Heute KrankPrivacy information
This is a translation for your convenience. In the event of any discrepancy the German version prevails; you can read it at heute-krank.de/datenschutz.
Controller
The controller for the processing of health data in the course of treatment is:
Mirco Giannini
Münsterlandstraße 33, 10317 Berlin
Email: kontakt@heute-krank.de
Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Booking an appointment (including a callback number in case the audio connection fails) | Art. 6 (1) (b) GDPR | Until the treatment is complete, thereafter as part of the medical record |
| Questions by phone before booking | Art. 6 (1) (b) and (f) GDPR | No recording, no voicemail; connection data held by the telephone provider under its own retention periods |
| Medical history and treatment | Art. 9 (2) (h) GDPR in conjunction with section 630f BGB | 10 years after the treatment is complete (section 630f (3) BGB) |
| Video consultation | Art. 9 (2) (h) GDPR | No recording of picture or sound. The video service runs on our own server in the European Union (Hetzner, Helsinki); no third-party provider is involved. Connection logs 7 days |
| Written transcript of the consultation | Art. 9 (2) (a) GDPR (consent) | The audio of the consultation is turned into text on our own server in the European Union, so that the doctor does not have to type the documentation during the conversation. NO audio file is created. The doctor asks you beforehand; without your consent nothing is transcribed and the consultation takes place regardless. The text is deleted once your documents have been sent; whatever belongs in the medical record has been reviewed and adopted by the doctor beforehand |
| Messages to your mobile phone (WhatsApp) | Art. 6 (1) (b) GDPR (performance of the treatment contract) | To organise your appointment you receive up to three messages at the mobile number you provide in the questionnaire: confirmation of your appointment after the questionnaire, the reminder shortly beforehand, and a note that your documents are on their way by email. You receive the same information by email regardless. We transmit your mobile number, the time of the appointment and the access link - no name, no symptoms, no diagnoses, no documents. The provider is WhatsApp Ireland Limited (Meta); the message is not end-to-end encrypted there, and Meta learns that you are in contact with us. You may object to these messages at any time, informally to kontakt@heute-krank.de, with effect for the future; your appointment is then organised by email only |
| Retrieving your documents at /unterlagen | Art. 6 (1) (b), Art. 9 (2) (h) GDPR | So that you can retrieve your certificate, doctor’s letter and invoice later, we keep exactly the files you received by email after your appointment. Access works via a link sent to your email address; no password account is created. We do not store your address in clear text, only as a non-reversible check value. Private prescriptions are not kept. Retention is 24 months from treatment, then deletion; the medical records required under section 630f of the German Civil Code are kept separately |
| Billing under the GOÄ | Art. 6 (1) (b) and (c) GDPR | 10 years (section 147 of the German Fiscal Code) |
| Audience measurement for this website | Art. 6 (1) (f) GDPR, legitimate interest in a working website that meets demand | Aggregated statistics without cookies and without recognising you across days, on our own server in the European Union (Umami, Hetzner). No disclosure to third parties, raw data 12 months |
| Usage analysis of the booking process (Microsoft Clarity) | Art. 6 (1) (f) GDPR, legitimate interest in a clear, error-free booking process | Clarity records how the pages are used: clicks, scrolling, time spent and movements on the page. Without cookies; entries in form fields, the symptoms you select and the booking summary are masked and are not transmitted. The practice pages and the questionnaire before the consultation are excluded. The provider is Microsoft (see recipients). Recordings 30 days. To object: the browser setting „Do Not Track" or a script blocker; booking works regardless |
| Audience and advertising measurement (Google Analytics) | Art. 6 (1) (f) GDPR, legitimate interest in knowing how visitors find us and whether our advertising works | Google Analytics 4 records which pages are viewed, which source or ad the visit came from, device type, browser and approximate location (country, region, city; Google Analytics does not store IP addresses). For this, the script sets two cookies (_ga and _ga_ with an identifier, 13 months) by which it recognises your browser on a later visit. The page address is sent to Google with the path and campaign details only, without the details you enter when booking. After a paid booking, our server reports the purchase with the amount, a booking number (not your reference) and the identifier from the cookie. The script is not loaded on the pages after booking, in the questionnaire before the consultation, in the patient area, on the practice pages or for a follow-up appointment. Google signals and personalised advertising are switched off. The provider is Google (see recipients). Analysis data 14 months. No information about symptoms, diagnoses or the certificate. You may object under Art. 21 GDPR at any time by email, by deleting the cookies or with a script blocker; booking works regardless |
| Chat for questions | Art. 6 (1) (f) GDPR, legitimate interest in answering enquiries; for the reply by email Art. 6 (1) (b) GDPR; for health-related information Art. 9 (2) (h) GDPR | The chat only contacts our server once you send your first message. After that, your browser remembers an identifier for the conversation (local storage) so that the history and replies are there on your next visit. The chat runs on our own server in the European Union (Chatwoot, Hetzner); no third-party provider is involved. Your messages are stored, along with technical details about browser and device; an email address only if you provide one. In that case we also send you our reply by email if you no longer read it in the chat (sent via ZeptoMail, see recipients). Please do not mention symptoms or diagnoses in the chat - that is what the video consultation is for. Deleted after 6 months; where it relates to treatment, as part of the medical record |
