MeinBefund24Privacy information
This is a translation for your convenience. In the event of any discrepancy the German version prevails; you can read it at meinbefund24.de/datenschutz.
Controller
The controller for the processing of health data in the course of treatment is:
Mirco Giannini
Münsterlandstraße 33, 10317 Berlin
Email: kontakt@meinbefund24.de
Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Booking an appointment (including a callback number in case the audio connection fails) | Art. 6 (1) (b) GDPR | Until the treatment is complete, thereafter as part of the medical record |
| Questions by phone before booking | Art. 6 (1) (b) and (f) GDPR | No recording, no voicemail; connection data held by the telephone provider under its own retention periods |
| Details before the consultation and medical advice | Art. 9 (2) (h) GDPR in conjunction with section 630f BGB | 10 years after the treatment is complete (section 630f (3) BGB) |
| Uploaded report (photo or PDF) | Art. 9 (2) (a) GDPR (consent given by uploading) | The report is transmitted in encrypted form and stored on our own storage in Germany (Hetzner) so that the doctor can read it before the call. It is deleted after the summary has been sent, at the latest 14 days after upload; you can remove it yourself until the consultation. Whatever the consultation requires to be documented is recorded in the patient file. |
| Video consultation | Art. 9 (2) (h) GDPR | No recording of picture or sound. The video service runs on our own server in the European Union (Hetzner, Helsinki); no third-party provider is involved. Connection logs 7 days |
| Written transcript of the consultation | Art. 9 (2) (a) GDPR (consent) | The audio of the consultation is turned into text on our own server in the European Union, so that the doctor does not have to type the documentation during the conversation. NO audio file is created. The doctor asks you beforehand; without your consent nothing is transcribed and the consultation takes place regardless. The text is deleted once your documents have been sent; whatever belongs in the medical record has been reviewed and adopted by the doctor beforehand |
| Billing under the GOÄ | Art. 6 (1) (b) and (c) GDPR | 10 years (section 147 of the German Fiscal Code) |
| Audience measurement for this website | Art. 6 (1) (f) GDPR, legitimate interest in a working website that meets demand | Statistics without cookies on our own server in the European Union (Umami, Hetzner): pages and sections viewed, time on page, buttons used and the origin of the visit. Your device is recognised for no longer than one calendar month, via an identifier derived from IP address and browser details that changes every month; the IP address itself is not stored. Raw data 12 months The events (sections viewed, time on page, buttons) are also sent to Microsoft Clarity, see the next row; otherwise no disclosure. |
| Usage analysis of the pages and the booking process (Microsoft Clarity) | Art. 6 (1) (f) GDPR, legitimate interest in clear pages and an error-free booking process | Clarity records how the pages are used: clicks, scrolling, time spent and movements on the page. For this, Clarity sets two cookies: _clck (one year, recognises your browser on a later visit) and _clsk (one day, links the pages of one visit). Clarity does not set advertising cookies. Each recording carries attributes of the visit: the topic of the page or of the chosen application, the language, whether you came from an ad (campaign, ad group, search term, entry point) and the events listed above under audience measurement. entries in form fields, the type of report you select, the answers in the self-check, the booking summary and the chat are masked and are not transmitted. The pages for your documents and the questionnaire, the pages after booking, the withdrawal page, addresses containing your booking number and the practice pages are excluded. Which page you open (for example the page on care levels) is part of the recording. The provider is Microsoft (see recipients). Microsoft keeps recordings for 30 days, recordings marked as favourites and a random sample for up to nine months. To object: the browser setting „Do Not Track" or „Global Privacy Control", blocked cookies, a script blocker, or opening meinbefund24.de/?messung=aus once (applies to this browser, including audience measurement); booking works regardless |
| Chat for questions | Art. 6 (1) (f) GDPR, legitimate interest in answering enquiries; for the reply by email Art. 6 (1) (b) GDPR; for health-related information Art. 9 (2) (h) GDPR | The chat only contacts our server once you send your first message. After that, your browser remembers an identifier for the conversation (local storage) so that the history and replies are there on your next visit. The chat runs on our own server in the European Union (Chatwoot, Hetzner); no third-party provider is involved. Your messages are stored, along with technical details about browser and device; an email address only if you provide one. In that case we also send you our reply by email if you no longer read it in the chat (sent via ZeptoMail, see recipients). Please do not mention symptoms or diagnoses in the chat - that is what the video consultation is for. Deleted after 6 months; where it relates to treatment, as part of the medical record |
| Measuring the success of advertising | Art. 6 (1) (f) GDPR, legitimate interest in assessing our own advertising | After a paid booking a conversion event is transmitted to the advertising provider whose ad you arrived through. To Meta: an encrypted hash of the email address and name, the amount, IP address, browser identifier and the advertising click identifier. To Google: a hash of the email address, the amount and the click identifier. To OpenAI (ads in ChatGPT): only the click identifier, amount, time and a payment number, no email address, no name, no IP address; no OpenAI script is loaded and no cookie is set. For a medical report on an application, Google receives only the amount, time and click identifier, no email address. If you arrive through an ad, your browser remembers the click identifier and the campaign of that ad for up to 90 days (local storage, no cookie) so that a later booking can be attributed to the ad. It reaches our server only when you start a booking, and the advertising provider only after a paid booking. No information about symptoms, diagnoses or the certificate. You may object under Art. 21 GDPR at any time by email |
