Key points at a glance
- Since 14 May 2024, the Impressum has been governed by § 5 DDG – a reference to “§ 5 TMG” is outdated.
- Doctors state their Ärztekammer (medical chamber), statutory professional title with the awarding country and the Berufsordnung (professional code) with a link; doctors with a statutory health insurance licence also name their Kassenärztliche Vereinigung.
- With a blog: a responsible person under § 18 Abs. 2 MStV. The link to the EU dispute resolution platform can go – the platform was switched off in July 2025.
- A privacy policy, consent under § 25 TDDDG for cookies and third-party content, locally embedded fonts and forms without required fields for health data.
- With online booking, check the BFSG (Accessibility Act) – microenterprises are exempt. The free legal notice generator creates your Impressum.
This post is general information and does not replace legal or tax advice. Rules change – check details with your chamber, your professional association or your tax adviser.
The Impressum under § 5 DDG
The Digitale-Dienste-Gesetz (DDG, Digital Services Act) replaced the Telemediengesetz on 14 May 2024. The content of the Impressum has hardly changed, but the legal basis has: if your Impressum still says “Angaben gemäß § 5 TMG”, change it to “§ 5 DDG”. The details must be easily recognisable, directly accessible and permanently available – in other words, an “Impressum” link in the footer of every page.
Your practice’s Impressum must include:
- Your full name and the practice address (for companies, also the legal form and authorised representatives)
- Contact details for quick communication, including an email address, usually also a phone number
- The competent medical chamber (Landesärztekammer, the state medical chamber)
- The statutory professional title (“Ärztin” or “Arzt”, with your specialist title if applicable) and the country in which it was awarded
- The professional rules and where to find them: the Berufsordnung of your state medical chamber and the state’s Heilberufe-Kammergesetz (chamber law), with a link
- The competent supervisory authority – for doctors with a statutory health insurance licence, the Kassenärztliche Vereinigung
- Register and register number, if registered (partnership, commercial or company register)
- The VAT ID (USt-IdNr.) or business ID number, if you have one
| Detail | Example | Legal basis |
|---|---|---|
| Name and address | Dr. med. Anna Muster, Musterstraße 1, 50667 Köln | § 5 Abs. 1 Nr. 1 DDG |
| Contact | Phone number and email address of the practice | § 5 Abs. 1 Nr. 2 DDG |
| Supervisory authority | Statutory health insurance doctors: Kassenärztliche Vereinigung Nordrhein | § 5 Abs. 1 Nr. 3 DDG |
| Chamber | Ärztekammer Nordrhein | § 5 Abs. 1 Nr. 5 DDG |
| Professional title | Ärztin, Fachärztin für Allgemeinmedizin (GP), awarded in Germany | § 5 Abs. 1 Nr. 5 DDG |
| Professional law | Berufsordnung der Ärztekammer Nordrhein and Heilberufsgesetz NRW, available on the chamber’s website (link) | § 5 Abs. 1 Nr. 5 DDG |
| VAT ID | Only if you have one – medical treatment is usually VAT-exempt | § 5 Abs. 1 Nr. 6 DDG |
Recommendations on the supervisory authority differ: the Saarland medical chamber names the Kassenärztliche Vereinigung for doctors with a statutory health insurance licence, while the Berlin medical chamber also names the authority that granted the Approbation (licence to practise). As a private-only doctor, it is best to ask your state medical chamber what it recommends. Missing mandatory details can lead to a fine of up to €50,000 under § 33 DDG – although in practice, cease-and-desist letters are more common.
Your practice's legal notice in two minutes
The free legal notice generator knows every state medical chamber and Kassenärztliche Vereinigung, fills in the professional code, chamber law and professional title correctly and delivers text or HTML. Your data stays in your browser.
You run a physiotherapy, psychology or psychotherapy practice? Then different professional laws, chambers and licensing authorities apply. Read the posts on the Impressum for physiotherapists, the Impressum for psychologists and the Impressum for psychotherapists.
BAG, partnership and MVZ
If you don’t work alone, the provider of the website is often a company. This changes the details in the first block of the Impressum:
- Berufsausübungsgemeinschaft (BAG, joint practice) as a GbR: all partners by name; if the GbR is entered in the company register (eGbR), also the register court and register number.
- Partnerschaftsgesellschaft (PartG or PartG mbB, professional partnership): name of the partnership, partnership register and register number, partners authorised to represent it.
- MVZ (medical care centre) as a GmbH: company name with legal form, managing directors as authorised representatives, commercial register and number; the KV as supervisory authority.
- For every doctor: professional title, chamber and professional code – most simply as a list of all doctors with their specialist titles.
Blog, liability insurance and dispute resolution
Besides § 5 DDG, there are three further details that are necessary depending on your website – or that you can consciously leave out:
Blog: responsible person under § 18 Abs. 2 MStV
If you publish journalistic-editorial content, such as regular health articles, also name a responsible person with name and address. This person must be permanently resident in Germany and have full legal capacity. A website that only presents the practice does not need this.
Professional liability insurance: voluntary, but complete
The DL-InfoV (Service Information Ordinance) requires details of professional liability insurance (insurer, address, territorial scope) but does not apply to health services. If you offer services outside medical treatment, such as courses or talks, it may apply. You are insured anyway: doctors with a statutory health insurance licence must prove their insurance under § 95e SGB V. If you mention it, do so completely.
Consumer dispute resolution under § 36 VSBG
If you employed more than ten people on 31 December of the previous year, you must state on your website whether you take part in proceedings before a consumer arbitration board. Smaller practices are exempt. Remove the old link to the EU online dispute resolution platform: it was switched off on 20 July 2025.
