The data protection officer of the
KEM | Evang. Kliniken Essen-Mitte gGmbH
Henricistr. 92
45136 Essen
Phone: +49 201 174-16002
Fax: +49 201 174-16000
Email: datenschutz@kem-med.com
KEM | Evang. Kliniken Essen-Mitte gGmbH is subject to the provisions of the Data Protection Act of the Protestant Church in Germany (DSG-EKD).
Your Rights as a Data Subject
Using the contact details of our data protection officer provided above, you can exercise the following rights at any time:
- Information about the data we have stored about you and its processing (§19 DSG-EKD),
- Correction of inaccurate personal data (§20 DSG-EKD),
- Deletion of your data stored with us (§21 DSG-EKD),
- Restriction of data processing, if one of the conditions set out in §22 DSG-EKD is met (§22 DSG-EKD),
- Widerspruch gegen die Verarbeitung Ihrer Daten bei uns (§ 25 DSG-EKD) und
- Data portability, provided you have consented to the data processing or have entered into a contract with us (§24 DSG-EKD).
If you have given us consent, you may revoke it at any time with effect for the future.
You may file a complaint with the competent supervisory authority at any time:
The Data Protection Officer of the Protestant Church in Germany
Branch Office for the Central-West Data Protection Region
Friedhof 4, 44135 Dortmund
Phone: +49 (0)231 533827-0
Fax: +49 (0)231 533827-20
mitte-west@datenschutz.ekd.de
Collection of General Information When Visiting Our Website
Type and purpose of processing:
When you access our website, i.e., when you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes the type of web browser, the operating system used, the domain name of your internet service provider, your IP address, and similar data.
This data is processed in particular for the following purposes:
- Ensuring a smooth connection to the website,
- Ensuring convenient use of our website,
- Evaluating system security and stability, and
- for other administrative purposes.
We do not use your data to draw conclusions about your identity. Information of this kind may be statistically evaluated by us in order to optimize our website and the underlying technology.
Legal basis:
Processing is carried out in accordance with §6 No. 4 DSG-EKD on the basis of our legitimate interest in improving the stability and functionality of our website.
Recipients:
Recipients of the data may include technical service providers acting as data processors for the operation and maintenance of our website.
Storage period:
The data is deleted as soon as it is no longer required for the purpose for which it was collected. For data used to provide the website, this is generally the case once the respective session has ended.
Provision required by law or contract:
The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, certain functions and services may be unavailable or restricted. For this reason, objection is not possible.
Newsletter
Type and purpose of processing:
Your data is used exclusively to deliver the subscribed newsletter to you by email. Your name is requested so that we can address you personally in the newsletter and, if necessary, identify you should you wish to exercise your rights as a data subject.
Providing your email address is sufficient to receive the newsletter. When you sign up to receive our newsletter, the data you provide is used exclusively for this purpose. Subscribers may also be informed by email of circumstances relevant to the service or registration (e.g., changes to the newsletter offering or technical details).
We require a valid email address for effective registration. To verify that a registration is actually carried out by the owner of an email address, we use the “double opt-in” procedure. For this purpose, we log the newsletter order, the sending of a confirmation email, and the receipt of the requested response. No further data is collected. The data is used exclusively for sending the newsletter and is not passed on to third parties.
Legal basis:
On the basis of your explicitly given consent (§6 No. 2 DSG-EKD), we regularly send you our newsletter or comparable information by email to your provided email address.
You may revoke your consent to the storage of your personal data and its use for sending the newsletter at any time with effect for the future. Each newsletter contains a corresponding link for this purpose. You may also unsubscribe directly on this website at any time or notify us of your revocation via the contact details provided at the end of this privacy policy.
Recipients:
Recipients of the data may include data processors.
Storage period:
In this context, data is only processed for as long as the corresponding consent exists. It is then deleted.
Provision required by law or contract:
Providing your personal data is voluntary and based solely on your consent. Without your consent, we unfortunately cannot send you our newsletter.
