Privacy policy
1. Controller
PharmaCare GmbH
Raiffeisenallee 16
82041 Oberhaching, Germany
Phone: +49 89 21966887-0
E-mail: kontakt@pharmacare.de
Managing directors: Werner Bauer, Dirk Bauer
2. Data protection officer
You can reach our data protection officer at datenschutz@pharmacare.de or by post at the address above, marked “Datenschutzbeauftragter”.
3. Principles
We process personal data only where this is necessary for the purpose in question, and only on one of the legal bases set out in the General Data Protection Regulation (GDPR). The sections below explain which data this is, what we use it for, which legal basis applies and how long we keep it.
Part of our range concerns the supply of medical aids. Information about this allows conclusions to be drawn about your health. Such data belongs to the special categories under Article 9 GDPR. We treat it with corresponding care and pass it on only where this is necessary for your supply or for billing it.
4. Operation of the shop (Shopify)
Our shop runs on the platform of Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes the data on our behalf; a data processing agreement under Article 28 GDPR is in place. Transfers to countries outside the European Union may occur, in particular to Canada and the USA. Where no adequacy decision exists for the country concerned, we base such transfers on the European Commission’s standard contractual clauses.
Legal basis: Article 6(1)(b) GDPR (contract and pre-contractual measures) and Article 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of the shop).
5. Access data
Each time our pages are called up, technical data is processed: IP address, date and time, the address requested, the volume of data transferred, browser type and operating system, and the page visited before. We need this data to deliver the pages, detect faults and fend off attacks.
Legal basis: Article 6(1)(f) GDPR. Retention: seven days, after which the logs are deleted.
6. Cookies and consent
We use technically necessary cookies without consent. They keep the cart intact, make signing in work, remember the language and protect forms against misuse. The legal basis is Section 25(2) no. 2 of the German Digital Services Data Protection Act (TDDDG) in conjunction with Article 6(1)(f) GDPR.
Cookies and comparable technologies that are not necessary are used only with your consent. You can make your choice in the consent banner and change or withdraw it at any time. A withdrawal takes effect for the future. Legal basis: Section 25(1) TDDDG and Article 6(1)(a) GDPR.
7. Orders and performance of the contract
To process an order we use your name, the delivery and billing address, your e-mail address, your telephone number where given, the items ordered and payment details. We need this data to perform the contract, deliver the goods and issue invoices.
Recipients, as far as required for the step concerned, are:
- the payment service provider you choose (see section 8),
- the carrier DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany) with the details needed for delivery, and on request your e-mail address or telephone number for shipment tracking,
- our enterprise resource planning system Microsoft Dynamics 365 Business Central, which we operate in our own tenant; Microsoft Ireland Operations Limited acts as our processor,
- our tax advisers and, in the event of payment default, a debt collection service provider,
- for supplies covered by insurance, your health or long-term care insurance fund (see section 10).
Legal basis: Article 6(1)(b) GDPR; for the retention of invoices additionally Article 6(1)(c) GDPR in conjunction with commercial and tax law obligations.
8. Payment
Depending on the payment method chosen, we pass the data required for processing to the payment service provider. These providers process your payment data on their own responsibility; the payment details themselves do not reach us in full.
- Shopify Payments and Shop Pay: Shopify International Limited, Dublin, Ireland
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg
- Klarna: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden
For purchase on invoice or in instalments, the provider may obtain a credit assessment. Details can be found in that provider’s privacy notice. Legal basis: Article 6(1)(b) GDPR.
9. Customer account
You can order as a guest or use a customer account. Signing in runs through Shopify with a one-time code sent by e-mail; no password is needed. In your account you can see your orders and addresses and submit a review.
Where your supply is covered by an insurance fund, further details may be stored with your account, such as customer number, date of birth, insurance number, insurance status and the paying body. These come from your supply and allow repeat orders and billing without asking you again.
Legal basis: Article 6(1)(b) GDPR, and for the health-related details additionally Article 9(2)(h) GDPR. You may request deletion of your account at any time; statutory retention periods remain unaffected.
