Privacy notice
Controller and contact
The controller for Krankschreibung per Video at krankschreibung-per-video.de is Drylabs GmbH, Straße der Jugend 18, 14974 Ludwigsfelde, Germany, represented by managing director Mithat Arda. Commercial register: Amtsgericht Potsdam, HRB 41588 P. Privacy enquiries: kontakt@krankschreibung-per-video.de.
Treating doctors are independent controllers for medical treatment and are bound by professional confidentiality (section 203 StGB). Drylabs GmbH is responsible for platform operation, accounts, billing and technical provision of your information to the doctor.
Visiting this website
Server logs may process IP address, time, requested address, browser and device identifier and the previous page. The purpose is secure operation and protection against attacks, based on Article 6(1)(f) GDPR. Logs are kept for no more than 14 days unless a security incident requires longer retention.
These pages only set analytics or advertising cookies with your consent, see the next section. They only load a script from Meta (Meta Pixel) with consent to ad performance measurement, and never a script from Google. Fonts are loaded from our own server, with no requests to external font providers. The start link leads to the questionnaire on the same domain.
Statistics and ad performance measurement
On your first visit we ask whether we may use statistics and ad performance measurement. We store your choice for 12 months in the cookie oc24_consent; you can change or withdraw it at any time via “Cookie settings” in the footer. Without consent nothing is measured and no click identifier is stored. Data for Google is sent only by our own server; no Google script loads in your browser.
Statistics (only with consent): address of the page viewed without parameters, page title, referring domain, language, the click on the start button and a random identifier and session identifier (cookies oc24_cid, 13 months, and oc24_sid, 30 minutes). The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics 4) as processor.
Ad performance measurement (only with consent): if you arrive via a Google or Meta ad, we store its click identifier (cookies oc24_click, _fbc and _fbp, 90 days). When a request with reservation is submitted, we report only this identifier, time, amount and a checksum of the request to Google Ireland Limited (Google Ads) and to Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (Conversions API), so we can see which ad led to a request. For Meta we also transmit the browser identifier (user agent). In addition, with this consent your browser loads the Meta Pixel from Meta Platforms Ireland Limited; it transmits the page viewed, the click on the start button, browser and device information, your IP address and the identifier in the _fbp cookie to Meta. Meta uses this data to measure the performance of our ads and to show ads more relevantly, including to visitors of this site. Health information, your concern, name and contact details are never transmitted. For measurement with Meta we are joint controllers with Meta (Article 26 GDPR, agreement at facebook.com/legal/controller_addendum).
The legal basis is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG); withdrawal applies for the future. A transfer to Google LLC and Meta Platforms, Inc. in the USA is possible, based on the EU-U.S. Data Privacy Framework (Article 45 GDPR) and additionally the EU standard contractual clauses. Reported click identifiers are deleted after 90 days.
Data used for video consultations
Account and treatment data includes name, email address, hashed password, date of birth, address or postcode and insurance status. Providing a telephone number is optional. We also process information about symptoms and pre-existing conditions, consultation and message contents, treatment records and certificates.
Consent records include the version, checksum, time and language of the consent text. Payment data includes amount, status and transaction reference; Stripe processes card details directly. We also process emails and text messages relating to your enquiry, payment and appointment, and messages you send us. Audio and video are transmitted live and are not recorded.
Purposes and legal bases
Accounts, enquiries, video consultations, communications and billing serve contract performance (Article 6(1)(b) GDPR). Health data is processed on the basis of explicit consent (Article 9(2)(a) GDPR) and healthcare by professionals subject to confidentiality (Article 9(2)(h) GDPR, section 22 BDSG).
Documentation and retention are based on Article 6(1)(c) GDPR, section 630f BGB; health data also relies on Article 9(2)(h) GDPR. Consent records serve Article 7(1) GDPR. Statutory billing duties arise from section 147 AO and section 257 HGB. Legal claims and IT security rely on Article 6(1)(c) or (f) GDPR.
Login uses necessary access and refresh tokens in sessionStorage or localStorage. Access tokens last 15 minutes; refresh tokens last until logout or expiry. They are deleted on logout. The legal bases are section 25(2) no. 2 TDDDG and Article 6(1)(b) GDPR.
Recipients and international processing
Treating doctors receive information needed for treatment as independent controllers. Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, operates infrastructure at its Helsinki data centre in Finland. The self-hosted video server uses LiveKit; audio and video are not sent to the software vendor.
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, with an EU establishment in Lisbon, supports networking, delivery and attack protection, processing connection data and content in transit. Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, is an independent controller for payment processing and fraud prevention.
MailerLite Limited (MailerSend), Ground Floor, 71 Lower Baggot Street, Dublin 2, Ireland, processes names, email addresses and message contents for transactional emails. Twilio Ireland Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland, processes telephone numbers and text message contents, without diagnoses or findings.
Processors are bound by agreements under Article 28 GDPR. Health data is stored in the EU. Cloudflare, Stripe and Twilio may transfer data to the USA within the scope described, using EU standard contractual clauses (Article 46 GDPR) and, for certified recipients, the EU-U.S. Data Privacy Framework (Article 45 GDPR). Contact our privacy address for information on these safeguards.
Health data is not shared with employers, health insurers, advertisers or data brokers. You submit your certificate yourself. Authorities and courts receive data only where legally required.
Retention
Treatment records are retained for ten years after treatment ends (section 630f(3) BGB). Billing and payment records are subject to statutory retention periods under section 147 AO and section 257 HGB. Account data is retained until account deletion and thereafter only where legally required. Consent evidence is retained during the treatment relationship and until limitation periods expire, three years after withdrawal or the end of the relationship.
Your rights
You have rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests (Articles 15 to 21 GDPR). You may withdraw consent at any time for the future, without affecting prior lawful processing (Article 7(3) GDPR). Statutory retention duties may prevent erasure. Write to kontakt@krankschreibung-per-video.de. We may need proof of identity to protect your data.
You may complain to a supervisory authority (Article 77 GDPR), in particular the Brandenburg Commissioner for Data Protection and Access to Information, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.
Security and required information
Connections use transport encryption. Personal and medical database fields and documents are stored encrypted; passwords use Argon2id hashes. Role-based access restricts access, and access to patient data is logged. The video server operates in the EU; end-to-end encryption may supplement transport encryption where supported by the browser.
Contact and health information is required for the treatment contract. Without it, we cannot forward your enquiry to a doctor. Medical assessment and the decision on a certificate are made by a doctor, not solely by automated processing.
Changes
The current version is available on this page. New consent is requested when processing requiring consent changes.