Contact Form
Type and purpose of processing:
The data you enter is stored for the purpose of individual communication with you. This requires providing a valid email address and your name, which is used to assign and subsequently respond to your inquiry. Providing any further information is optional.
Legal basis:
The processing of data entered into the contact form is based on a legitimate interest (§6 No. 4 DSG-EKD).
By providing the contact form, we aim to make it easy for you to get in touch with us. The information you provide is stored for the purpose of processing your inquiry and any follow-up questions.
If you contact us to request a quote, the processing of the data entered into the contact form is carried out to perform pre-contractual measures (§6 No. 5 DSG-EKD).
Recipients:
Recipients of the data may include data processors.
Storage period:
Data is deleted no later than 6 months after your inquiry has been processed.
If a contractual relationship results, we are subject to the statutory retention periods under the German Commercial Code (HGB) and will delete your data once these periods have expired.
Provision required by law or contract:
Providing your personal data is voluntary. However, we can only process your inquiry if you provide us with your name, email address, and the reason for your inquiry.
Use of Google Analytics
Type and purpose of processing:
This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (hereinafter: “Google”). Google Analytics uses so-called “cookies”, text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Due to the activation of IP anonymization on this website, however, your IP address is first shortened by Google within member states of the European Union or in other signatory states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide the website operator with other services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.
The purposes of data processing are the evaluation of website usage and the compilation of reports on website activity. Based on the use of the website and the internet, further related services are then to be provided.
Legal basis:
The processing of data is based on the user’s consent (§6 No. 2 DSG-EKD).
Recipients:
The recipient of the data is Google, acting as a data processor. We have entered into a corresponding data processing agreement with Google for this purpose.
Storage period:
The data is deleted as soon as it is no longer required for our record-keeping purposes.
Transfer to third countries:
Please note that Google processes your data in the USA. Since the USA is a country without an adequate level of protection or appropriate safeguards within the meaning of EU data protection laws, there are risks associated with the transfer of personal data, and therefore adequate protection of personal data cannot be guaranteed.
Provision required by law or contract:
Providing your personal data is voluntary and based solely on your consent. If you prevent access, this may result in functional limitations on the website.
Withdrawal of consent:
You can prevent the storage of cookies by selecting the appropriate settings in your browser software; however, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available under the following link: Browser add-on to disable Google Analytics.
In addition to, or as an alternative to, the browser add-on, you can prevent tracking by Google Analytics on our pages by clicking this link. This will install an opt-out cookie on your device. This will prevent the collection of your data by Google Analytics for this website and this browser in the future, as long as the cookie remains installed in your browser.
Profiling:
With the help of the Google Analytics tracking tool, visitor behavior on the website can be evaluated and interests analyzed. For this purpose, we create a pseudonymous user profile.
Use of Google Maps
Type and purpose of processing:
On this website, we use the Google Maps service. Google Maps is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”). This allows us to display interactive maps directly on the website and enables you to conveniently use the map feature.
For more information on data processing by Google, please refer to Google’s privacy policy. There, you can also change your personal privacy settings in the privacy center.
Detailed instructions on managing your own data in connection with Google products can be found here.
Legal basis:
The legal basis for the integration of Google Maps and the associated data transfer to Google is your consent (§6 No. 2 DSG-EKD).
Recipients:
By visiting the website, Google receives information that you have accessed the corresponding subpage of our website. This occurs regardless of whether Google provides a user account through which you are logged in, or whether no user account exists. If you are logged in to Google, your data will be directly linked to your account.
If you do not want this association to be made with your profile on Google, you must log out of Google before activating the button. Google stores your data as usage profiles and uses it for the purposes of advertising, market research, and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and to exercise this right you must contact Google.
Storage period:
We do not collect any personal data through the integration of Google Maps.
Transfer to third countries:
Google processes your data in the USA and has submitted to the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.