10. Supply of medical aids, prescriptions and health data
When you submit a prescription or obtain a medical aid through your insurance fund, we process data concerning your health: the prescription itself as a photo or file, the products prescribed, size and version, your insurance fund, insurance number and insurance status, and the related correspondence.
We use this data to advise you, carry out the supply and bill it to your health or long-term care insurance fund. For that purpose we transmit the necessary details to your fund. This is based on the provisions of the German Social Code on the supply of medical aids and on billing, in particular Sections 33 and 302 of Book V and Section 40 of Book XI.
When you apply for a package of care aids, we additionally process your name, contact details, your care insurance fund and your statements about what you need.
Legal basis: Article 9(2)(h) GDPR in conjunction with Section 22(1) no. 1(b) of the German Federal Data Protection Act (provision of health care), supplemented by Article 6(1)(b) and (c) GDPR. The staff who process this data are bound to confidentiality.
11. Contacting us
If you contact us via the contact form, by e-mail or by telephone, we process your details in order to answer your enquiry. The legal basis is Article 6(1)(b) GDPR where a contract is involved, otherwise Article 6(1)(f) GDPR (legitimate interest in responding). We keep enquiries for as long as is needed to handle them and to document what was agreed.
12. Product reviews
Customers can review products they have bought. For this we process the rating, a headline, the review text, the date, the order number and the customer account used to submit it.
What we publish is the rating, headline, text and date, together with the note “Verified buyer”. Your name does not appear and is not requested. The order number and the account stay internal and serve only to check that the review belongs to a genuine order. We do not pass reviews on to any third party; they appear only in our shop.
A review of a medical aid may contain information about your health. It is therefore published only with your explicit consent, which you give when submitting the form. Legal basis: Article 6(1)(a) and Article 9(2)(a) GDPR. You may withdraw your consent at any time without giving reasons, and we will then remove the review. The withdrawal takes effect for the future. How we check reviews is explained on the page How our reviews come about.
13. E-mails about your order and review invitations
We send order confirmations, shipping notifications and queries about your order in order to perform the contract. After a purchase we may also ask you once to review the product you bought. The legal basis for this is Section 7(3) of the German Act against Unfair Competition (UWG) in conjunction with Article 6(1)(f) GDPR.
You may object to this use of your address at any time, at no cost other than the transmission costs at base rates. Use the unsubscribe link in the e-mail or write to datenschutz@pharmacare.de.
14. Protection against misuse (Google reCAPTCHA)
To protect our forms against automated entries we use reCAPTCHA from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This evaluates, among other things, the IP address, time spent on the page and mouse movements, and transmits them to Google; a transfer to the USA cannot be ruled out and is based on the standard contractual clauses. Legal basis: Article 6(1)(f) GDPR (legitimate interest in preventing misuse).
15. Google sales channel
We transmit our product data to the Google Merchant Center so that our items appear in Google Search and in the Shopping area. What is transferred is product information, not data about you. Google Ireland Limited is responsible for the further processing within the Google services. Legal basis: Article 6(1)(f) GDPR (legitimate interest in the visibility of our range).
16. Retention periods
- Access data: seven days
- Order and invoice data: up to ten years under commercial and tax law retention periods
- Records on the supply of medical aids and on billing with the insurance funds: as required by social law, as a rule ten years
- Customer account: until you delete it
- Reviews: until you withdraw your consent
- Enquiries without a contract: until they have been dealt with, at most three years
17. Your rights
You have the right to obtain information about the data we hold about you (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability (Article 20 GDPR).
Objection: Where we base processing on a legitimate interest, you may object under Article 21 GDPR. You may object to advertising at any time without giving reasons.
Withdrawal of consent: You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out up to that point.
Please contact datenschutz@pharmacare.de.
Complaints: You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 27, 91522 Ansbach, Germany.
18. No automated decision-making
We do not carry out automated decision-making or profiling with legal effect for you. An exception is a possible credit assessment by the payment service provider you choose; that provider informs you about it separately.
19. Changes
We adapt this notice when our processing or the legal situation changes. The version published here at the time applies.
Last updated: 10 September 2026