Data Processing Agreement (AVV)

This is a convenience translation. Only the German version is legally binding. Read the German original.

1. Scope of Application

The Contractor provides services to the Client in connection with an integrated controlling system for medical care centers / medical practices in accordance with the agreement concluded between the parties on the use of the MediPulse software (hereinafter: the “Main Agreement”). Pursuant to Section 3 of the General Terms and Conditions, the Main Agreement is concluded by registration on the platform and the express acceptance of these terms; this agreement constitutes their Annex 1. The performance of the Main Agreement includes the processing of personal data within the meaning of the General Data Protection Regulation (“GDPR”). In order to meet the requirements of the GDPR for such constellations, the parties conclude the following agreement, the performance of which is not separately remunerated unless expressly agreed.

In the course of the commissioned relationship, personal data of patients may be processed in the allocation and billing of receivables under the Main Agreement. In doing so, the Contractor processes personal data in respect of which the Client acts as controller within the meaning of data protection law (“Client Data”). This Annex to the Main Agreement specifies the data protection obligations and rights of the parties in connection with the processing of Client Data for the provision of the services under the Main Agreement.

2. Scope and Duration of the Commission / Client’s Authority to Issue Instructions

  1. The Contractor shall process the Client Data exclusively on behalf of and in accordance with the instructions of the Client, unless the Contractor is required by law to carry out other processing. In the latter case, the Contractor shall inform the Client of these legal requirements before the processing, unless the law in question prohibits such information on important grounds of public interest.
  2. The processing of Client Data by the Contractor takes place exclusively in the manner, to the extent and for the purpose specified in the Main Agreement and, supplementarily, in Annex 1 to this data processing agreement; the processing concerns exclusively the types of personal data and categories of data subjects designated therein.
  3. The Client reserves the right to issue further instructions regarding the type, scope, purposes and means of the processing of Client Data. The Client’s instructions shall in principle (exceptions are possible) be given in written form or text form. If necessary, the Client may also issue instructions orally or by telephone. Instructions given orally or by telephone, however, require confirmation in written form or text form without undue delay, insofar as reasonable. The Contractor is obliged to document all material instructions of the Client.
  4. If the Contractor is of the well-founded opinion that an instruction of the Client violates this agreement or applicable data protection law, the Contractor shall notify the Client thereof without undue delay. After timely prior notice to the Client with a period of at least 14 days, the Contractor is entitled to suspend the execution of the instruction until the instruction is confirmed or amended by the Client. If the Client confirms the instruction, the Contractor is obliged to follow it.
  5. The term of this agreement corresponds to the term of the Main Agreement. In accordance with the obligations under the Main Agreement, the processing on behalf ends in each case either (i) upon termination of the Main Agreement, (ii) upon termination of this agreement, (iii) upon erasure / destruction of the data after expiry of the statutory retention periods in accordance with the provisions of the Main Agreement, or (iv) upon a corresponding instruction of the Client, for example as a result of an objection by a data subject. In case of doubt, a termination of the Main Agreement shall also be deemed a termination of this agreement.
  6. The processing of the Client Data takes place exclusively in data centers within the Federal Republic of Germany. No transfer to a third country or to an international organization within the meaning of Chapter V GDPR takes place; this also applies to access for support or maintenance purposes. Should a transfer become necessary in the future, it shall take place only on the prior instruction of the Client and only on a basis pursuant to Art. 44 to 49 GDPR.
  7. The processing begins with the first transfer of Client Data and continues for as long as the Main Agreement exists. It ends upon the termination of the Main Agreement. Within 30 days after termination of the Main Agreement or after a corresponding request by the Client, the Contractor shall, at the Client’s option, return the Client Data or erase it completely and irrevocably, unless a statutory retention obligation precludes this; Section 8 remains unaffected. Beyond the aforementioned period, the Contractor shall process the Client Data only insofar as it is legally obliged to do so.

