Legal

Datenschutzerklärung / Privacy Policy

Pursuant to Art. 13–14 GDPR and § 13 DDG (Digitale-Dienste-Gesetz).

1. Controller (Verantwortlicher)

The controller responsible for the processing of personal data on this website within the meaning of Art. 4 (7) GDPR is:

Medical Contour

Marek Swietlik

Großer Burstah 23

20457 Hamburg, Germany

Email: info@scanyourfiller.com

This platform is operated in cooperation with Cutaneous and Viv. The controller for data processing on this website is Medical Contour as the platform operator and domain owner.

2. Overview of processing

The following overview summarises the categories of personal data we process, the purposes, and the legal bases. We process personal data only when and to the extent necessary to provide and operate this platform.

3. Data we process

a) User accounts, passwords & admin access

When you register for an account (admin, practitioner, or blog contributor), we process your email address and authentication data. Practitioners set their own password directly on the registration form; the password is stored by the platform infrastructure solely as a cryptographically hashed value and is never stored or transmitted in plain text. After submitting the registration form, practitioners receive a one-time verification code by email to confirm their address and activate their login. If this email is lost, a new code can be requested at any time, and a forgotten password can be reset via the "Forgot password" function — so a lost email never results in losing access to the account. Legal basis: Art. 6 (1)(b) GDPR (contract) and Art. 6 (1)(f) GDPR (legitimate interest in operating the platform).

b) Practitioner listings

Practitioners who submit their listing provide: title, first name, last name, display name, profession, clinic name, address, city, country, postal code, geographic coordinates, email, phone, website, Instagram handle, bio, languages, services, qualifications, years of experience, and a profile image. This data is published in the directory upon approval. Legal basis: Art. 6 (1)(a) GDPR (consent) for publication and Art. 6 (1)(b) GDPR for listing management.

c) Blog submissions

Blog contributors provide: title, content, excerpt, author name, author email, author clinic, author country, category, tags, and a cover image. Author name and clinic may be published with the article. Legal basis: Art. 6 (1)(a) GDPR (consent).

d) Contact & correspondence

When you contact us by email, we process the information you provide (name, email, message content) to respond to your enquiry. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in responding to enquiries).

e) Course listing payments & invoicing

When a course provider pays for a listing, we process the buyer's email address, payment amount, and payment status via our payment provider (Base44 Payments / Wix Payments) to fulfil the listing contract and issue an invoice (§ 14 UStG). The contracting party and invoice issuer for paid course listings is Marek Swietlik Handelsunternehmen (Inhaber: Marek Swietlik), Großer Burstah 23, 20457 Hamburg, Germany. The invoice is sent by email to the address provided during checkout. We do not store credit card or bank account details — these are processed exclusively by the payment provider. Legal basis: Art. 6 (1)(b) GDPR (contract performance) and Art. 6 (1)(f) GDPR (legitimate interest in tax-compliant invoicing under § 14 UStG).

4. Server log files & hosting

Our hosting provider (Strato SE, Berlin, Germany) and the platform infrastructure provider (Base44 / Wix) automatically collect and store information in so-called server log files, which your browser transmits automatically: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request, and IP address. This data is processed to enable the use of the website (connection setup) and to ensure the security and functionality of the infrastructure. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in ensuring the technical operation and security). IP addresses are stored for a limited period and deleted thereafter.

5. Cookies & local storage

This website uses technically necessary cookies and local storage to maintain user sessions (e.g. authentication tokens) and to ensure the basic functionality of the platform. These are stored on the basis of Art. 6 (1)(f) GDPR. We do not use tracking or advertising cookies. No consent tool (cookie banner) is therefore required for non-essential cookies, as none are deployed.

6. Interactive map (Leaflet)

The directory page displays an interactive map using the open-source Leaflet library. Map tiles are loaded from third-party tile providers. When the map loads, your browser establishes a connection to the tile provider's servers, which may process your IP address and potentially set cookies. We have no influence over this data processing. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in providing a usable directory map).