| Measuring the success of advertising | Art. 6 (1) (f) GDPR, legitimate interest in assessing our own advertising | To measure the success of advertising, events are transmitted to advertising providers. To Meta, regardless of whether you arrived through an ad (Meta makes the assignment itself): when the booking page is opened, after an appointment is chosen, when a voucher is confirmed, when payment is started and after a paid booking, in each case the IP address, browser identifier, a visitor identifier and, if present, the advertising click identifier with the time of the click; when a voucher is confirmed additionally an encrypted hash of the email address, from the start of payment such a hash of the email address and name and the amount. No Meta script is loaded and no cookie is set; the visitor identifier is kept for up to 90 days in the local storage of your browser. To Google: after a paid booking a hash of the email address, the amount and the click identifier. To OpenAI (ads in ChatGPT): only the click identifier, amount, time and a payment number, no email address, no name, no IP address; no OpenAI script is loaded and no cookie is set. So that the assignment also works if you book later in a new window, your browser keeps the click identifier, the campaign and the page you came from for up to seven days in local storage (no cookie), and the click identifier of a Google ad for up to 30 days. No information about symptoms, diagnoses or the certificate. You may object under Art. 21 GDPR at any time by email |
| Affiliate programme (AWIN) | Art. 6 (1) (f) GDPR, legitimate interest in settling accounts with partners who refer visitors to us | Partners such as voucher, cashback and advice websites refer visitors to us via the AWIN network and receive a commission for a paid first booking. For this purpose, a script from AWIN loads on our information pages (not during or after booking); if you arrive via a partner link, it stores the partner identifier in a cookie (30 days). After a paid booking, AWIN receives the booking number, the amount and whether the last advertising click came via AWIN, a search ad or Meta, and technically your IP address and browser identifier. Your browser keeps the partner identifier and the type of the last advertising click for up to 30 days in local storage. No email address, no name, no information about symptoms. You may object under Art. 21 GDPR at any time by email |
| Abandoned booking | Art. 6 (1) (f) GDPR, legitimate interest in following up an abandoned process | If you enter your contact details during booking and do not complete it, we store your name, email address and insurance status for 30 days, so that we can follow up with you. We contact you at most twice by email. Your information about symptoms is not stored - it only comes into being with the treatment contract. You may object under Art. 21 GDPR at any time by email, after which we delete it immediately |
| Voucher for later | Art. 6 (1) (a) GDPR, consent, which you give via the link in our confirmation email | If you request a voucher on the booking page, we store your email address, the time of the request and of the confirmation, and where your visit came from (campaign, advertising click identifier, visitor identifier). We send you an email to confirm, then the voucher and at most one reminder before it expires. Your browser keeps the voucher in local storage until it expires (no cookie). Without confirmation we delete the address after 30 days, otherwise 30 days after the voucher expires, at most after seven months. You can withdraw your consent at any time via the link in each of these emails; the voucher remains valid afterwards. |
| Recommendations | Art. 6 (1) (b) GDPR, participation in the recommendation scheme | With your certificate you receive a personal code. For this we store your name, date of birth, email address, phone number, the payments for your appointments and your credits. If someone books through your link, the code is attached to that booking; you are not told who booked. On the day after your sick note ends, we send you one WhatsApp message with your link if you allowed WhatsApp in the questionnaire, and an email and a WhatsApp message for every credit. You may object at any time by email. Stored as long as your patient area exists, credits as accounting records for ten years (section 147 AO). |
| Treating a child: if a parent books for their child, we process the parent's contact details and the child's name, date of birth, address and health data. The child's name and date of birth appear on the certificate for school or nursery and on the certificate for child sick pay, which the parent passes on; the parent's name appears on that certificate and on the invoice. | Art. 6 (1) (b) and Art. 9 (2) (h) GDPR (treatment contract for the benefit of the child) | Like the rest of the medical record: ten years (section 630f (3) BGB) |
| Payment processing | Art. 6 (1) (b) GDPR. Technical log of the payment process: Art. 6 (1) (f) GDPR (troubleshooting, prevention of misuse). The scripts of the payment services load in the payment step because payment is not possible without them (section 25 (2) no. 2 TDDDG). If you return from the payment service without the payment being completed, we set a cookie (hk_weiter, 30 minutes). Its only purpose is to let you continue your booking with your details, even in another browser window, and it is technically necessary for that (section 25 (2) no. 2 TDDDG). When the Stripe script loads in the payment step, it sets two cookies for fraud prevention (__stripe_mid, one year; __stripe_sid, 30 minutes), which likewise serve only the payment (section 25 (2) no. 2 TDDDG). | Payment records for the retention periods under tax law; the technical log for 90 days. |
Recipients
We use processors under Article 28 GDPR for hosting, appointment booking and the video consultation. Everyone with access to patient data is additionally bound to secrecy under section 203 (4) of the German Criminal Code. The payment services (PayPal, Stripe, Apple, Google, Klarna, Trustly and, for payments up to 2 October 2026, Mollie) process payment data as independent controllers; their own privacy notices apply.