The privacy policy under the GDPR
As soon as your website processes personal data – and it already does through server logs with IP addresses –, you must inform visitors under Art. 13 GDPR. Link the privacy policy in the footer of every page, like the Impressum. It must match your website exactly: a copied template that lists services you don’t use (or vice versa) is a common mistake.
- The controller (you, the BAG or the MVZ) and your data protection officer, if any
- Which data the website processes: server logs, contact form, online booking, embedded content
- The purpose, legal basis and retention period of each processing activity
- Recipients such as the hosting provider, booking platform or newsletter service – and whether data leaves the EU
- Visitors’ rights and the right to complain to your state’s data protection authority
Under § 38 BDSG (Federal Data Protection Act), you need a data protection officer if, as a rule, at least 20 people are constantly involved in the automated processing of personal data – or regardless of headcount if a data protection impact assessment is required. For treatment data, medical confidentiality (§ 203 StGB, Criminal Code) and the professional code also apply.
Cookies, Google Fonts and embedded content
Cookies and similar technologies are governed by § 25 TDDDG (called TTDSG until May 2024): you may only store or read information on a device with consent – unless it is strictly necessary for the service the user explicitly requested. This mainly concerns third-party content:
- Google Fonts: In 2022, the Munich Regional Court I awarded a website visitor €100 in damages because fonts were loaded from Google’s servers, transferring her IP address (case 3 O 17493/20). Embed fonts locally.
- Maps: Load Google Maps only after a click, use an OpenStreetMap-based map or show an image with a link to directions.
- Booking and review widgets: Embedded widgets often transfer data as soon as they load. A button linking to the booking page is the simpler solution.
- Analytics: Cookieless, data-minimising analytics can often work without a banner.
A lean website without tracking or embedded third-party content needs no cookie banner – and loads faster. What else a practice website needs is covered in the post What belongs on a practice website.
Contact forms and health data
Under Art. 9 GDPR, health data is a special category of personal data; § 22 BDSG governs when you may process it for treatment. If a patient writes in your contact form “I’ve had a fever and a cough for days, when can I come in?”, you are processing exactly this kind of data. So:
How to get it right
- Only ask for what you need for the appointment: name, contact, preferred time, statutory or private insurance
- HTTPS and secure storage of messages with a provider in the EU
- A visible note not to send test results, diagnoses or emergencies through the form – with a reference to 112 and 116 117 (out-of-hours medical service)
- Clear information in the privacy policy about what happens to the data
Better not
- Required fields for symptoms, diagnoses or medication
- Asking for test results or doctors’ letters by unencrypted email
- Storing form data with services outside the EU without checking
Accessibility Act: does it apply to your practice?
The Barrierefreiheitsstärkungsgesetz (BFSG, Accessibility Act) has applied since 28 June 2025. Among other things, it covers “e-commerce services” for consumers (§ 1 Abs. 3 Nr. 5 BFSG): services provided electronically through websites or apps at the individual request of a consumer with a view to concluding a consumer contract (§ 2 Nr. 26 BFSG). A purely informational website without a booking or purchase option is not covered.
- Online booking: Whether a medical practice’s appointment booking is a consumer contract within the meaning of the BFSG is disputed and has not been settled by the courts. It is safer to assume it may be covered.
- Microenterprises are exempt (§ 3 Abs. 3 BFSG): fewer than ten employees and an annual turnover or balance sheet total of no more than €2 million (§ 2 Nr. 17 BFSG). This applies to many single-doctor practices, but often not to larger BAGs and MVZs.
- External booking platform: Check whether the provider has an accessibility statement, and ask if in doubt.
Even if your practice is exempt: sufficient contrast, legible text, alt texts and keyboard navigation help older patients and people with visual impairments. What a professionally built, accessible website costs is shown in the post What does a practice website cost?.
Checklist for your practice website
- “Impressum” and “Datenschutz” (privacy) links in the footer of every page
- “§ 5 DDG” instead of “§ 5 TMG”, “§ 25 TDDDG” instead of “TTDSG”
- Name, practice address, phone number and email complete
- Medical chamber, statutory professional title with country, professional code and chamber law with link
- Statutory health insurance doctors: Kassenärztliche Vereinigung as supervisory authority
- For a BAG, PartG or MVZ: legal form, authorised representatives, register and number
- With a blog: responsible person under § 18 Abs. 2 MStV; no more link to the ODR platform
- Privacy policy matching the services you use; fonts embedded locally; maps and widgets only after consent
- Contact form without required fields for health data
- With online booking: BFSG checked; advertising statements checked against Advertising for doctors
Setting up a practice right now? The guide Opening a private practice and the overview Opening a practice in Germany cover the website as one of the steps before opening.
Websites for medical practices – with Impressum, privacy and no cookie banner
We build practice websites that come with the mandatory details, locally embedded fonts and data-minimising forms from day one.
Sources
- Gesetze im Internet – § 5 DDG
- Gesetze im Internet – § 33 DDG (fines)
- Saarland Medical Chamber – mandatory details under the DDG
- German Medical Association – professional law
- KBV – Kassenärztliche Vereinigungen
- Gesetze im Internet – § 2a Federal Medical Code (BÄO)
- Interstate Media Treaty (MStV), § 18 (lxgesetze)
- Gesetze im Internet – § 1 DL-InfoV
- EUR-Lex – Services Directive 2006/123/EC, Art. 2 (health services exemption)
- Gesetze im Internet – § 95e SGB V
- Gesetze im Internet – § 36 VSBG
- EUR-Lex – Regulation (EU) 2024/3228 (repeal of the ODR platform)
- Gesetze im Internet – § 25 TDDDG
- Gesetze im Internet – § 38 BDSG
- Munich Regional Court I, judgment of 20 Jan 2022, 3 O 17493/20
- Gesetze im Internet – § 3 BFSG
- Gesetze im Internet – § 2 BFSG