3. Requirements for Personnel

  1. The Contractor shall oblige all natural persons acting under its authority who process Client Data to maintain confidentiality with regard to the processing of Client Data.
  2. The Contractor shall ensure that natural persons acting under its authority who have access to Client Data process such data only on its instructions, unless they are required to carry out other processing under Union or Member State law.

4. Security of Processing

  1. The Contractor shall take all appropriate technical and organizational measures that are necessary, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of the Client Data as well as the risk of varying likelihood and severity for the rights and freedoms of the data subjects, in order to ensure a level of protection for the Client Data appropriate to the risk.
  2. Before the start of the processing of the Client Data, the Contractor shall, in addition to the obligations set out in the Main Agreement, in particular take the technical and organizational measures specified in Annex 2 to this agreement and maintain them during the Main Agreement, and ensure that the processing of Client Data is carried out in accordance with these measures.
  3. Insofar as the processing concerns special categories of personal data within the meaning of Art. 9 GDPR, the Contractor applies additional restrictions: access is granted exclusively to persons authorized by name, every access is logged, and the data is processed separately from other data sets. In accordance with the scope set out in Annex 1, no directly patient-related data reaches the Contractor from the practice management system. The payment transaction data of the connected accounts is different: it contains the name and payment reference of the payers, and thus, in the case of private patients and self-payers, information about patients. This may reveal a treatment and thus health data within the meaning of Art. 9 GDPR, for example in the case of payments to a psychotherapeutic practice. Sentence 1 applies to this data.

5. Engagement of Further Processors

  1. The Contractor shall not engage any subcontractor without the consent of the Client. The Contractor shall ensure that a corresponding consent of the Client exists for all further subcontractors used in connection with the processing that is the subject of the agreement. The Contractor shall inform the Client at least 15 days in advance of any intended change concerning the addition or replacement of subcontractors, thereby giving the Client the opportunity to object to such changes. Consent shall be deemed granted unless the Client objects within three weeks. If the Client, by its objection, refuses consent for reasons other than good cause, the Contractor may terminate the agreement with effect from the date of the planned engagement of the subcontractor.
  2. The Contractor shall bind the further processor in writing in the sub-processing agreement in the same way as the Contractor is bound towards the Client under this agreement. In the sub-processing agreement, the Client shall be granted all control rights pursuant to Section 9 of this agreement directly vis-à-vis the further processor (genuine contract for the benefit of third parties). The Contractor is liable for any fault of each further processor as for its own fault.
  3. The Contractor shall review compliance with the contractual obligations of the further processor regularly (i.e. at least once a year) in an appropriate form and document the result of the review. The Client remains entitled to monitor the Contractor’s exercise of its control powers without restriction and may at any time also exercise this control itself vis-à-vis the further processor.

6. Rights of Data Subjects

  1. The Contractor shall, within reasonable limits, support the Client with technical and organizational measures in fulfilling its obligations to respond to requests for the exercise of the rights to which data subjects are entitled.
  2. In particular, the Contractor shall:
    • inform the Client without undue delay if a data subject should contact the Contractor directly with a request to exercise their rights in relation to Client Data;
    • provide the Client, upon request, with all information available to it on the processing of Client Data that the Client requires to respond to the request of a data subject and that the Client does not itself have.

7. Other Support Obligations of the Contractor

  1. The Contractor shall notify the Client without undue delay after becoming aware of it of any breach of the protection of Client Data, in particular incidents leading to the destruction, loss, alteration or unauthorized disclosure of, or unauthorized access to, Client Data. The notification shall, where possible, contain a description of:
    • the nature of the breach of the protection of the Client Data, where possible including the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
    • the likely consequences of the breach of the protection of the Client Data;
    • the measures taken or proposed by the Contractor to address the breach of the protection of the Client Data and, where appropriate, measures to mitigate its possible adverse effects.
  2. In the event that the Client is obliged to inform the supervisory authorities and/or data subjects pursuant to Art. 33, 34 GDPR, the Contractor shall, upon the Client’s request, support the Client in complying with these obligations.
  3. The Contractor shall, within reasonable limits, support the Client in any data protection impact assessments to be carried out by the Client and any subsequent consultations of the supervisory authorities pursuant to Art. 35, 36 GDPR.

