MeinBefund24Privacy information
This is a translation for your convenience. In the event of any discrepancy the German version prevails; you can read it at meinbefund24.de/datenschutz.
Controller
The controller for the processing of health data in the course of treatment is:
Mirco Giannini
Münsterlandstraße 33, 10317 Berlin
Email: kontakt@meinbefund24.de
Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Booking an appointment (including a callback number in case the audio connection fails) | Art. 6 (1) (b) GDPR | Until the treatment is complete, thereafter as part of the medical record |
| Questions by phone before booking | Art. 6 (1) (b) and (f) GDPR | No recording, no voicemail; connection data held by the telephone provider under its own retention periods |
| Details before the consultation and medical advice | Art. 9 (2) (h) GDPR in conjunction with section 630f BGB | 10 years after the treatment is complete (section 630f (3) BGB) |
| Uploaded report (photo or PDF) | Art. 9 (2) (a) GDPR (consent given by uploading) | The report is stored in encrypted form with our hosting provider Netlify so that the doctor can read it before the call. It is deleted after the summary has been sent, at the latest 14 days after upload; you can remove it yourself until the consultation. Whatever the consultation requires to be documented is recorded in the patient file. |
| Video consultation | Art. 9 (2) (h) GDPR | No recording of picture or sound. The video service runs on our own server in the European Union (Hetzner, Helsinki); no third-party provider is involved. Connection logs 7 days |
| Written transcript of the consultation | Art. 9 (2) (a) GDPR (consent) | The audio of the consultation is turned into text on our own server in the European Union, so that the doctor does not have to type the documentation during the conversation. NO audio file is created. The doctor asks you beforehand; without your consent nothing is transcribed and the consultation takes place regardless. The text is deleted once your documents have been sent; whatever belongs in the medical record has been reviewed and adopted by the doctor beforehand |
| Billing under the GOÄ | Art. 6 (1) (b) and (c) GDPR | 10 years (section 147 of the German Fiscal Code) |
| Audience measurement for this website | Art. 6 (1) (f) GDPR, legitimate interest in a working website that meets demand | Aggregated statistics without cookies and without recognising you across days, on our own server in the European Union (Umami, Hetzner). No disclosure to third parties, raw data 12 months |
| Usage analysis of the booking process (Microsoft Clarity) | Art. 6 (1) (f) GDPR, legitimate interest in a clear, error-free booking process | Clarity records how the pages are used: clicks, scrolling, time spent and movements on the page. Without cookies; entries in form fields, the symptoms you select and the booking summary are masked and are not transmitted. The practice pages and the questionnaire before the consultation are excluded. The provider is Microsoft (see recipients). Recordings 30 days. To object: the browser setting „Do Not Track" or a script blocker; booking works regardless |
| Chat for questions | Art. 6 (1) (f) GDPR, legitimate interest in answering enquiries; for health-related information Art. 9 (2) (h) GDPR | The chat only loads when you open it yourself and runs on our own server in the European Union (Chatwoot, Hetzner); no third-party provider is involved. Your messages are stored, along with technical details about browser and device; an email address only if you provide one. Please do not mention symptoms or diagnoses in the chat - that is what the video consultation is for. Deleted after 6 months; where it relates to treatment, as part of the medical record |
| Measuring the success of advertising | Art. 6 (1) (f) GDPR, legitimate interest in assessing our own advertising | After a paid booking a conversion event is transmitted to the advertising provider whose ad you arrived through. To Meta: an encrypted hash of the email address and name, the amount, IP address, browser identifier and the advertising click identifier. To Google: a hash of the email address, the amount and the click identifier. To OpenAI (ads in ChatGPT): only the click identifier, amount, time and a payment number, no email address, no name, no IP address; no OpenAI script is loaded and no cookie is set. No information about symptoms, diagnoses or the certificate. You may object under Art. 21 GDPR at any time by email |
| Abandoned booking | Art. 6 (1) (f) GDPR, legitimate interest in following up an abandoned process | If you enter your contact details in the second step of the booking and do not complete it, we store your name, email address, phone number, postal code, city and insurance status for 30 days, so that we can follow up with you. We contact you once by email and once by text message. Your information about symptoms is not stored - it only comes into being with the treatment contract. You may object under Art. 21 GDPR at any time by email, after which we delete it immediately |
Recipients
We use processors under Article 28 GDPR for hosting, appointment booking, the video consultation and payment. Everyone with access to patient data is additionally bound to secrecy under section 203 (4) of the German Criminal Code.
| Recipient | Purpose | Location |
|---|---|---|
| Netlify, Inc. | Hosting of this website and the booking functions | USA, standard contractual clauses |
| Mollie B.V. | Payment processing | Netherlands |
| Zoho Corporation B.V. | The practice email account and storage of sent messages | Netherlands, data centre in the European Union |
| Zoho Corporation B.V. (ZeptoMail) | Sending the appointment and document emails | Netherlands, data centre in the European Union |
| seven communications GmbH | Sending a single text message after an abandoned booking | Germany |
| Hetzner Online GmbH | Servers for the video consultation, the transcript, the chat and audience measurement | Germany, data centre in Finland |
| Meta Platforms Ireland Ltd. | Measuring the success of advertising, see the table above | Ireland, transfer to the USA on the basis of the adequacy decision |
| Microsoft Ireland Operations Ltd. | Usage analysis of the booking process (Clarity), see the table above | Ireland, transfer to the USA on the basis of the adequacy decision (EU-US Data Privacy Framework, Microsoft is certified) |
| Google Ireland Ltd. | Delivery of search advertisements and measuring their success, see the table above | Ireland, transfer to the USA on the basis of the adequacy decision |
| OpenAI Ireland Ltd. | Measuring the success of ads in ChatGPT, see the table above | Ireland, transfer to the USA under the OpenAI data processing terms (adequacy decision or EU standard contractual clauses) |
The video consultation itself runs on our own server with no third-party provider involved. Picture and sound are not recorded.
Your rights
You have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw consent at any time with effect for the future.
Complaints can be addressed to the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
No automated decision-making
The assessment of your report and the statements made in the consultation come solely from the doctor. No automated decision-making within the meaning of Article 22 GDPR takes place.
The doctor uses two systems as tools: one turns the audio of the consultation into text, a second drafts the documentation from it. Both only produce text. The doctor reads every draft, changes it where necessary and releases it; nothing is stored or sent without that release.