Withdrawal of consent:
If you do not want Google to collect, process, or use data about you through our website, you can disable JavaScript in your browser settings. In this case, however, you may not be able to use our website, or only to a limited extent.
Provision required by law or contract:
Providing your personal data is voluntary and based solely on your consent. If you prevent access, this may result in functional limitations on the website.
Social Media
Type and purpose of processing:
When you log in on the respective social media provider’s page, your personal data is collected there. The scope and purpose of data collection depends on the respective social media page you visit. We only collect personal data through our social media accounts that you leave with us via messages. We therefore do not collect data when you merely visit our social media pages, but only when you contact us directly through these pages. We collect this data on the basis of the consent you implicitly give through this contact, so that we can respond to your comment.
Legal basis:
The legal basis for this data processing is §6 No. 2 DSG-EKD.
Recipients:
By visiting the social media page, the social media operators receive information that you have accessed our social media page. This occurs depending on whether you are logged in via a user account.
We cannot provide precise information about which data is collected by the operator of the social media page when you visit our social media page. Please contact the respective network operator for this information.
Storage period and withdrawal of consent:
We do not collect data when you merely visit our social media pages, but only when you contact us directly through these pages. Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Of course, you can also delete your comments yourself.
For further information, please contact the respective network operator.
Transfer to third countries:
The social media operators process your data in a third country or in the USA.
For further information, please contact the respective network operator.
Provision required by law or contract:
Providing your personal data is voluntary and based solely on your consent.
Embedded YouTube Videos
Type and purpose of processing:
We embed YouTube videos on some of our web pages. The provider of the corresponding plugins is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (hereinafter “YouTube”). When you visit a page with the YouTube plugin, a connection to YouTube’s servers is established. This tells YouTube which pages you visit. If you are logged in to your YouTube account, YouTube can associate your browsing behavior directly with you personally. You can prevent this by logging out of your YouTube account beforehand.
When a YouTube video is started, the provider sets cookies that collect information about user behavior.
For more information on the purpose and scope of data collection and processing by YouTube, please refer to the provider’s privacy policy. There you will also find further information on your rights in this regard and options for protecting your privacy (https://policies.google.com/privacy). Google processes your data in the USA and has submitted to the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework
Legal basis:
The legal basis for the integration of YouTube and the associated data transfer to Google is your consent (§6 No. 2 DSG-EKD).
Recipients:
Accessing YouTube automatically triggers a connection to Google.
Storage period and withdrawal of consent:
Anyone who has disabled the storage of cookies for the Google Ad program should not expect such cookies when watching YouTube videos either. However, YouTube also stores non-personal usage information in other cookies. If you wish to prevent this, you must block the storage of cookies in your browser.
Further information on data protection at “YouTube” can be found in the provider’s privacy policy at: https://www.google.de/intl/de/policies/privacy/
Transfer to third countries:
Google processes your data in the USA and has submitted to the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.
Provision required by law or contract:
Providing your personal data is voluntary and based solely on your consent. If you prevent access, this may result in functional limitations on the website.
Eye Able
Type and purpose of processing:
On our website, we use Eye-Able Assist, a software by Web Inclusion GmbH that enables all people to access information on the internet with low barriers.
The files required for this, such as JavaScript, stylesheets, and images, are loaded from an external server. When features are activated, Eye-Able Assist uses the browser’s local storage to save settings. All settings are stored exclusively locally and are not transmitted further.
To defend against attacks and provide our service in near real-time, Eye-Able Assist uses the Content Delivery Network (CDN) of BunnyWay d.o.o. (Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia). This is used for the purpose of fulfilling our contract with our customers (Art. 6(1)(b) GDPR) as well as in the interest of a secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).
All transmitted data and servers remain within the EU at all times to ensure processing in compliance with the GDPR. Web Inclusion GmbH does not, at any time, collect or analyze personal usage behavior or other personal data. To ensure processing in compliance with data protection law, Web Inclusion GmbH has entered into data processing agreements with the provider BunnyWay.
