Plain-language summary. t651 collects only the information needed to provide advisory services and, where applicable, to connect health records via Fasten Connect. We do not sell your data. Health and personal data is stored only as long as your account is active and deleted promptly upon request or account closure. You may withdraw consent or request deletion at any time.
1. Who we are
t651 is an independent advisory practice operated as a Freiberufler under German law. References to "t651," "we," "us," or "our" refer to that practice. For the purposes of the GDPR and the German BDSG, t651 is the data controller for personal data collected through this website and any associated services.
Contact: hello@t651.com · Tel: +49 175 654 2001
2. Scope
This notice applies to the t651 website at t651.com, any software application operated by t651 that connects to third-party health-data services (including Fasten Connect), and communications between t651 and prospective or current advisory clients. It does not apply to third-party services linked from our site.
3. What we collect
3.1 Website and enquiry data
When you contact us we collect: name, email address, company name (optional), and the content of your message.
3.2 Application account data
When you create an account we collect the information required to provide and secure it: name, email address, authentication credentials (stored as a secure hash), and account preferences.
3.3 Health records (where applicable)
Certain t651 applications connect to health record providers via Fasten Connect. In those cases we may receive, process, or temporarily hold Personal Health Information (PHI) and Personally Identifiable Information (PII). We only access this data after you have given explicit, informed consent through an in-application consent flow.
3.4 Technical and usage data
Our infrastructure providers may automatically collect: IP address, browser type, operating system, device type, pages visited, and error reports. This data is used solely for security and service reliability.
4. Health data and sensitive personal data
We do not sell, rent, or trade personal health information. Ever. Health data is processed only to deliver the service you requested and only with your explicit prior consent.
4.1 Definitions
- Personally Identifiable Information (PII): Any information that directly identifies you, or that is capable of doing so when combined with other information — including name, address, email, phone number, date of birth, or national identifiers.
- Protected Health Information (PHI): Any information in a medical record that can be used to identify you and relates to a health condition, the provision of healthcare, or payment for healthcare — including diagnoses, treatment history, health insurance details, and related financial information.
- Special category data under GDPR Article 9 includes health data, genetic data, and biometric data. We treat all PHI as special category data regardless of technical source.
4.2 How health data is handled
- Collected only after an explicit consent step describing what will be collected, how it will be used, who it may be shared with, and for how long.
- Stored on your account for as long as the account remains active, so that the service can function as intended.
- Permanently deleted when your account is deleted or upon a verified deletion request (see Section 10).
- Never used for advertising, profiling, or any purpose beyond the service you requested.
- Any use for AI or machine learning will be disclosed separately and will require a new, explicit opt-in.
5. How we use your data
| Purpose | Data used |
|---|---|
| Responding to enquiries and providing advisory services | Contact and message data |
| Operating and securing application accounts | Account data, technical data |
| Connecting to and retrieving health records | PHI / PII (with explicit consent) |
| Maintaining security and preventing abuse | Technical and usage data |
| Complying with legal obligations | As required by applicable law |
| Improving services | Aggregated, non-identifiable usage data |
6. Legal bases for processing (GDPR)
- Contract (Art. 6(1)(b)): Processing necessary to provide the services you have engaged us for.
- Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, and service improvement.
- Legal obligation (Art. 6(1)(c)): Compliance with applicable German, EU, or international law.
- Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): All processing of health data (special category data) and any optional processing beyond service delivery. You may withdraw consent at any time.
7. Sharing and sub-processors
We do not sell, rent, or trade your personal data. We share data only with: infrastructure and technical service providers acting under data processing agreements; Fasten Health, Inc. (where you connect a health record via Fasten Connect, as an independent controller under its own privacy policy); legal authorities where required by law; and successors in the event of a business transfer, who will be bound by equivalent obligations.
8. Retention and deletion
- Enquiry and contact data: Retained for the duration of an engagement and up to 36 months thereafter, then deleted.
- Application account data: Retained while your account is active. Deleted within 30 days of a verified account deletion request.
- Health data (PHI / PII): Retained while your account is active. Permanently and irreversibly deleted within 30 days of a verified account deletion request or consent revocation.
- Technical and usage data: Identifiable records deleted within 90 days.
We will confirm deletion in writing within 30 calendar days of a verified request.
9. Security
We implement commercially reasonable technical and organisational measures including encryption in transit (TLS) and at rest, access controls, and regular security review. In the event of a data breach affecting your personal data, we will notify you as required by GDPR Art. 34 — ordinarily within 72 hours of becoming aware.
10. Your rights
Under GDPR you have the right to: access, rectification, erasure, restriction of processing, data portability, and the right to object. You may withdraw consent at any time for consent-based processing. To exercise any right, contact hello@t651.com. We will respond within 30 calendar days. You may also lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit or your local supervisory authority.
To revoke consent for health data processing specifically, email hello@t651.com with subject line "Revoke Health Data Consent", including your name and account email address.
11. Cookies
This website uses only technically necessary cookies required for basic site functionality. We do not use advertising or tracking cookies that identify you personally. If this changes, we will update this notice and obtain your consent where required by law.
12. Children
Our services are not directed to persons under 18. We do not knowingly collect data from minors. If we become aware we have done so, we will delete that data promptly. Contact hello@t651.com if you believe we hold data about a minor.
13. International transfers
t651 is based in Germany and primarily processes data within the EU/EEA. Where data is transferred to a third country (for example, to Fasten Health, Inc. in the United States), we ensure appropriate safeguards are in place — such as the EU Standard Contractual Clauses or an adequacy decision — in accordance with GDPR Chapter V.
14. Changes
We may update this notice to reflect changes in our practices or applicable law. For material changes that affect health data or special category data, we will notify you directly by email and request fresh consent where required.
15. Contact
t651 advisory
Email: hello@t651.com
Tel: +49 175 654 2001