| Recipient | Purpose | Location |
|---|---|---|
| Netlify, Inc. | Hosting of this website and running the booking functions; your data is not stored there permanently | USA, standard contractual clauses |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing. When you enter the payment step, a script from PayPal is loaded where PayPal handles the card fields, Apple Pay or Google Pay (otherwise Stripe does, see below), even if you pay another way; PayPal then learns your IP address and technical details about your browser. Where the card fields come from PayPal, card details go directly to PayPal, not to us. If you pay with Apple Pay, PayPal also receives the billing address of your card. We keep a technical log of the payment process (steps, error codes from the payment provider, rough device type), without names or card details, to detect faults; it is deleted after 90 days | Luxembourg |
| Stripe Payments Europe, Ltd. | Payment processing for card, Apple Pay, Google Pay, Klarna and online bank transfer where these payment methods run through Stripe. Where card, Apple Pay or Google Pay run through Stripe, a script from Stripe is loaded when you enter the payment step, even if you pay another way; Stripe then learns your IP address and technical details about your device and browser, which Stripe also uses for fraud prevention. Card details go directly to Stripe, not to us. From us, Stripe receives the amount and the booking reference; if you pay by card, also your name and email address, which your bank uses to verify the payment (3-D Secure). For online bank transfer, you choose your bank on a Stripe page and approve the payment with your bank; Stripe receives the account details your bank transmits with the payment | Ireland; transfer to Stripe, Inc. in the USA possible (EU-US Data Privacy Framework, standard contractual clauses) |
| Apple Distribution International Ltd. | Apple Pay, if you choose this payment method: authorising the payment on your device (amount and name of the payee) | Ireland |
| Google Ireland Limited | Google Pay, on devices without Apple Pay: the Google payment script is loaded in the payment step (Google then learns your IP address and technical details about your browser); if you choose Google Pay, the authorisation runs through Google (amount and name of the payee) | Ireland |
| Klarna Bank AB (publ) | Klarna, if you choose this payment method: the payment takes place on the Klarna site. Through Stripe, Klarna learns the amount, the name of the payee and the payment description as it would also appear on a bank statement; whatever Klarna needs for the payment option you choose (for example name, address, email address, phone number, date of birth) you enter there yourself. Depending on the payment option, Klarna checks your identity and creditworthiness | Sweden |
| Trustly Group AB | Online bank transfer where it runs through PayPal: PayPal and Trustly receive your name, email address and the amount; selecting your bank and authorising the payment take place on the Trustly site | Sweden |
| Mollie B.V. | Processing of payments made up to 2 October 2026 (refunds, settlement) | Netherlands |
| Zoho Corporation B.V. | The practice email account and storage of sent messages | Netherlands, data centre in the European Union |
| Zoho Corporation B.V. (ZeptoMail) | Sending the appointment and document emails | Netherlands, data centre in the European Union |
| seven communications GmbH | Sending a single text message after an abandoned booking | Germany |
| WhatsApp Ireland Limited (Meta) | Appointment reminder to your mobile phone, only with your consent | Ireland, transfer to the USA on the basis of the adequacy decision |
| Hetzner Online GmbH | Storage of your appointments, details, documents and the treatment records (data centre in Falkenstein, Germany); servers for the video consultation, the transcript, the chat and audience measurement (data centre in Helsinki) | Germany, data centres in Germany and Finland |
| Meta Platforms Ireland Ltd. | Measuring the success of advertising, see the table above | Ireland, transfer to the USA on the basis of the adequacy decision |
| Microsoft Ireland Operations Ltd. | Usage analysis of the booking process (Clarity), see the table above | Ireland, transfer to the USA on the basis of the adequacy decision (EU-US Data Privacy Framework, Microsoft is certified) |
| Google Ireland Ltd. | Delivery of search advertisements and measuring their success, audience measurement (Google Analytics), see the table above | Ireland, transfer to the USA on the basis of the adequacy decision |
| OpenAI Ireland Ltd. | Measuring the success of ads in ChatGPT, see the table above | Ireland, transfer to the USA under the OpenAI data processing terms (adequacy decision or EU standard contractual clauses) |
| Awin AG | Affiliate programme, see the table above | Germany |
The video consultation itself runs on our own server with no third-party provider involved. Picture and sound are not recorded.
Your rights
You have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw consent at any time with effect for the future.
Complaints can be addressed to the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
No automated decision-making
Whether you are unable to work is decided solely by the doctor during the video consultation. No automated decision-making within the meaning of Article 22 GDPR takes place.
The doctor uses two systems as tools: one turns the audio of the consultation into text, a second drafts the documentation from it. Both only produce text. The doctor reads every draft, changes it where necessary and releases it; nothing is stored or sent without that release.