KEM | Evang. Kliniken-Essen-Mitte gGmbH
Henricistraße 92, 45136 Essen
Tel.: +49 (0201) 174-0
Fax: +49 (0201) 174-11310
Email: info@kem-med.com
Duty to provide information when collecting personal data
Dear Patients,
As part of your treatment or care, it is necessary to process personal and medical data about you. Since the processes both within our hospital and in interaction with other persons/institutions in the healthcare sector involved in your treatment are not easy to oversee, we have compiled the following information for you:
Purposes for which your personal data are processed
As part of your treatment, data about your person, your social status, and the medical data necessary for treatment are collected, recorded, stored, processed, queried, used, transmitted, etc. Overall, this is referred to as the “processing” of your data. This term “processing” forms the umbrella term for all these activities. For data protection reasons, the processing of patient data in the hospital is only possible if a legal basis prescribes or permits this, or if you as a patient have given your consent.
Processing of your data for preventive, diagnostic, therapeutic, curative, and also follow-up reasons is particularly necessary for your patient-related care/treatment. Likewise, processing takes place—in the sense of the best possible care—with regard to interdisciplinary conferences for the analysis and discussion of diagnostics and therapy, for pre-, co-, and follow-up care regarding diagnostics, therapy, findings, and disease/vital status. In addition, medical letters/reports are written and processing takes place for quality assurance reasons, for detecting and combating hospital infections, as well as for pastoral and social care and discharge management.
In addition to these patient-related processes, administrative handling of your treatment is also required. This essentially involves the processing of your data for billing your treatment, for reasons of controlling/auditing, for the assertion, exercise, and defense of legal claims, etc. Furthermore, data processing takes place for purposes of education, training, and further education of doctors and members of other healthcare professions, for research or for legally required reporting obligations (e.g., to the police due to registration laws, to state health offices due to the Infection Protection Act, to cancer registries) and, last but not least, for reasons of care and maintenance of IT systems and applications, etc.
From whom do we receive your data?
We generally collect the relevant data from you yourself—wherever possible. In some cases, however, it may also happen that we receive personal data concerning you from other hospitals that have carried out your initial/previous treatment, from established doctors, specialists, medical care centers (so-called MVZ), etc. These are merged with your other data in our hospital for the purpose of uniform documentation.
Who has access to your data?
The individuals involved in your treatment have access to your data. This includes, for example, physicians from other departments who take part in interdisciplinary treatment, or the administrative staff responsible for billing your treatment.
Your data is processed by qualified professionals or under their responsibility. These professionals are bound either by a professional confidentiality obligation or a duty of confidentiality.
In some cases, so-called data processors are engaged to carry out certain services. Appropriate data processing agreements are concluded with these external service providers in accordance with § 30 DSG-EKD and/or Art. 28 GDPR. This ensures that your data is always handled confidentially!
Legal basis for the processing of your data by the hospital operator
The basis for the hospital operator being allowed to process your data under data protection law arises mainly from the fact that the hospital operator is responsible for the care and treatment of patients. On this basis, there are various laws and regulations that allow the hospital operator to process the data.
Particular mention should be made here of the Church Law on Data Protection of the Evangelical Church in Germany (DSG-EKD). Sections 6 and 13 of the DSG-EKD expressly regulate the conditions under which patient data may be processed. In addition, there are bases in German law, for example in the Social Code, Book Five (SGB V), e.g., § 301 SGB V, and in the Civil Code (§§ 630 ff. BGB), which require the processing of your data.
Examples of legal bases for processing include:
– Data processing for the purpose of carrying out and documenting the treatment process, including the internal medical and interprofessional exchange in the hospital about the patient for the treatment (§ 13 para. 2 no. 8 and para. 3 DSG-EKD in conjunction with §§ 630a ff, 630f BGB in conjunction with corresponding state law regulations if available),
– Data transmission to “external parties” in the sense of joint treatment (in a team), involvement of external consulting physicians, e.g., laboratory, telemedicine, and involvement of external therapists (§ 13 para. 2 no. 8 and para. 3 DSG-EKD in conjunction with corresponding state law regulations if available),
– Data transmission to the statutory health insurance funds for billing purposes (§ 13 para. 2 no. 8, para. 3 DSG-EKD in conjunction with § 301 SGB V),
– Data transmission for quality assurance purposes (§ 13 para. 2 no. 9 DSG-EKD in conjunction with § 299 SGB V in conjunction with § 136 SGB V or the guidelines of the G-BA), etc.