For more information, please see the privacy policies: https://eye-able.com/datenschutz-eye-able/ https://bunny.net/privacy
Payment Method: Privacy Policy for Altruja as a Payment Method
The party responsible for processing has integrated components of Altruja on this website. Altruja is an online fundraising software that enables donation transfers.
The operating company of Altruja is Altruja GmbH, Augustenstraße 62, 80331 Munich. Altruja GmbH’s privacy policy can be found here: www.altruja.de/datenschutz.html
If the data subject selects “Altruja” for the donation transfer, data of the data subject is automatically transmitted to Altruja. By selecting this payment option, the data subject consents to the transfer of personal data required for payment processing.
The personal data transmitted to Altruja generally includes the donation amount, payment frequency, first name, last name, email address, IP address, or other data necessary for payment processing. The necessary data for the selected transfer method (direct debit/credit card) is also required to process the donation transfer.
The purpose of the data transfer is payment processing and fraud prevention. The party responsible for processing will transmit personal data to Altruja in particular where there is a legitimate interest in doing so. The personal data exchanged between Altruja and the party responsible for processing may be transmitted by Altruja to credit reporting agencies under certain circumstances. This transfer is intended for identity and credit checks.
The data subject has the option of revoking consent to the handling of personal data at any time by contacting Altruja. A revocation does not affect personal data that must be processed, used, or transmitted for the purpose of (contractual) payment processing.
Altruja’s applicable privacy policy can be found at https://www.altruja.de/datenschutz.html.
SSL Encryption
To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g., SSL) via HTTPS.
Changes to Our Privacy Policy
We reserve the right to adapt this privacy policy so that it always complies with current legal requirements, or to implement changes to our services in the privacy policy, e.g., when introducing new services. The new privacy policy will then apply to your renewed visit.
Questions for the Data Protection Officer
The Data Protection Officer of KEM | Evang. Kliniken Essen-Mitte gGmbH
Henricistr. 92, 45136 Essen
Phone: +49(0) 201 174 16002
Fax: +49(0) 201 174 16000
This privacy policy was created using the Privacy Policy Generator by activeMind AG (version 2018-09-24).
Privacy Information on Doctolib
For optimal appointment management, we use Doctolib’s appointment management system. Doctolib provides us with a modern calendar system and also gives our patients the opportunity to book appointments with us online at https://www.doctolib.de/. Doctolib GmbH (Mehringdamm 51, 10961 Berlin) acts as a data processor on our behalf.
We use Doctolib’s calendar software for all our patients (regardless of whether the patient has a Doctolib user account for online booking or not) in order to manage appointments consistently. Doctolib processes all data in accordance with all applicable data protection regulations and applies the highest security standards. For appointment scheduling, the following data may be entered into the Doctolib calendar: name, first name, date of birth, address, phone number, email address, general practitioner, health insurance status, referring doctor, reason for visit, and appointment history.
Your data is collected for the purposes of appointment management, as has also been the case with us up to now. The legal basis for processing your data is Art. 28 (data processing) in conjunction with Art. 6(1)(b) GDPR (the treatment contract you give us) or §6 No. 5 DSG-EKD, Art. 6(1)(a) GDPR (consent for appointment reminders by SMS and email) or §6 No. 2 DSG-EKD, and Art. 9(2)(h) GDPR (the purposes of healthcare) or §13(2) No. 8 DSG-EKD. Doctolib does not forward the data to commercial providers. Doctolib is contractually bound to confidentiality in accordance with §§203, 204 of the German Criminal Code (StGB). A release from this confidentiality obligation is not required.
