Privacy Policy

We care about your personal data. Processing is based on the EU GDPR and Austrian law. This policy informs you about data handling on this website.

1. Controller

Stefan Kohlweg
Cluster Headache Counseling
Stenografengasse 4, 1230 Vienna
Email: [email protected]

2. Data processing

Technical connection data: Your IP address is processed to deliver this website. The application does not maintain a separate visitor session log with session start and end times. Infrastructure logs are distinct from this connection processing. The website is hosted by Hetzner (EU data centers) behind the Cloudflare security and delivery network.

Contact: If you reach out by email or via the contact form, the details you provide (name, email address, your role as a sufferer or relative, message) are stored in our website database and additionally sent to us by email. We keep this data for six months after the last contact to process the request. To protect the form against abuse, the number of submissions is limited; for this purpose your IP address and email address are processed briefly in pseudonymised form only (SHA-256 hash).

Health information is not needed for the initial contact. Please limit your message to an appointment request or general question. Acknowledging this policy records that you have read it; it is not explicit consent under Article 9 GDPR. The conditions for sharing sensitive health information during counselling must be clarified separately in advance.

Thesis download: The PDF is available directly without providing an email address. Downloading does not store contact details or subscribe you to email updates. The former request form is no longer used to collect email addresses.

Previous email-update preferences: You may withdraw any earlier voluntary consent at any time. Changing the download flow does not automatically delete earlier records; please contact us at the address above for access or erasure requests.

Voice messages (Voicebox): If you leave a voice message, your phone number, the audio recording, and an automatically created transcription are processed. This data is used to prepare and conduct the counseling (Art 6 Para 1 lit b GDPR or your consent when leaving the message Art 9 Para 2 lit a GDPR). Data is deleted after 6 months if no counseling relationship is established.

Web analytics and conversion measurement (only with consent): Google Analytics 4 and Google Ads conversion measurement are activated only after you consent in the cookie banner (tags blocked until a category is selected; basic consent mode). See the cookie policy for details.

Country-based crisis notices: A coarse country of origin is derived from technical headers of our delivery network so that visitors from certain countries are shown appropriate crisis helpline numbers. This value is used only for the duration of the page view and is not stored.

3. Cookies

We use technically necessary storage (your cookie choice, your light/dark preference) and, only with your consent, Google Analytics 4 and Google Ads cookies. You can change your choice at any time via the cookie banner or the "Cookie settings" footer link. Details: cookie policy.

4. Recipients

We share data with Hetzner Online GmbH (hosting, EU data centers), Cloudflare, Inc. (security/delivery network), Twilio Ireland Limited (voice services), Google Ireland Limited (analytics and conversion measurement — only after your consent), email service providers for our notifications, and our tax advisor. Contracts according to Art 28 GDPR are in place.

Operational notifications: Telegram receives only a fixed notice that a new inquiry has arrived. This notice contains no name, email address, role, message, phone number, transcript, IP address, referrer or identifiers from your inquiry. Processing your contact inquiry and forwarding it by email are separate from this notice.

5. Storage

The exact retention period for infrastructure logs at the hosting and delivery providers is under review; a fixed 14-day period has not been confirmed. Inquiry data is kept for 6 months after the last contact, voice messages for 6 months if no counseling relationship is established, billing data for 7 years (statutory retention), and email addresses previously volunteered for updates until you withdraw consent.

6. Third countries

If data is transferred outside the EU (e.g. Google LLC, Twilio Inc. or Cloudflare, Inc. in the USA), it is protected by an EU adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses.

7. Your rights

You have the right to information, correction, deletion, restriction, data portability and complaint to the Austrian Data Protection Authority.

8. Data security

We use technical and organisational measures to secure your data. Communication with this website is encrypted.

9. Changes

This policy may change to reflect legal requirements or improvements. Last updated October 14, 2026.