Social Media Privacy Policy

Responsible entity:

Torstrasse 19
10119 Berlin, Germany
Phone: +49 (0) 30 – 5770221- 0

Managing Directors: Dr. med. Madjid Salimi, Dr. med. Nawid Salimi, Benedikt Hochkirchen

Local Court Berlin (Charlottenburg), HRB 209607


Our representative and wholly-owned subsidiary in the US:

234 5th Avenue, 2nd Floor
New York, NY, 10001
Phone: 347-835-5441

Contact details data protection officer:

Data Protection Officer
Torstrasse 19
10119 Berlin, Germany

Last Update Date: August 2023

1. Basic information on data processing and legal basis

AMBOSS GmbH (hereinafter also referred to as “AMBOSS” or “we”) is a young company providing high quality services for physicians and medical students as well as learning materials. We want you, as a user of our services, to understand how we use information and what options you have to protect your data. We are aware of the importance and sensitivity of your personal data and thank you for your trust. Handling it responsibly is a major concern for us. We process personal data of visitors to our social media presences in compliance with the relevant data protection regulations, in particular the EU General Data Protection Regulation (GDPR). If you have any questions about this, please do not hesitate to contact us.

The respective platform providers listed below are primarily responsible for processing your personal data within the social media platforms. If data is collected on our social media presences that both the respective platform provider and we process and use for joint purposes (e.g., in the context of analysis or advertising), there is a joint responsibility of the provider and us. Often, this function cannot be deactivated by us. You can therefore contact both the respective provider and us with your concern.This Social Media Privacy Policy is in addition to and supplements our General Privacy Policy.

2. Our social media presences

2.1. Facebook

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland

AMBOSS presences:,

We have entered into a shared responsibility agreement with Meta Platforms Ireland Limited pursuant to Art. 26 GDPR (available here:

2.2 Instagram

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland

AMBOSS presence:

2.3 Linkedin

Provider: LinkedIn Ireland Unlimited Company, 2, Dublin, Ireland (for users in the EU,EEA or Switzerland) or LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, CA 94085 (for users outside the EU, EEA, Switzerland).

AMBOSS presence:

We have concluded a joint responsibility agreement with LinkedIn Ireland Unlimited Company in accordance with Art. 26 GDPR (available here:

2.4. YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EEA or Switzerland) or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (for users outside the EEA or Switzerland).

AMBOSS Presence:

2.5 Twitter

Provider: Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (for users in the EU, EFTA countries or UK) or Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103 (for users outside the EU, EFTA countries or UK).

AMBOSS presence:

3. Purposes of the processing of data and legal bases

In the following, we describe for which purposes and on which legal basis we process your personal data.

The processing of your data by the social media platform providers may be based on different legal grounds. We have no influence on the data processing procedures of the platform providers and we do not know in detail how the social media platforms use the data from your visit to our social media presences and interaction with our posts for their own purposes, how long this data is stored and whether data is passed on to third parties. We also have no information on the deletion of the collected data by the providers of the platforms.

Data processing may differ depending on whether you are registered and logged in to the social media platform or visit the site as a non-registered and/or non-logged-in user. When you access a post or the social media presence, the IP address assigned to your terminal device is transmitted to the provider of the social media platform. If you are currently logged in as a user, it may be possible to track how you have moved around the network via cookies on your end device. Buttons embedded in websites enable the platforms to record your visits to these websites and assign them to your respective profile. Based on this data, content or advertising can be offered tailored to you. If you want to avoid this, you should log out or deactivate the “stay logged in” function, delete the cookies present on your device and restart your browser.

Which data the social media platform providers receive and how they are used is described by the providers in their privacy statements. There you will also find information on contact options as well as on the settings options for advertisements. In detail:

3.1 Informational use of our social media presences

You can visit our websites without providing any personal information. If you only use our websites for information purposes, i.e. if you do not register or otherwise provide us with personal information, we do not process any personal data, with the exception of the data that the respective provider transmits to us. When you visit our social media presences, the providers of the social media platforms collect, among other things, your IP address and other information that is collected as part of cookies on your terminal device. This information is used to provide us, as the operator of the site, with statistical information about the interaction with us (see section 3.2).

3.2 Analysis and tracking

For the purpose of analyzing and tracking the use of their social media platform and our presence, the providers use cookies that enable an evaluation of your surfing behavior. This allows us to improve the quality of the platform and our site and its content. We learn how our site is used and can thus constantly optimize our offer, but do not gain access to the personal data behind it. We can only influence statistics provided to us by the platform providers to a limited extent and cannot switch them off.

We process your personal data on the basis of your consent pursuant to Art. 6 (1) lit. a GDPR, which you have given to the provider upon registration or within the Cookie Consent Manager of the respective social media platform.

