microsoft or Shopify) may also process personal data outside the European Economic Area (EEA), in particular in the United States of America.

Insofar as such a transfer takes place, we ensure that it is carried out exclusively on the basis of the legal requirements of the GDPR.

This is done in particular on the basis of

• an adequacy decision of the European Commission,
• the EU Standard Contractual Clauses,
• or other appropriate safeguards pursuant to Art. 44 et seq. GDPR.

9. Retention Period

We store personal data only for as long as necessary to fulfill the respective purposes or for as long as statutory retention obligations require.

The retention period is determined in particular by

• tax-related retention obligations,
• corporate law retention obligations,
• statutory documentation obligations,
• warranty and limitation periods,
• legitimate interests in legal defense.

Health-related data is stored exclusively in accordance with the applicable statutory provisions.

Once the respective purpose of processing ceases to apply and statutory retention periods have expired, personal data is deleted or anonymized, unless there is a further legal basis for its processing.

10. Data Security

The protection of your personal data is of the utmost priority to Mediora GmbH.

We implement appropriate technical and organizational measures against

• loss,
• misuse,
• unauthorized access,
• alteration,
• disclosure, or
• destruction

in order to protect personal data.

These include, in particular,

• role-based access permissions,
• encrypted data transmission,
• password-protected systems,
• regular data backups,
• firewall and network protection,
• access restrictions,
• logging of security-relevant access,
• regular software updates, and
• training of our staff in data protection and information security.

Despite all security measures, complete security cannot be guaranteed for electronic data transmission or storage.

11. Your Rights

Under the provisions of the General Data Protection Regulation, you are entitled, in particular, to the following rights:

• the right to access pursuant to Art. 15 GDPR,
• the right to rectification pursuant to Art. 16 GDPR,
• the right to erasure pursuant to Art. 17 GDPR,
• the right to restriction of processing pursuant to Art. 18 GDPR,
• the right to data portability pursuant to Art. 20 GDPR,
• the right to object to certain processing pursuant to Art. 21 GDPR,
• the right to withdraw consent given, with effect for the future.

You may contact Mediora GmbH at any time to exercise your rights.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

12. Right to Lodge a Complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with the competent data protection authority.

The competent supervisory authority in Austria is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria

Phone: +43 1 52 152-0

Web: https://www.dsb.gv.at

13. Website, Cookies and Comparable Technologies

Our website uses cookies and comparable technologies (e.g. pixels, local storage technologies or similar services) to ensure the secure operation of the website, improve usability, and — insofar as you have consented — carry out statistical analyses and marketing measures.

Cookies are small text files that are stored on your device and allow your browser to be recognized.

We distinguish, in particular, between the following categories:

Technically necessary cookies

These cookies are required for the operation of the website and the online shop. Without them, essential functions such as login, shopping cart, appointment booking or security mechanisms cannot be provided.

These cookies cannot be disabled.

Functional cookies

These cookies store settings you have chosen, such as language or other user preferences, to make your next visit more convenient.

Analytics cookies

With your consent, we use analytics tools for statistical evaluation of the use of our website. This allows us to continuously improve our online offering.

In doing so, information about

• page views,
• time spent on page,
• click behavior,
• device,
• browser type, and
• approximate location

may in particular be processed.

Marketing cookies

With your consent, cookies may be used to display interest-based advertising to you on other websites or social networks, or to measure the success of our advertising measures.

You can withdraw or change your consent at any time via our cookie banner or the cookie settings.

14. Newsletter and Electronic Communication

If you subscribe to our newsletter or explicitly consent to receiving information, we process your personal data to send information about

• new applications,
• events,
• offers,
• memberships,
• promotions,
• medical professional events,
• seminars, and
• other news from Mediora GmbH.

External newsletter service providers may be used for sending.

You can withdraw your consent at any time with effect for the future. A corresponding unsubscribe link is included in every newsletter.

15. Social Media

Mediora GmbH operates company profiles on various social networks.

These may in particular include:

• LinkedIn
• Facebook
• Instagram
• YouTube
• TikTok

When visiting these platforms, the privacy policy of the respective platform operator also applies.

Insofar as you contact us via social networks, we process your data exclusively to handle your inquiry and to communicate with you.

16. External Content

Our website may embed content or services from external providers.

These include, for example,

• Google Maps,
• YouTube,
• Vimeo,
• embedded forms,
• appointment booking systems,
• payment services,
• map material, or similar services.

Accessing such content may result in data being transmitted to the respective provider.

Insofar as your consent is required for this, such content is only embedded after corresponding consent has been given.

17. Automated Decisions

As a general rule, Mediora GmbH does not engage in decision-making based exclusively on automated processing, including profiling, pursuant to Art. 22 GDPR.

18. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy where this becomes necessary due to technical developments, new legal requirements, organizational changes, or the introduction of new services.

The version published at the time of your visit to our website or your use of our services shall apply.

19. Contact

If you have any questions about data protection or the processing of your personal data, you may contact us at any time.

Mediora GmbH

Zieglergasse 2/2
1070 Vienna

Email: info@mediora.com

20. Final Provisions

Should individual provisions of this Privacy Policy be or become invalid, this shall not affect the validity of the remaining provisions.

This Privacy Policy is governed by Austrian law, taking into account the directly applicable provisions of the General Data Protection Regulation (GDPR).