7. Web fonts (Google Fonts)

This website uses external web fonts provided by Google (Google Fonts). The fonts are loaded from Google servers. When loading, your browser transmits your IP address to Google. Google may use this information to provide the font service and to compile server log data. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in an appealing typographic presentation). For more information, see Google's privacy policy.

8. Instagram integration

We operate an Instagram account (@scanyourfiller) and use the Instagram Graph API to publish content (blog posts and practitioner profiles) automatically. When you view our Instagram content on Instagram's platform, Meta Platforms processes data in accordance with its own privacy policy. We are not responsible for Meta's data processing. For automated publication, we process practitioner display names, locations, and Instagram handles that have already been provided to us. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in public awareness outreach).

9. Image & file storage

Uploaded images (practitioner profile photos, blog cover images, partner logos, course images) are stored via the platform's media infrastructure (Wix Media Platform). Images may be automatically resized and re-encoded (e.g. to WebP format) for performance. Legal basis: Art. 6 (1)(a) GDPR (consent given at upload) and Art. 6 (1)(b) GDPR (provision of the listing/blog service).

10a. AI-generated content (EU AI Act Art. 50)

In accordance with Art. 50 of the EU AI Act (transparency obligations for providers and deployers of certain AI systems, applicable from 2 August 2026), we disclose the use of artificial intelligence on this platform as follows:

Blog articles: Authors submitting articles may declare that their content was generated or substantially assisted by AI. Such articles are labelled with a visible "AI-generated" badge in blog listings and on the article page. All articles — including AI-generated ones — undergo human editorial review by our admin team before publication, and the author retains full editorial responsibility for the content (Art. 50(5) exception).
Practitioner listings: All practitioner data is provided directly by the practitioners themselves and is not AI-generated.
Instagram captions: Captions published via our automated daily posting are assembled from template text and stored practitioner data. They do not use generative AI and are not AI-generated content.
Images: Practitioner profile photos and blog cover images are uploaded by users. We do not generate images using AI for publication. Branded Instagram images are created by compositing real uploaded photos with pre-written text overlays — no AI image generation is involved.

We do not operate AI chatbots or interact with users via AI systems on this platform. Where AI-generated content is published, it is always labelled in accordance with Art. 50(4)–(5) AI Act.

11. Your rights (Art. 15–22 GDPR)

You have the following rights under the GDPR:

Right of access (Art. 15) — to know what data we hold about you.
Right to rectification (Art. 16) — to correct inaccurate or incomplete data.
Right to erasure (Art. 17) — to have your data deleted ("right to be forgotten").
Right to restriction of processing (Art. 18).
Right to data portability (Art. 20).
Right to object (Art. 21) — to object to processing based on legitimate interest.
Right to withdraw consent (Art. 7 (3)) — at any time, without affecting the lawfulness of prior processing.
Right to lodge a complaint with a supervisory authority (Art. 77).

To exercise any of these rights, contact us at info@scanyourfiller.com.

12. Data retention & deletion

Personal data is stored only for as long as necessary to fulfil the purpose for which it was collected. Practitioner listings remain published until the practitioner requests removal or the listing is rejected/removed by the admin. Blog submissions and their associated author data are retained while the article is published. Server log files are deleted after a short period as defined by the hosting provider. Account data is retained for the duration of the account and deleted upon request.

13. Recipients of your data

Your data is processed by the following categories of recipients:

Strato SE (Berlin, Germany) — hosting provider.
Base44 / Wix.com — platform infrastructure and database hosting.
Google LLC — web font delivery (Google Fonts).
Meta Platforms / Instagram — social media publication.
Map tile providers — for the interactive directory map.

Some recipients (e.g. Google, Meta) are located in third countries outside the EU/EEA. Appropriate safeguards (e.g. Standard Contractual Clauses) are in place where required.

14. Children

This platform is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us so we can delete it immediately.

15. Updates to this policy

We may update this privacy policy to reflect changes in our practices or legal requirements. The date of the last update will be indicated below. We encourage you to review this page periodically.

Last updated: August 2026 (updated: password set during registration and one-time email verification). Sections marked with brackets [...] require information to be completed by the operator. For questions about data protection, contact info@scanyourfiller.com.