8. Erasure and Return of Data

After termination of the Main Agreement or at any time upon the Client’s request, the Contractor shall return to the Client all documents, data or data carriers provided to it or, at the Client’s request, erase them completely and irrevocably, unless a statutory retention period applies. If a data subject objects to the processing, the Contractor shall implement the Client’s instruction issued in this regard. The Contractor cannot itself identify a data subject because it is unable to attribute the pseudonymized identifiers to individual persons; such attribution is the sole responsibility of the Client.

9. Evidence and Audits

  1. The Contractor shall ensure and regularly verify that the processing of the Client Data is in accordance with this Annex, including the scope of the processing of the Client Data set out in Annex 1, and with the instructions of the Client.
  2. The Contractor shall document the implementation of the obligations under this data processing agreement in an appropriate manner and present corresponding evidence to the Client upon request. The Client is entitled, before the start of the processing of Client Data and regularly during the term of the Main Agreement, to audit the Contractor, itself or through an auditor commissioned by it, with regard to compliance with the provisions of this Annex, in particular the implementation of the technical and organizational measures pursuant to Annex 2. The Contractor shall enable such audits and contribute to them by all expedient and reasonable measures.

10. Liability

  1. The liability of the parties is governed by Art. 82 GDPR. Any liability of the Contractor towards the Client or of the Client towards the Contractor for breach of obligations under this agreement or the Main Agreement remains unaffected thereby. This applies in particular to guarantees and/or indemnities assumed by the Client towards the Contractor under the Main Agreement.
  2. The parties shall each indemnify one another against liability under Art. 82 GDPR if a party proves that it is in no way responsible for the event giving rise to the damage suffered by a data subject. The preceding sentence applies accordingly in the case of a fine imposed on a party, whereby the indemnification shall be granted to the extent that the respective other party bears a share of the responsibility for the infringement sanctioned by the fine. Where applicable, indemnities assumed under the Main Agreement take precedence in this context.

11. Protection of Professional Secrets (Section 203 StGB)

  1. As a physician, psychotherapist or member of another healthcare profession, the Client may be obliged to protect third-party secrets pursuant to Section 203 of the German Criminal Code (StGB). The Contractor participates in the Client’s professional activity as another participating person within the meaning of Section 203(3) sentence 2 StGB.
  2. The Contractor undertakes to maintain secrecy about all third-party secrets that become known to it in the performance of the Main Agreement. It shall acquire knowledge of them only to the extent necessary for the fulfillment of the Main Agreement.
  3. The Contractor has been informed that, pursuant to Section 203(4) sentence 1 StGB, any person who, as a participating person, discloses without authorization a third-party secret that has become known to them in the exercise or on the occasion of their activity is liable to prosecution.
  4. The Contractor has obliged all employees who may have access to Client Data in text form to maintain secrecy and has informed them of criminal liability pursuant to Section 203(4) StGB. It shall likewise oblige and inform newly joining employees before their first access. It shall provide the Client with evidence of this obligation upon request.
  5. If the Contractor makes use of further persons who participate in its activity and may thereby obtain knowledge of third-party secrets, it shall oblige them in text form to maintain secrecy beforehand (Section 203(4) sentence 2 no. 2 StGB).
  6. The obligations under this Section continue to apply beyond the end of the Main Agreement.

12. Final Provisions

  1. Should individual provisions of this agreement be or become invalid or contain a gap, the remaining provisions shall remain unaffected. The parties undertake to replace the invalid provision with a legally permissible provision that comes closest to the purpose of the invalid provision and best meets the requirements of Art. 28 GDPR.
  2. In the event of contradictions between this agreement and other agreements between the parties, in particular the Main Agreement, the provisions of this agreement shall take precedence.
  3. The Client is entitled to terminate the Main Agreement and this agreement if the Contractor violates material obligations under this agreement and does not remedy the violation within a reasonable period set by the Client. If the Contractor is unable, for legal or factual reasons, to comply with this agreement, it shall notify the Client thereof without undue delay and suspend the processing until an instruction is given by the Client.

