1. Controller
This English text is a translation for convenience. The German version is legally binding and prevails in the event of any discrepancy.
The controller under the GDPR is Yhab Hammoud, Sandkamp 7, 22111 Hamburg, Deutschland, hammoudyhab@gmail.com.
For content practitioners record about their own clients — in particular intake forms and session notes — the practitioner is the controller. Oasis processes that data solely on documented instruction, as a processor (see section 6).
2. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Serving the website | IP address, timestamp, requested resource | Art. 6(1)(f) GDPR (secure operation) |
| Account and sign-in | Name, email address, password hash | Art. 6(1)(b) GDPR |
| Bookings and payment | Name, email, appointment, service, payment status | Art. 6(1)(b) GDPR |
| Practitioner profiles and directory | Professional title, offering, location, public contact details | Art. 6(1)(b) or (f) GDPR |
| Health information in intake forms | Voluntary information provided by the person booking | Art. 9(2)(a) GDPR (explicit consent) |
| Reviews | Review text, date of experience, booking reference | Art. 6(1)(f) GDPR (marketplace transparency) |
| Platform operator reporting duty | Name, address, date of birth, tax ID, fees | Art. 6(1)(c) GDPR together with the German PStTG |
Health information is always voluntary. A booking can be completed without it; the practitioner will then prepare for the session differently.
3. Inclusion in the practitioner directory (Art. 14 GDPR)
To make the directory useful from day one, we create unclaimed profiles for some practitioners. These are built exclusively from information those people have themselves made publicly available in a professional capacity — for example professional title, services offered, public business address and publicly published contact channels.
- Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is building a complete directory that is genuinely useful to people searching.
- Source of the data: publicly accessible professional sources. Nothing is taken from behind a login and no private contact details are used.
- No health claims and no healing promises are carried over from third-party sources.
- Data subjects are informed about the processing at first contact (Art. 14(3) GDPR).
- Objection under Art. 21 GDPR requires no particular form. We then delete the profile completely within 24 hours, without asking for a reason.
To have an unclaimed profile removed, a plain email to hammoudyhab@gmail.com is enough. No justification is required.
4. Recipients and processors
| Service | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase (Supabase Inc.) | Datenbank, Authentifizierung, Datei-Speicher | EU (Frankfurt, eu-central-1) | AVV nach Art. 28 DSGVO; Verarbeitung ausschließlich in der EU |
| Vercel (Vercel Inc.) | Hosting und Auslieferung der Anwendung | EU (Frankfurt, fra1) mit globalem CDN | AVV nach Art. 28 DSGVO; EU-US Data Privacy Framework |
| Resend (Resend Inc.) | Versand von Transaktions-E-Mails (Buchungsbestätigungen, Erinnerungen) | EU / USA | AVV nach Art. 28 DSGVO; Standardvertragsklauseln |
| Stripe (Stripe Payments Europe, Ltd.) | Zahlungsabwicklung und Auszahlungen an Anbieter:innen | EU (Irland) | Eigenverantwortlicher Zahlungsdienstleister; Art. 6 Abs. 1 lit. b DSGVO |
5. Retention
- Account data: until the account is deleted.
- Booking and invoice data: 10 years (§ 147 AO, § 257 HGB).
- PStTG reporting data: 10 years from the end of the reporting period.
- Intake forms and session notes: on the practitioner's instruction, at the latest until their account is deleted.
- Server logs: 14 days.
6. Processing on behalf of practitioners
Practitioners use Oasis to process personal data about their clients, including health data under Art. 9 GDPR. In that relationship the practitioner is the controller and Oasis is the processor. The data processing agreement under Art. 28 GDPR forms part of the practitioner terms and is available as a separate document.
7. Your rights
- Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and portability (Art. 20).
- Objection to processing based on legitimate interests (Art. 21).
- Withdrawal of consent with effect for the future (Art. 7(3)).
- Complaint to a supervisory authority (Art. 77).
9. AI-assisted features
Some features — such as text suggestions when creating a profile, and translations — are generated with AI assistance. Such content is labelled (Art. 50 EU AI Act) and is approved by the practitioner before publication. Health data from intake forms is never used for this.