Special Features of Online Booking
A Doctolib user account is required for online appointment booking; Doctolib’s privacy notices, available on the website doctolib.de, apply in this case. Doctolib GmbH (Mehringdamm 51, 10961 Berlin) is responsible for data processing in connection with setting up a Doctolib user account. To reduce missed appointments, you will be reminded of your appointment by SMS and/or email via the Doctolib calendar system if you booked your appointment online. If you no longer wish to receive such reminders, please let us know at any time and we will disable the reminders.
If you would like to learn more about the data processing carried out through the use of Doctolib, you can access the privacy notices for patients at the following link:
Privacy Notice for the Use of the Patient Portal of KEM | Evang. Kliniken Essen-Mitte gGmbH
This privacy notice applies to the collection, processing, and use of your personal data in connection with the use of the patient portal of KEM | Evang. Kliniken Essen-Mitte gGmbH for end devices (“WEB APP”).
In the patient portal, KEM provides general information about the hospital, its departments, and the treatment options available there. In addition, the use of the patient portal enables patients to interact with KEM in the following ways:
- Getting in touch
- Appointment Scheduling
- Exchange of information before, during, and after treatment
Regarding appointment scheduling, both outpatient appointments and appointments for inpatient admission can be requested, provided that a referral has been issued by a resident physician. For these possible interactions, the patient portal provides a data exchange between the patient and the hospital. As part of this data exchange, patients can already transmit data on their treatment history, preventive care, and health status (collectively “HEALTH DATA”) before their appointment, without any additional hardware. For this purpose, the patient can upload HEALTH DATA via the web app at any time.
1 Contact Details of the Provider
With regard to the patient portal, KEM is a SERVICE PROVIDER within the meaning of the German Telemedia Act (TMG) and the responsible party within the meaning of applicable data protection laws. KEM | Evang. Kliniken Essen-Mitte gGmbH is an institution under denominational sponsorship and is therefore subject to the Church Act on Data Protection of the Evangelical Church in Germany (DSG-EKD). If you have any questions or suggestions regarding this privacy policy or data protection at KEM in connection with the patient portal, please contact us using the following details:
KEM | Evang. Kliniken Essen-Mitte gGmbH, – Data Protection Officer –, Henricistr. 92, 45136 Essen, Germany, Phone: +49 201 174-16003, Email: datenschutz@kem-med.com
2 Collection, processing and use of your personal data
2.1 Personal data
Personal data refers to individual details about the personal or factual circumstances of an identified or identifiable natural person, including, for example, name, email address, and telephone number. KEM collects, processes, and uses this personal data only when permitted or required by law, or when you have given your consent.
2.2 Consent to use and processing/legal basis
By using the patient portal and submitting data to KEM, you consent to the use and processing of your data by KEM. The legal basis is therefore your consent under Section 6 No. 2 DSG-EKD and Section 13 (2) No. 1 DSG-EKD.
2.3 Withdrawal of consent
You may withdraw your consent to the collection, processing, and use of your personal data at any time. You may also exercise your right of withdrawal at any time by sending an informal notice to the contact details provided above.
After your withdrawal, your data will be deleted from the patient portal. If a treatment contract has already been concluded at that time, your data will continue to be stored in your patient file in order to fulfill documentation requirements. The withdrawal has no retroactive effect; the processing of your data up to the time of withdrawal remains lawful.
3 Collection, processing and use of your personal data for the provision and use of the patient portal
3.1 (Automatic) collection and storage of data when accessing the patient portal
Simply accessing the patient portal does not require, and is not technically necessary for, providing personal data. For technical reasons, certain data is always transmitted from your device to us during communication on and via the (mobile) internet, such as the date and time of access to the patient portal, the operating system, and the amount of data transferred. We collect and use this data when the patient portal is accessed exclusively in a non-personal, i.e. anonymized, form.
