Privacy Notice

Controller under the GDPR

immo.quick Global UG (haftungsbeschränkt) i.G.
Product and system brand: BestCura
Barbarastr. 9
45527 Hattingen
Germany
Represented by: Rami Cherri

Contact: info@bestcura.com

For privacy requests, you may use this email address or the contact form and clearly identify your message as a privacy request. Do not submit patient, resident or health data through the general form.

No data protection officer is currently identified on this website. If a statutory appointment obligation arises or a DPO is appointed, the contact details will be published here.

Privacy principles

The public BestCura website is designed for data minimization. Personal data is processed only as required for technical delivery, security, communication or handling inquiries. Article 5 GDPR principles apply, including lawfulness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality.

The public website is not intended to collect patient, resident, treatment or other special-category data under Article 9 GDPR.

Hosting, technical delivery and infrastructure

IONOS

Hosting and domain infrastructure is provided through IONOS. Where IONOS processes personal data on our behalf, this is subject to Article 28 GDPR processor arrangements. IONOS describes technically necessary access processing for its web-hosting products and notes that certain visitor data may be anonymized at collection.

Netlify

Netlify is additionally used for deployment, delivery and technical website functions. The contact form uses Netlify Forms. Form submissions may be stored in Netlify's backend until deleted by BestCura or otherwise processed in line with the relevant purpose. Netlify provides a Data Processing Agreement for processor activities.

Technical roles: Depending on the resource and delivery path, IONOS and Netlify may both be involved in processing technically necessary data. The infrastructure description is reviewed whenever the deployment architecture changes.

Server, log and connection data

Accessing the website may involve processing an IP address or truncated/anonymized IP information, date and time, requested resource, referrer information, browser type/version, operating system, device type and technical status or error information.

Purpose: secure and stable delivery, prevention of abuse and attacks, troubleshooting and technical administration.

Legal basis: Article 6(1)(f) GDPR based on our legitimate interest in a secure, functional and reliable website. Article 6(1)(c) GDPR may apply where processing is required by law.

Contact form and inquiries

If you contact us through the website form, we process in particular your name, email address, message content and technically necessary transmission data.

Purpose: handling your inquiry, initiating business or institutional discussions and necessary follow-up communication.

Legal basis: Article 6(1)(b) GDPR for contract-related or pre-contractual inquiries; otherwise Article 6(1)(f) GDPR based on our legitimate interest in appropriate communication.

No health data: The general contact form is not intended for diagnoses, medication data, care information or other patient-related content.

BestCura periodically reviews contact submissions for continued necessity and deletes data no longer required. Statutory retention rules may require longer storage if an inquiry becomes part of a business transaction.

Devices, cookies, local storage, tracking and external content

The delivered BestCura website code currently sets no marketing or profiling cookies, no embedded analytics or advertising trackers, and no first-party local-storage mechanism for recognizing returning visitors. Root-language routing uses the language reported by the browser without persistent storage.

Section 25 TDDDG generally requires consent when information is stored on or accessed from a user's terminal equipment unless a statutory exception applies. Consent-requiring technologies are therefore not introduced without the necessary consent mechanism.

No cookie banner is shown merely as a precaution under the current technical setup because the website code does not intentionally deploy consent-requiring tracking or marketing technologies. If this changes, an appropriate consent mechanism will be placed before activation of the relevant technology and this notice will be updated.

AI-generated content and EU AI Act transparency

BestCura uses AI-generated or AI-assisted concept visuals and illustrations on parts of the public website. They explain architecture, care situations or product concepts and do not depict an actual customer, patient or treatment situation unless expressly stated.

Article 50 of Regulation (EU) 2024/1689 distinguishes provider duties concerning machine-readable detectability of synthetic outputs from deployer disclosure duties in specific situations, including deepfakes. BestCura applies an additional transparency standard: AI-generated or materially AI-edited concept visuals are visibly labelled “AI-GENERATED CONCEPT VISUAL · BESTCURA”; German content uses “KI-GENERIERTES KONZEPTVISUAL · BESTCURA”. Where technically available, machine-readable provenance or metadata may additionally be retained.

The label is intentionally discreet but must not obscure material image content. It is supplemented by alt text, captions or surrounding HTML context where appropriate. Legal, technical and regulatory statements remain editorially accountable BestCura content.

More about BestCura AI transparency

No automated decision-making or profiling on the public website

The public website does not make solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR. Based on the current technical setup, website visitors are not behaviorally profiled for advertising or marketing purposes.

Recipients and processors

Personal data is disclosed only where required for the stated purposes, where a legal obligation applies or where another legal basis permits disclosure. Relevant categories include hosting, deployment, infrastructure and communications providers.

For this website, relevant technical providers include IONOS and Netlify. Where they process personal data on our behalf, Article 28 GDPR requirements and the applicable contractual terms are taken into account.

International data transfers

Netlify operates internationally. Processing outside the EEA, including in the United States, may occur as part of service delivery. Netlify states that it uses transfer mechanisms including European Commission Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

International transfers are assessed under Articles 44 et seq. GDPR and additional safeguards are considered where required.

Retention

Personal data is retained only for as long as necessary for the relevant purpose or as required by law. Technical logs are subject to the providers' technical and security retention periods.

Contact inquiries are deleted once communication is complete and no legal, contractual or evidentiary reason requires continued retention. Business communications and records may be retained longer where commercial or tax retention obligations apply.

Whether providing data is required

There is no contractual or statutory requirement to actively provide personal data merely to visit the website. In the contact form, name, email address and message are technically required because an inquiry cannot reasonably be assigned and answered without them. Without these fields, the form cannot be submitted or the inquiry handled.

Your privacy rights

Subject to statutory conditions, you have rights including access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21 GDPR). Consent can be withdrawn at any time for the future where processing is based on consent.

Right to lodge a complaint

You have the right under Article 77 GDPR to lodge a complaint with a supervisory authority. For the controller's location this includes:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de

Technical and organizational security

We use appropriate technical and organizational measures to protect personal data against loss, accidental alteration and unauthorized access. Measures include HTTPS/TLS transport encryption, access restrictions, security-oriented deployment and hosting configuration and minimizing public data collection.

The website also applies restrictive browser security headers, including controls against content-type sniffing, unwanted framing and unnecessary device permissions. Absolute security cannot be guaranteed for internet-based systems.

Changes to this privacy notice

This notice is updated when technical functions, providers, legal requirements or processing operations change. The version published on this page with its revision date is the applicable version.

Severability notice

If any wording in this privacy notice is wholly or partly invalid, unenforceable or superseded by a change in law, the remaining information is unaffected. Mandatory privacy law applies in place of any non-applicable wording. This notice does not restrict or exclude statutory data-subject rights.

Boundary to use of the BestCura Healthcare Operating System

This privacy notice describes processing on the public website bestcura.com only. It is not the privacy documentation for a productive BestCura deployment in a specific care facility or hospital. Institutional deployments require their own controller/processor roles, records of processing, technical and organizational measures, retention concepts, where applicable data-protection impact assessments, and the required processing or other privacy agreements.