GDPR-compliant appointment booking, EU/Hetzner-hosted, no marketplace
Appointment software that is GDPR compliant starts with where the servers sit and ends with the question of who sees the data. With TerminJet everything runs on your own domain, on German Hetzner servers, with a data processing agreement. No data sharing with a booking marketplace.
What really makes appointment software GDPR compliant
Hosted with Hetzner in German data centres. No data transfer to the USA, no detour through third countries, no Schrems II risk.
A data processing agreement under Art. 28 GDPR. You sign one document and have the processing chain cleanly documented.
Your patient and customer data does not go to a portal. There is no second profile that someone else markets.
The instance belongs to you. You remain the sole controller in the sense of the GDPR. TerminJet only processes on your behalf.
GDPR appointment booking with servers in Germany instead of a cloud in a third country
The most common stumbling block is not the booking form, it is what sits beneath it: where the data lives and who could theoretically access it. TerminJet runs on Hetzner infrastructure in Germany. Sensitive data is stored encrypted with AES-256. There is no replication into US regions and no sub-processors in third countries that you do not know about.
White-label on your own domain, not in someone else's portal
A booking marketplace makes its money by collecting patients and customers and remarketing them. That means you share data sovereignty and visibility. TerminJet turns this around: the booking and rebooking system runs as your own instance on your domain. Patients see your practice, not a comparison portal with the competitor right next to you.
Data protection that holds up under an audit
Documented consent
The reminders and rebooking offers via WhatsApp and SMS only go to people with documented consent. The proof is part of the system, not a loose checkbox.
Data-minimal waitlist
The consented waitlist only stores what is needed to refill a slot. No shadow profiles, no mountain of data without a purpose.
Encryption of PHI
Health-related data is stored encrypted with AES-256. Even in the unlikely event of access, the contents are not readable in plain text.
Clear responsibility
You are the controller, TerminJet is the processor. These roles are set out in the data processing agreement instead of being hidden in terms and conditions.
Deletion concept and retention periods
Retention and deletion can be configured per data type, so you can map the periods required by GDPR and professional law.
Hosting in the EU
Processing exclusively in Germany. No silent data flows into regions you have not approved.
Your own instance versus a booking marketplace
Both models take appointments. On data protection and data sovereignty they part ways clearly. A fair comparison of the points that count in an audit.
| TerminJet (your own instance) | Booking marketplace / portal | |
|---|---|---|
| Server location | Germany (Hetzner) | Often a global cloud, sometimes a third country |
| Runs on your domain | ||
| Data processing agreement under Art. 28 | Depends on the provider | |
| Data marketed to third parties | The portal's business model | |
| You remain the sole controller | Shared data sovereignty | |
| Commission per appointment | Often | |
| Automatic refilling of cancellations | Rarely |
The decisive question is not whether a booking form has a checkbox for consent. It is this: where does the data live, who may see it, and who remains responsible in the end.
Frequently asked questions about GDPR compliance
Is TerminJet automatically GDPR compliant the moment I use it?
TerminJet provides the technical and organisational prerequisites: hosting in Germany, AES-256 encryption, a data processing agreement, documented consent and a deletion concept. Responsibility for lawful use remains with you as the operator. We supply the building blocks that make clean processing possible.
Where exactly is the data stored?
On Hetzner servers in German data centres. There is no standard replication into US regions. Sensitive data is stored encrypted. The sub-processor chain is short and disclosed to you.
Do I get a data processing agreement?
Yes. The data processing agreement under Art. 28 GDPR is part of the setup. That makes the division of roles clear: you are the controller, TerminJet processes exclusively on your behalf.
Is my patient or customer data passed on to a marketplace?
No. TerminJet is not a portal like Doctolib, Jameda or Treatwell. No public comparison profile is created and your contacts are not marketed. The instance runs on your domain and the data stays with you.
How does this fit the 2025 DSK position paper?
The setup is aligned with the guidance of the Data Protection Conference: processing in the EU, clear responsibility, documented consent for communication channels and data minimisation for the waitlist. A data protection impact assessment can be built cleanly on this basis.
Does the automatic rebooking still work in a data protection compliant way?
Yes. The slot recovery engine only contacts people who have consented via the waitlist to be reached by WhatsApp or SMS. The consent is documented and only the data needed to refill the slot is used.
This is how the intake form looks on your domain
This embedded form is the same one that later feeds your slot recovery engine. Data-minimal, on your domain, with documented consent. Try it out.