In addition, processing is also permissible in cases where you have given us your consent.
Necessity of providing your personal details
The proper administrative handling of your treatment requires the recording of your personal details. The only exceptions to this are cases of confidential birth.
Possible recipients of your data
Your data will be collected within the scope of the intended purpose in compliance with the respective data protection regulations or any existing declarations of consent and, if necessary, transmitted to third parties. Such third parties may include in particular:
– statutory health insurance funds, if you are publicly insured,
– private health insurance companies, if you are privately insured,
– accident insurance providers,
– family doctors,
– doctors providing further, follow-up, or co-treatment,
– other healthcare or treatment facilities,
– rehabilitation facilities,
– nursing facilities,
– external data processors (so-called processors) as well as
– chaplains,
– external research institutions (anonymized or pseudonymized data)
– etc.
If necessary, your data may also be processed outside the scope of the DSG-EKD. This is the case, among other things, in the context of scientific research and studies. However, you will be informed accordingly in advance or asked for your consent.
Which data are transmitted in detail?
If data are transmitted, it depends in each individual case on the respective recipient which data these are. In the case of a transmission to your health insurance fund in accordance with § 301 SGB V, for example, the following data are involved:
- Name of the insured person,
- Date of birth,
- Address,
- Health insurance number,
- Insurance status,
- the day, time, and reason for admission as well as the referral diagnosis, the admission diagnosis, in the event of a change in the admission diagnosis the subsequent diagnoses, the expected duration of hospital treatment and, if this is exceeded, the medical justification at the request of the health insurance fund, for infants up to one year the birth weight,
- Date and type of operations and other procedures performed in the hospital,
- the day, time, and reason for discharge or transfer as well as the main diagnosis and secondary diagnoses relevant for the hospital treatment,
- Information about the rehabilitation measures carried out in the respective hospital as well as statements on the ability to work and suggestions for the type of further treatment with details of suitable facilities.
Our service providers
For the long-term storage of our patient records, these are digitized. This work takes place outside the hospital on the basis of commissioned processing and is carried out by the following service provider in compliance with data protection regulations and the duty of confidentiality according to § 203 StGB: DMI GmbH & Co. KG, Otto-Hahn-Str. 11-13, 48161 Münster.
Billing of private medical services
For the billing of private medical inpatient and outpatient services, your treatment data may be passed on to a service provider to create the invoice. For this purpose, a declaration of consent will be presented to you before the start of treatment. This is a legal requirement. Please note that you may receive invoices from different billing service providers.
Treatment due to aesthetic operations, tattoos, or piercings
In the event that an illness exists for which there is a suspicion that it is the result of a medically non-indicated aesthetic operation, a tattoo, or a piercing, a report must also be made to the health insurance fund in this regard.
Secondary use of treatment data for scientific research purposes
Data protection law, with § 50 DSG-EKD in conjunction with § 13 para. 2 point 10 DSG-EKD, generally grants the possibility of data processing for scientific research purposes. However, the secondary use of treatment data is limited to the facility’s own research purposes.
Furthermore, it is possible that your treatment data will be used jointly with third parties. These can be externally funded research projects such as:
- Interventional and non-interventional clinical trials
- Non-statutory clinical registries
- Cooperation projects with third parties
You will usually be contacted about this by your treating physicians in the corresponding specialist clinics. The lawfulness of these data processing operations is based on informed consent § 6 point 2 DSG-EKD in conjunction with § 13 para. 2 point 1 DSG-EKD.
Furthermore, we can also share your treatment data with third parties in completely anonymized form for the following purposes on the basis of § 6 para. 3 Health Data Use Act (GDNG):
- for quality assurance and to promote patient safety
- for medical, rehabilitative, and nursing research
- for statistical purposes, including health reporting
This form of secondary use of your treatment data can generally take place in all our specialist clinics.
If you have any questions as to whether and to what extent secondary use of anonymized treatment data takes place, please contact the corresponding specialist clinic.
In principle, you have the right to object to the secondary use of your treatment data. To do so, please contact the corresponding specialist clinic(s) in which you were treated.
Use of AI
The use of Artificial Intelligence (AI) is of great relevance in the medical field. Therefore, AI is also used in various areas at KEM. As a rule, the use is limited to on-premises/on-prem use, which means that the AI/software is installed and runs locally, i.e., on the KEM servers.