3.2 Collection, processing and use of personal data in connection with the use of the patient portal
- You do not need to register as a user in order to access the patient portal. All personal data is transmitted to KEM solely through your transaction and in connection with an appointment request/booking. As part of patient administration, you are required to provide various (personal) data, which we store and use. This is exclusively (personal) data that we need in order to initiate the appointment scheduling for you via the patient portal and to use the data for your further treatment with us. As part of patient administration, the following personal data is collected, processed, and used: title, name (first and last name), email address, telephone number, date of birth, type of insurance.
- In addition, you can upload your personal HEALTH DATA in the patient portal, such as treatment orders, diagnoses, medical history forms, X-ray images, medical reports, medication plans, questionnaires, checklists, etc. We only process this data if you transmit it to us.
- We also ask you to submit or upload your referral and may ask you additional questions to prepare for treatment or to arrange an appointment.
- We will notify you by email or SMS when there is news (e.g. new documents, new messages) in your account, or for authentication purposes.
You decide for yourself whether you receive notifications by email or SMS. For sending SMS messages, we use the services of an external telecommunications provider based in Germany. The content of the SMS/email merely states that new messages/information are available in your account, or contains a verification TAN. In the case of appointment scheduling, the SMS/email will also include the appointment date and time. - You also have the option to create your own account as a user of the patient portal, i.e., to register as a user. If you choose to do so, we will also use your email address or telephone number to verify the account created. Furthermore, the email address or telephone number will be used for authentication.
- The patient portal can also be used for the exchange of information between you and us. This also makes it possible to provide documents (e.g., the medical report resulting from the appointment) via the portal.
3.3 Right to inspect and delete data
Your submitted personal data (Section 3.2) can be viewed by our employees for the purpose of scheduling appointments.
Please note that absolute protection during data transmission over the Internet cannot be guaranteed according to the current state of technology. You are therefore responsible for the security of the data transmitted to the Internet.
Unless you have given us further consent for the storage and use of your data and there are no legal retention periods to the contrary, the data you have already transmitted will be deleted from our servers no later than 90 days after case closure or the last transmission. If your submitted personal data is relevant for treatment at the hospital, the data and documents will be transferred to your patient file. Legal retention periods apply to medical documentation.
You can end the current treatment in the patient portal at any time. You can request the deletion of the data you have transmitted from us:
KEM | Evang. Kliniken Essen-Mitte gGmbH, – Data Protection Officer –, Henricistr. 92, 45136 Essen, Germany, Tel.: +49 201 174-16003, Email: datenschutz@kem-med.com
4 Further collection and use of personal data and transmission to third parties
Your personal HEALTH DATA will never be passed on to unauthorized third parties.
5 Data processing outside the European Union (“EU”) and the European Economic Area (“EEA”)
In principle, your data is processed in our internal hospital data center, which is located within the Federal Republic of Germany and thus within the EU or the EEA.
6 Log data:
We store the IP address transmitted by your web browser strictly for a specific purpose for a period of 90 days, in the interest of being able to detect, limit, and eliminate attacks on our websites. After this period has expired, we delete or anonymize the IP address.
In addition, so-called usage data is temporarily stored as a log on our web server for statistical purposes in order to improve the quality of our websites.
This data set consists of
- the page from which the file was requested
- the name of the file
- the date and time of the query
- the amount of data transferred
- the access status (file transferred, file not found)
- the description of the type of web browser used
- the IP address of the requesting terminal device, which is shortened so that it can no longer be linked to a person.
The log data mentioned is only stored in anonymized form.
7 Cookies
For the duration of your visit to the patient portal, the PHPSESSID cookie is set on your terminal device. Cookies are small text files that are stored locally in the cache of your internet browser. Among other things, cookies enable the recognition of the internet browser.
This cookie temporarily stores the selection for the chosen department, the section (e.g., outpatient consultation), and the appointment type (e.g., initial consultation). At this point in time, this information cannot be stored in the portal itself; the cookie is therefore technically necessary. When you leave the patient portal, the cookie is deleted from your terminal device again.
Note:
In accordance with the terms of use, we point out that use of our patient portal is not possible without the described processing of your personal data.
