Privacy notice
Controller and contact
The controller for Krankschreibung per Video at krankschreibung-per-video.de is Drylabs GmbH, Straße der Jugend 18, 14974 Ludwigsfelde, Germany, represented by managing director Mithat Arda. Commercial register: Amtsgericht Potsdam, HRB 41588 P. Privacy enquiries: kontakt@krankschreibung-per-video.de.
Treating doctors are independent controllers for medical treatment and are bound by professional confidentiality (section 203 StGB). Drylabs GmbH is responsible for platform operation, accounts, billing and technical provision of your information to the doctor.
Visiting this website
Server logs may process IP address, time, requested address, browser and device identifier and the previous page. The purpose is secure operation and protection against attacks, based on Article 6(1)(f) GDPR. Logs are kept for no more than 14 days unless a security incident requires longer retention.
These information pages set no analytics or advertising cookies and load no analytics scripts. Fonts are loaded from our own server, with no requests to external font providers. The start link leads to the questionnaire on the same domain.
Data used for video consultations
Account and treatment data includes name, email address, hashed password, date of birth, address or postcode and insurance status. Providing a telephone number is optional. We also process information about symptoms and pre-existing conditions, consultation and message contents, treatment records and certificates.
Consent records include the version, checksum, time and language of the consent text. Payment data includes amount, status and transaction reference; Stripe processes card details directly. We also process emails and text messages relating to your enquiry, payment and appointment, and messages you send us. Audio and video are transmitted live and are not recorded.
Purposes and legal bases
Accounts, enquiries, video consultations, communications and billing serve contract performance (Article 6(1)(b) GDPR). Health data is processed on the basis of explicit consent (Article 9(2)(a) GDPR) and healthcare by professionals subject to confidentiality (Article 9(2)(h) GDPR, section 22 BDSG).
Documentation and retention are based on Article 6(1)(c) GDPR, section 630f BGB; health data also relies on Article 9(2)(h) GDPR. Consent records serve Article 7(1) GDPR. Statutory billing duties arise from section 147 AO and section 257 HGB. Legal claims and IT security rely on Article 6(1)(c) or (f) GDPR.
Login uses necessary access and refresh tokens in sessionStorage or localStorage. Access tokens last 15 minutes; refresh tokens last until logout or expiry. They are deleted on logout. The legal bases are section 25(2) no. 2 TDDDG and Article 6(1)(b) GDPR.
Recipients and international processing
Treating doctors receive information needed for treatment as independent controllers. Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, operates infrastructure at its Helsinki data centre in Finland. The self-hosted video server uses LiveKit; audio and video are not sent to the software vendor.
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, with an EU establishment in Lisbon, supports networking, delivery and attack protection, processing connection data and content in transit. Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, is an independent controller for payment processing and fraud prevention.
MailerLite Limited (MailerSend), Ground Floor, 71 Lower Baggot Street, Dublin 2, Ireland, processes names, email addresses and message contents for transactional emails. Twilio Ireland Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland, processes telephone numbers and text message contents, without diagnoses or findings.
Processors are bound by agreements under Article 28 GDPR. Health data is stored in the EU. Cloudflare, Stripe and Twilio may transfer data to the USA within the scope described, using EU standard contractual clauses (Article 46 GDPR) and, for certified recipients, the EU-U.S. Data Privacy Framework (Article 45 GDPR). Contact our privacy address for information on these safeguards.
Health data is not shared with employers, health insurers, advertisers or data brokers. You submit your certificate yourself. Authorities and courts receive data only where legally required.
Retention
Treatment records are retained for ten years after treatment ends (section 630f(3) BGB). Billing and payment records are subject to statutory retention periods under section 147 AO and section 257 HGB. Account data is retained until account deletion and thereafter only where legally required. Consent evidence is retained during the treatment relationship and until limitation periods expire, three years after withdrawal or the end of the relationship.
Your rights
You have rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests (Articles 15 to 21 GDPR). You may withdraw consent at any time for the future, without affecting prior lawful processing (Article 7(3) GDPR). Statutory retention duties may prevent erasure. Write to kontakt@krankschreibung-per-video.de. We may need proof of identity to protect your data.
You may complain to a supervisory authority (Article 77 GDPR), in particular the Brandenburg Commissioner for Data Protection and Access to Information, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.
Security and required information
Connections use transport encryption. Personal and medical database fields and documents are stored encrypted; passwords use Argon2id hashes. Role-based access restricts access, and access to patient data is logged. The video server operates in the EU; end-to-end encryption may supplement transport encryption where supported by the browser.
Contact and health information is required for the treatment contract. Without it, we cannot forward your enquiry to a doctor. Medical assessment and the decision on a certificate are made by a doctor, not solely by automated processing.
Changes
The current version is available on this page. New consent is requested when processing requiring consent changes.