top of page
Logo - animiert.gif
Logo_Text_Black.png

Privacy Policy

1. Controller

David Römmler
Hypnosis Therapy Online
Warschauer Straße 31
10243 Berlin
Germany

Telephone: +49 (0) 30 2204 6607
Email: inhale@hypnosis-therapy.online

2. Supervisory authority

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
https://www.datenschutz-berlin.de

3. General principles

Personal data is processed only where necessary to provide this website, communicate with users, arrange appointments, perform contracts, process payments, comply with legal obligations or act on valid consent. Depending on the activity, the legal basis is in particular Article 6(1)(a), (b), (c) or (f) GDPR. Health data and other special categories of personal data are processed only where an additional condition under Article 9(2) GDPR is met.

4. Website hosting by Wix

This website is provided using Wix. For users in the European Economic Area, the provider is generally Wix Online Platforms Limited, Dublin, Ireland. Wix processes technical connection data, IP addresses, browser and device information, timestamps, security data, cookies and usage information to deliver and protect the website and provide its functions.

The processing is based on Article 6(1)(b) and (f) GDPR. Wix may engage affiliated companies and subprocessors outside the European Economic Area. International transfers take place only subject to Articles 44 et seq. GDPR. Further information: https://www.wix.com/about/privacy

5. Cookies and consent management

Strictly necessary cookies and similar technologies are used where required to provide a service expressly requested by the user. Analytics, advertising and other non-essential technologies are activated only after consent. The legal bases are section 25 of the German TDDDG and Article 6(1)(a) GDPR. Consent may be withdrawn through the cookie settings at any time with effect for the future.

6. Contact requests

If you contact us by form, email or telephone, the information you provide is processed to respond to your request. The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries and otherwise Article 6(1)(f) GDPR. Messages are deleted when no longer required, unless statutory retention duties apply.

Please do not send particularly sensitive health information by unencrypted email without prior arrangement.

7. Appointments and customer administration through Wix

Wix functions are used for appointment bookings, contact details, contract administration, payment status and related communications. The data may include name, contact details, selected service, appointment, payment and billing information and voluntary statements. Processing is based on Article 6(1)(b) and (c) GDPR. Voluntary health information is processed only where an additional legal basis under Article 9(2) GDPR applies.

8. Online sessions using Zoom

Online sessions are conducted through Zoom. Zoom processes connection, device, participant, audio and video information and may receive the email address associated with the invitation. Processing is necessary to perform the booked online session under Article 6(1)(b) GDPR. Where session content includes health data, an additional condition under Article 9(2) GDPR applies.

No recording is stored in the Zoom cloud. A local recording is created only following advance notice as described below. Further information: https://explore.zoom.us/en/privacy/

9. Local audio and video recording of online sessions

At the practitioner's discretion, an online session may be recorded locally in audio and video form. You will be expressly informed before a particular recording begins. If you do not accept an announced recording, the session will not be conducted or started under recording conditions.

The purposes are to document the course of the session and to establish, exercise or defend legal claims. Recordings are not published, used for advertising, used to train AI systems or routinely disclosed to third parties.

Files are stored only locally on a fully encrypted computer. David Römmler is the only person with access. Recordings are deleted no later than one year after creation unless continued retention is exceptionally necessary for a specific legal claim or statutory obligation. As recordings may contain special categories of personal data, the relevant legal basis and any required declaration will be provided and documented separately before recording begins.

10. HypnoAI – interactive self-hypnosis

HypnoAI is an AI-supported coaching service for interactive self-hypnosis. It is not psychotherapy, medical treatment, a medical or psychological diagnosis, or an emergency or crisis service. It is available only to adults.

Booking and customer master data stored in Wix are technically separate from the individual HypnoAI session. Users may use a fictional name. OpenAI and ElevenLabs do not receive direct access through HypnoAI to customer master data or booking data stored in Wix.

However, the spoken content, voice data, transcribed text, generated responses and necessary technical metadata are processed to provide the session. Information disclosed during a conversation may constitute personal data or health data. Users should disclose only information required for the coaching session.

The service providers include in particular:

  • OpenAI for AI processing and response generation

  • ElevenLabs for voice processing and speech output

  • Wix for booking, access and technical integration

Processing is based on Article 6(1)(a) and (b) GDPR. If a user voluntarily provides special categories of personal data, processing takes place only where an additional condition under Article 9(2) GDPR is met. Users are informed before the session that they are interacting with an AI system.

OpenAI, ElevenLabs and their subprocessors may process data outside the European Economic Area. Any transfer is subject to Articles 44 et seq. GDPR, including an applicable adequacy decision or appropriate Standard Contractual Clauses. Retention periods depend on the selected technical configuration and the contractually agreed settings.

11. Internal use of OpenAI and ChatGPT

Business OpenAI API services and a personal ChatGPT Plus account may be used for technical and administrative work. The business API account is organisationally separated from the personal Plus account. Customer, booking, therapy and health data are not intended to be processed in the personal Plus account. Use of content for general model improvement has been disabled for that Plus account.

A technical connection between ChatGPT/Codex and Wix results in processing of specific Wix data by OpenAI only when such data is actually retrieved and transmitted through the connection. There is no permanent or automatic transfer of the entire Wix customer database.

12. Google services

Subject to the particular activity and, where required, your consent, services provided by Google are used. These include Google Analytics, Google Ads, YouTube, Google Maps and Google Workspace services such as Gmail, Calendar, Drive and Meet.

Google Analytics and Google Ads are used for audience measurement, analysis and advertising only after consent. Embedded YouTube and Google Maps content is also loaded only after consent where information is stored on or read from your device. The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR.

Google Workspace, Gmail, Calendar, Drive and Meet are used for communication, appointment organisation, document administration and, where applicable, video communication. The legal basis is Article 6(1)(b) or (f) GDPR. Google may process data in third countries. Further information: https://policies.google.com/privacy

13. Newsletter

A newsletter is sent only with consent. The email address, time of registration and technical evidence of consent are processed under Article 6(1)(a) GDPR. Consent can be withdrawn at any time by using the unsubscribe link or contacting us by email.

14. Payments and statutory retention

Data required for payment processing and accounting is processed and, where necessary, disclosed to payment service providers, banks, tax advisers or authorities. The legal bases are Article 6(1)(b) and (c) GDPR. Tax and business records are retained for the applicable statutory periods.

15. Retention

Unless a specific period is stated, data is deleted when the purpose ceases to apply and no legal retention obligation or overriding lawful ground requires continued storage. Statutory periods may in particular be six, eight or ten years. Limitation periods and evidence requirements may justify longer retention in individual cases.

16. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, data portability and objection. Consent may be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

17. No solely automated decisions

No solely automated decision is made that produces legal effects concerning you or similarly significantly affects you. HypnoAI responses are automatically generated but do not constitute a binding decision about you.

18. Minors

The therapeutic services and HypnoAI are intended exclusively for persons aged 18 or over. Use by minors is prohibited.

19. Last updated

July 2026. This policy will be updated if the services, data flows or legal requirements change.

bottom of page