3.3 Active use of social media presences

We, as the operator of the respective social media presence, also process data from your active use of the site. In addition to the processing of your personal data described above, we then process further data from you that we need, for example, to process your inquiry or to interact with you on our own initiative.

You can comment, share or otherwise interact (like, recommend, review, etc.) with posts, photos, videos, etc. created by us on the provider’s platform and on our site. Where applicable, we will share your content on our Site if this is a feature of the Platform and communicate with you through the Platform. If necessary, we reserve the right to delete content.

In addition, you can send us inquiries via the platforms. Depending on the required response, we may also refer you to other secure communication channels that ensure confidentiality. You always have the option of sending us confidential inquiries to our address stated in this privacy policy.

We process your personal data on the basis of our legitimate interest in providing an interaction and information offer, analyzing and optimizing the same and interacting with you pursuant to Art. 6 (1) lit. f GDPR or to initiate a contract with you pursuant to Art. 6 (1) lit. b GDPR.

3.4 Further data processing in individual cases

We also process your personal data in individual cases in order to fulfill legal obligations. These include, in particular, commercial, trade or tax law retention obligations. We process your personal data in accordance with Art. 6 para. 1 lit. c GDPR in connection with commercial, trade or tax law, insofar as we are obliged to record and store your data. In addition, it may be necessary in individual cases to process your data in order to assert our rights and enforce our legal claims or insofar as this is necessary for the defense or prosecution of criminal offenses. We process your personal data for these purposes to protect our legitimate interests pursuant to Art. 6 (1) lit. f GDPR.

4. Disclosure of data

Initially, only our employees who are involved in the technical or editorial support of the social media presences receive knowledge of your personal data. Your data will only be passed on to third parties if this is permitted or required by law or if you have given your consent.

In addition, within the scope of the data processing described above, we may use external service providers or commission them to provide the corresponding services. If service providers receive your personal data as processors, they are strictly bound by our instructions when handling your personal data. We list the categories of external recipients in detail below:

  • Communications and IT service provider, e.g. as part of the administration of our social media presences,
  • Logistics service providers in order to be able to send you, for example, requested information brochures, any prizes as part of promotions,
  • Legal counsel in the assertion of our claims.

5. Data subject rights

You have the right:

  • in accordance with Art. 7 (3) GDPR to revoke a consent once given to us with effect for the future;
  • pursuant to Art. 15 GDPR to request information free of charge about your personal data processed by us;
  • in accordance with Art. 16 GDPR to immediately demand the correction of incorrect or completion of your personal data stored by us;
  • pursuant to Art. 17 GDPR to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
  • to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR;
  • in accordance with Art. 20 GDPR to receive your personal data that you have provided to us in a structured, common and machine-readable format to transfer this data to another controller;
  • object to the processing of your personal data on the basis of legitimate interests pursuant to Art. 21 GDPR;
  • report to a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our registered office.

However, we recommend that you first contact the data protection contact of the respective platform operator if you have any questions about data processing on the social media platforms.

6. Retention period

We ourselves store your personal data – if at all – only for the duration for which the respective purpose of use requires corresponding storage. In addition, we may store your personal data until the statute of limitations expires for any legal claims arising from the relationship with you, in order to be able to use them for evidence purposes. The limitation period is usually between 12 and 36 months, but can also be up to 30 years. When the statute of limitations expires, we delete your personal data, unless there is a legal obligation to retain it. These retention obligations can be up to ten years.

7. Obligation to provide data

In principle, you are not obliged to provide us with personal data when you visit our social media sites. As a rule, you can also visit them without being registered with the respective social media platform. However, if you wish to use certain functionalities (e.g. interactive functions such as commenting, sharing, rating) or contact us in the social media, it is regularly necessary that you register for this on the respective platform and in any case disclose your profile name. However, if you do not do this, the operator of a social media platform cannot, among other things, make the platform and our presence available to you, and we cannot answer your inquiries to us, send you information, etc., or enter into a contract with you.

8. Automated decision making/profiling

As a matter of principle, we do not use fully automated decision-making pursuant to Art. 22 GDPR. Should we use these procedures in individual cases, we will inform about this separately.

However, it is possible that the provider of a social media platform processes your data automatically with the aim of evaluating certain personal aspects (profiling). This may be done in order to inform and advise you in a targeted manner about products and services. For the data processing for which the platform providers are primarily responsible, please refer to their data protection declarations (see section 3).

9. Changes to the privacy policy

We reserve the right to change this privacy policy from time to time to reflect changes in the law or expansion of the functionality of our services. You should therefore read the privacy policy regularly to be informed about the protection of your data.