Annex 1: Purpose, Nature and Scope of the Data Processing, Types of Data and Categories of Data Subjects

Purpose of the data processing:

  • Preparation of an integrated controlling and management overview of service, billing and payment data
  • Analysis of economic key figures per location and per service provider
  • Reconciliation of billed services with the incoming payments of the connected accounts
  • Provision of comparative values, exclusively aggregated across a group of practices and without traceability to an individual practice
  • Provision of revenue, case and contact figures per service provider to the Client, for example as a basis for target agreements
  • Analysis of further data that the Client uploads itself, for example from personnel administration or time recording, for the same economic purpose
  • Provision of an AI assistant that answers users’ questions about the Client’s key figures. It accesses Client Data only after the Client’s prior consent. The Contractor operates the language model itself on its own servers in Germany; Client Data is not used to train AI models.

The Client determines on its own responsibility how it uses the key figures per service provider. The Contractor prepares existing service data and does not create employee profiles from it.

Types of data:

  • Location data (practice-internal identifier, designation, practice site number (Betriebsstättennummer))
  • Data of the service providers (practice-internal identifier, title, first and last name, lifelong physician number)
  • Pseudonymized patient identifier – exclusively the practice-internal identifier, no master, contact or insurance data
  • Billing data (billing type, invoice number, service period, invoice date)
  • Service data (date, billing code, billing type, point values, amounts, factors, tariff, material costs, quantity, percentages)
  • Diagnosis data (ICD-10 code and diagnostic certainty), exclusively linked to the pseudonymized patient identifier; no diagnosis texts, no findings and no other content of the treatment documentation
  • Payment transaction data of the connected accounts (booking date, amount, IBAN, name and IBAN of the payment counterparty, payment reference), as transmitted by the bank. In the case of payments by private patients and self-payers, this data contains their names and may allow conclusions to be drawn about a treatment (Art. 9 GDPR); Section 4.3 applies.
  • Analysis data uploaded by the Client, for example from personnel administration or time recording; the Client determines with the export which fields are transferred. Special categories of personal data pursuant to Art. 9 GDPR are not intended; if the Client nevertheless uploads them, Section 4.3 applies.

Origin of the payment transaction data: account connection via finAPI, no further processor

The connection of the bank accounts is provided by finAPI GmbH, München, as an account information service supervised by the German Federal Financial Supervisory Authority pursuant to Section 1(34) of the German Payment Services Supervision Act (ZAG). For this purpose, the Client concludes its own user agreement with finAPI upon connection; finAPI provides this service on its own responsibility and is not a further processor of the Contractor. The Contractor processes the account transactions that finAPI provides at the Client’s instigation in accordance with this agreement. Only the account information service is used, not the payment initiation service pursuant to Section 1(33) ZAG.
Place of processing at finAPI: Germany or another Member State of the EU.
Evidence: TÜV NORD CERT, “Trusted Site Privacy”, certificate no. 5558.25.

Categories of data subjects:

  • Patients: from the practice management system exclusively in pseudonymized form; in the payment transaction data with names, insofar as they pay themselves (private patients, self-payers)
  • Other payment counterparties of the connected accounts, for example payers, suppliers and service providers
  • Employees of the Client, in particular employed physicians

Annex 2: Technical and Organizational Measures

The Contractor takes the following technical and organizational measures (TOMs) and maintains them during the term of the Main Agreement.