However, there are also applications that make the use of an “external” AI necessary. This takes place, for example, in the context of early lung cancer detection, which was introduced by the decision of the Federal Joint Committee (GBA) in April 2026. Since KEM is a predominantly oncological hospital with correspondingly specialized departments, we also use AI for so-called thoracic patients referred to us in order to be able to detect medical abnormalities at an early stage. Here, too, the provider of the external AI is a processor (see chapter Who has access to your data?)
Revocation of granted consents
If the processing of your data is based on consent that you have declared to the hospital operator, you have the right to revoke your consent at any time. You can send this declaration—in writing / by email / by post—to the hospital operator. It is not necessary to state reasons. However, your revocation only applies from the time it is received by the hospital operator. It has no retroactive effect. The processing of your data up to this point remains lawful.
Perception of legitimate interests of the hospital operator
If the hospital operator is forced to seek legal or judicial assistance to enforce its claims against you or your health insurance fund because the invoice issued by the hospital operator is not paid, the hospital operator must (for purposes of legal enforcement) disclose the necessary data about your person and your treatment.
How long will your data be stored?
According to § 630f of the Civil Code (BGB), the hospital operator is obliged to keep documentation of your treatment. The hospital operator can fulfill this obligation in the form of a paper or electronic patient record. This patient documentation is kept by the hospital for a long time even after your treatment has been completed. The hospital operator is also legally obliged to do this.
Many special legal regulations deal with the question of how long the documents must be kept in the hospital in detail. Examples include the Radiation Protection Act (StrlSchG), the Pharmacy Operating Regulations (ApBetrO), the Transfusion Act (TFG), and many more. These legal regulations prescribe different retention periods.
In addition to the statutory retention periods, the hospital also sets different retention periods in accordance with the legal regulations. This is the case, for example, if patients suffer from chronic or genetic diseases. Since these diseases often last longer than the statutory retention period, a longer retention period may be necessary from a medical point of view.
The same applies to cases in which claims for damages are asserted against the hospital and longer storage is necessary for reasons of evidence.
Right to information, rectification, deletion, etc.
You are entitled to so-called data subject rights, i.e., rights that you can exercise as a person affected in an individual case. You can assert these rights against the hospital operator. They arise from the Church Law on Data Protection of the Evangelical Church in Germany (DSG-EKD):
- Right to information, § 19 DSG-EKD
You have the right to information about the stored personal data concerning you.
- Right to rectification, § 20 DSG-EKD
If you find that incorrect data about your person is being processed, you can request rectification. Incomplete data must be completed taking into account the purpose of the processing.
- Right to deletion, § 21 DSG-EKD
You have the right to request the deletion of your data if certain reasons for deletion exist. This is particularly the case if they are no longer required for the purpose for which they were originally collected or processed.
- Right to restriction of processing, § 22 DSG-EKD
You have the right to restriction of the processing of your data. This means that your data will not be deleted, but will be marked to restrict their further processing or use.
- Right to data portability, § 24 DSG-EKD
You have the right to receive your data in a structured, commonly used, and machine-readable format and you can request that your data be transmitted directly to another third party, as far as this is technically feasible.
- Right to object to unreasonable data processing, § 25 DSG-EKD
In principle, you have a general right to object even to lawful data processing operations that are in the public interest, in the exercise of official authority, or due to the legitimate interest of a body.
Complaint to the supervisory authority regarding data protection violations
Regardless of the fact that you are also free to seek judicial assistance, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data is not permissible under data protection law. This arises from § 46 DSG-EKD. The complaint to the supervisory authority can be made informally. The supervisory authority responsible for KEM is:
The Commissioner for Data Protection of the EKD – Central-West Region
Friedhof 4
44135 Dortmund
Telephone: +49 (0)231 533827-0
Email: mitte-west@datenschutz.ekd.de
Data Protection Officer of the hospital
The hospital operator has appointed a data protection officer. His contact details are as follows:
The Data Protection Officer of KEM | Evang. Kliniken-Essen-Mitte gGmbH
Am Deimelsberg 34a
45276 Essen
Tel.: +49 (0201) 174-16003
Fax: +49 (0201) 174-16000
Email: datenschutz@kem-med.com
We are happy to answer any further questions you may have.
