Privacy Policy

Use of "Meine-Medizindaten"

If you have given your consent, medical practices and hospitals can upload your medical data to “Meine-Medizindaten” on your behalf instead of creating a CD. In this case, you will receive an access code from the facility that you can use to retrieve your data. The access code is either an 18-digit alphanumeric code or a QR code. To protect against unauthorized access, an additional second factor - the password - is required. Using the access code and password, the medical data is available for the duration agreed upon with the provider (hospital or doctor’s office) and is then automatically deleted. If patients wish to retain their data for a longer period, they can download it from “My Medical Data” and save it locally. If you, as a patient, wish to have your data deleted immediately, the issuing institution can deactivate the access code immediately and delete the associated content.

Information on the Processing of Personal Data

In order to allow users to access medical data via this website (https://mmd-portal/code/), we process personal data from users of the Meine-Medizindaten portal. When access codes are used, in addition to the encrypted user data and the password, we store only usage data, metadata, and communication data based on our legitimate interests in providing this service efficiently and securely, in accordance with Article 6(1)(f) of the GDPR in conjunction with Article 28 of the GDPR.

Types of Processing

• Account Information (Login ID, Password)
• Usage data (e.g., websites visited, access times, file names, amount of data transferred, access status)
• Meta/communication data (e.g., device/browser information, truncated IP addresses, language settings)

Based on our legitimate interests within the meaning of Article 6(1)(f) of the GDPR, we collect data regarding every access to the server on which this service is hosted (so-called server log files). The access data includes the name of the webpage accessed, the file, the date and time of access, the amount of data transferred, a notification of successful access, the browser type and version, the user’s operating system, the referrer URL (the previously visited page), the truncated IP address, and the requesting provider.

Log file information is stored for a maximum of 2 months for security reasons (e.g., to investigate cases of misuse or fraud) and is subsequently deleted. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved. Content data (e.g., radiological images and/or findings, etc.) is not processed by Telepaxx Medical Data GmbH as the data controller, but rather on behalf of the respective customer as a data processor. When using “Meine-Medizindaten” with the Standard Viewer (not certified for diagnostic evaluation), this data is processed exclusively in encrypted form. When licensed physicians providing follow-up care use the teamVIEW web software—which is certified for diagnostic interpretation (licenses are issued by the client)—data is processed in unencrypted form temporarily, for the duration of a viewing session. All unencrypted data is deleted upon completion of the viewing session.

Purpose of Processing

• Provision of the “Meine-Medizindaten” service, its features, and content
• Safety Measures

How Your Data Is Protected

Appropriate measures are taken to ensure the protection of your data at Meine-Medizindaten. When using access codes, no personal data other than your password is required or collected. To prevent misuse by third parties, we use an encryption method. The information you provide is transmitted in encrypted form using the SSL (Secure Socket Layer) protocol and verified for authenticity. You can recognize this by the lock or key icon displayed in your browser’s status bar and by the address bar beginning with “https://…”.

Patient data is stored in encrypted form in the “Meine-Medizindaten” portal. The data is encrypted at the medical facility (e.g., hospital, doctor’s office). There, all images and test results are encrypted using a random key. In addition, a private and public key pair is generated for each patient. The random key is encrypted using the public key of the patient’s destination account and uploaded to the cloud. The corresponding private key is encrypted using an 18-digit, randomly generated cryptographic key. This key is provided to you by the medical facility. The technical and organizational data protection measures in place are documented in a contract and are regularly monitored.

How to Best Protect Your Data

Please also take technical and organizational measures to ensure data protection when using the “Meine-Medizindaten” portal:

• When using access codes, make sure that they are not accessible to unauthorized persons.
• Under no circumstances should you write down the password used as the second factor or in connection with the access code.
• Do not transmit personal data unencrypted over the Internet. This also applies to the transmission of data via email.
• If you use portable storage devices (USB drives, portable storage media, laptops, smartphones, tablets, etc.), use the encryption features of the hard drives and comply with data protection and security regulations.
• Keep your access code in a very secure place.