| Abandoned booking | Art. 6 (1) (f) GDPR, legitimate interest in following up an abandoned process | If you enter your contact details in the second step of the booking and do not complete it, we store your name, email address, phone number, postal code, city and insurance status for 30 days, so that we can follow up with you. We contact you once by email and once by text message. Your information about symptoms is not stored - it only comes into being with the treatment contract. You may object under Art. 21 GDPR at any time by email, after which we delete it immediately |
| Self-check evaluation by email | Consent, Art. 6 (1) (a) and Art. 9 (2) (a) GDPR | If you tick the box in the self-check on one of our application pages and enter your email address, we send you your evaluation by email (sent via ZeptoMail, see recipients). For this, your browser transmits the address, the topic (severe disability, reduced earning capacity pension or care level), your answers in short form and, if you arrived via an ad, its campaign. We store this information on our own storage in Germany (Hetzner) in order to send you further information about your application by email, until you withdraw your consent, at most 12 months after your last request. You can withdraw via the link “Angaben löschen” (delete data) in the email or informally by email to us; withdrawal does not affect the lawfulness of processing before the withdrawal. To prevent misuse, we also keep hashes of your connection (derived from the IP address) and of your address for up to two days, from which neither can be derived, and send at most one evaluation per address and day. |
Recipients
We use processors under Article 28 GDPR for hosting, appointment booking, the video consultation and payment. Everyone with access to patient data is additionally bound to secrecy under section 203 (4) of the German Criminal Code.
| Recipient | Purpose | Location |
|---|---|---|
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing as an independent controller. From us PayPal receives the amount, the name of the service and the booking number. When you enter the payment step, a script from PayPal is loaded, even if you pay another way; PayPal then learns your IP address and technical details about your browser. Card details from the card fields go directly to PayPal, not to us. If you pay with Apple Pay, PayPal may also receive the billing address of your card | Luxembourg |
| Apple Distribution International Ltd. | Apple Pay, if you choose this payment method: authorising the payment on your device (amount and name of the payee) | Ireland |
| Google Ireland Limited | Google Pay, on devices without Apple Pay: the Google payment script is loaded in the payment step (Google then learns your IP address and technical details about your browser); if you choose Google Pay, the authorisation runs through Google (amount and name of the payee) | Ireland |
| Mollie B.V. | Processing of payments made up to 10 October 2026 (refunds, settlement) | Netherlands |
| Zoho Corporation B.V. | The practice email account and storage of sent messages | Netherlands, data centre in the European Union |
| Zoho Corporation B.V. (ZeptoMail) | Sending the appointment and document emails | Netherlands, data centre in the European Union |
| seven communications GmbH | Sending a single text message after an abandoned booking | Germany |
| Hetzner Online GmbH | Hosting of this website and the booking functions, including the storage for all details from booking, questionnaire, upload and patient file (data centre in Germany); servers for the video consultation, the transcript, the chat and audience measurement (data centre in Finland). The booking details for payment (name, email address and appointment) for at most 30 days, after that only the payment reference needed for a refund, up to 180 days | Germany, data centres in Germany and Finland |
| Anthropic Ireland, Limited | Language model: draft of the consultation record from the transcript | Ireland; processing also takes place in the USA, on the basis of the EU standard contractual clauses |
| Openapi S.p.A. | Qualified electronic signature of reports and prescriptions; the certificate is issued by Namirial S.p.A. | Italy, data centre in Belgium |
| Meta Platforms Ireland Ltd. | Measuring the success of advertising, see the table above | Ireland, transfer to the USA on the basis of the adequacy decision |
| Microsoft Ireland Operations Ltd. | Usage analysis of the pages and the booking process (Clarity), see the table above | Ireland, transfer to the USA on the basis of the adequacy decision (EU-US Data Privacy Framework, Microsoft is certified) |
| Google Ireland Ltd. | Delivery of search advertisements and measuring their success, see the table above | Ireland, transfer to the USA on the basis of the adequacy decision |
| OpenAI Ireland Ltd. | Measuring the success of ads in ChatGPT, see the table above | Ireland, transfer to the USA under the OpenAI data processing terms (adequacy decision or EU standard contractual clauses) |
The video consultation itself runs on our own server with no third-party provider involved. Picture and sound are not recorded.
Your rights
You have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw consent at any time with effect for the future.
Complaints can be addressed to the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
We need your name, email address, appointment and payment data for the contract; without them no booking is possible. Reports, documents and the questionnaire are voluntary; without them the doctor cannot discuss your report or write one. Copies of the standard contractual clauses for transfers to countries outside the European Union are available on request.
No automated decision-making
The assessment of your report and the statements made in the consultation come solely from the doctor. No automated decision-making within the meaning of Article 22 GDPR takes place.
The doctor uses two systems as tools: one turns the audio of the consultation into text, a second drafts the documentation from it (a language model, see recipients). Both only produce text. The doctor reads every draft, changes it where necessary and releases it; nothing is stored or sent without that release.
Last updated: 19 October 2026