1. Confidentiality of IT Systems and Data Processing (Art. 32(1)(b) GDPR)

a) Physical access control
Physical access to the premises in which personal data is processed or stored is restricted to authorized persons by appropriate physical security measures – such as locking systems, access cards and surveillance systems.

b) System access control
Access to IT systems in which personal data is processed is protected by individual user IDs, strong password policies and multi-factor authentication. Unauthorized persons are not granted access to the systems.

c) Data access control
Personal data is processed exclusively by authorized persons with defined access rights. Rights are granted and managed according to the need-to-know principle and are reviewed regularly.

d) Separation control
Personal data processed for different purposes is separated by appropriate technical and organizational measures. This includes logical and physical separation in databases, authorization concepts and separate processing procedures.

e) Pseudonymization (Art. 32(1)(a) GDPR; Art. 25(1) GDPR)
Personal data is protected by pseudonymization where possible and necessary. This is done by using unique identifiers instead of direct identifiers, so that attribution to individual persons without additional information is ruled out or made considerably more difficult.

f) Encryption (Art. 32(1)(a) GDPR)
The Client Data is transmitted exclusively via authenticated, TLS-encrypted connections. It is stored with AES-256 encryption.

2. Integrity of IT Systems and Data Processing (Art. 32(1)(b) GDPR)

a) Transfer control
The transmission of personal data, in particular via electronic communication channels, takes place exclusively via secured and encrypted connections (e.g. TLS, VPN). Internal policies on access restriction and on the logging of data transfers are in place to prevent unauthorized disclosure or alteration.

b) Input control
The entry, modification and erasure of personal data is made traceable by technical measures. For this purpose, changes are logged, stored in an audit-proof manner and reviewed regularly. Access rights for entering or editing data are restricted to authorized persons.

3. Availability and Resilience of IT Systems (Art. 32(1)(b) GDPR)

a) Availability control
The Client Data is backed up regularly. The backups are encrypted and are stored exclusively in data centers in Germany. The retention period of the backups is 30 days; after that, they are overwritten. An erasure of Client Data takes effect in the backups as well at the latest after expiry of this period.

b) Resilience
The systems used are monitored. The Contractor provides the software with an availability of 98% per calendar month; planned maintenance work is, where possible, carried out at times of low usage and announced in good time.

4. Recoverability (Art. 32(1)(c) GDPR)

The Contractor maintains a procedure to restore the availability of the Client Data after a physical or technical incident from the most recent available backup in each case. For the component installed on the practice server, a rollback mechanism is additionally in place; updates are signed and checked for integrity before installation.

5. Procedure for Regular Testing, Assessment and Evaluation (Art. 32(1)(d) GDPR; Art. 25(1) GDPR)

The effectiveness of the technical and organizational measures is regularly tested, assessed and adjusted as necessary. This includes internal audits, security reviews, penetration tests and the ongoing analysis of new risks and threats in the field of data protection and IT security.

6. Identification and Authorization of Users

Access takes place via individual, personal user IDs with multi-factor authentication. Rights are assigned on a role basis; a distinction is made between the roles practice owner, physician and administration, each with a different scope of functions and data.

7. Logging of Events

The entry, modification and erasure of Client Data are logged in an audit-proof manner. Access by employees of the Contractor to Client Data takes place only with the consent of the Client; the consent and the access are documented and can be viewed by the Client. Logs are retained for 90 days.

8. Data Minimization

The export from the practice management system is limited to the fields designated in Annex 1. Of a patient, only the practice-internal identifier is transferred; master, contact and insurance data remain in the Client’s practice management system.

9. Erasure and Return

After termination of the Main Agreement or upon the Client’s request, the Client Data is returned or completely and irrevocably erased within 30 days, unless a statutory retention period precludes this. An erasure takes effect in the backups as well at the latest after expiry of the retention period of the backups.

Annex 3: Approved Further Processors

The Contractor uses the following further processors at the time of conclusion of the agreement. The Client grants its consent thereto pursuant to Section 5.1. The Contractor shall give notice of any change to this list at least 15 days in advance; the right to object pursuant to Section 5.1 remains unaffected.

1. Amazon Web Services

Service: Operation of the servers and storage of the Client Data.
Place of processing: exclusively the Frankfurt am Main region, Germany. No processing takes place in other regions.
Evidence: ISO 27001 and BSI C5. The Contractor shall present the certificates upon request.