Privacy Policy

1. Scope

This policy explains how personal data is processed when you use the website diggai.de, the DiggAI application (browser as well as desktop application for Windows and macOS) and the associated transmission service.

It is addressed to visitors of the website, to registered medical practices and institutions and their staff, and to patients who use the service.

The policy distinguishes between processing for which DiggAI is itself responsible and processing that DiggAI carries out on behalf of a registered practice or institution. The practice or institution is always responsible for medical care, its professional assessment and for maintaining the patient record — never DiggAI.

2. Controller

The controller responsible for data processing within the meaning of Art. 4(7) GDPR is:

The company is in the process of being formed. Until the articles of association have been notarised, the controller within the meaning of Art. 4(7) GDPR is Dr. med. Christian Klaproth personally, at the address stated above; thereafter it is the pre-incorporation company, represented by its managing director. It has not yet been entered in the commercial register; upon registration this statement will be supplemented with the register court and the commercial register number.

3. Data protection contact

For all questions regarding data protection you can reach us at the e-mail address given above.

We are appointing a data protection officer as a precaution. Whether there is a statutory obligation to do so depends on an unsettled legal question — namely whether an encrypted package whose key we do not hold constitutes personal data in our hands. We are not waiting for that to be resolved. Once the appointment has been made, we will publish the contact details here and notify the supervisory authority. Until then, please address your requests to the e-mail address stated above, which is monitored continuously.

4. How DiggAI works

Understanding the technical architecture is essential to this policy, because it determines which data reach us at all and which remain permanently inaccessible to us.

4.1 Collection on your own device

Patients open the application and answer structured questions there. The entries are stored in the memory of the device used and initially do not leave it. Separate records can be kept on one device, for example for children or dependants in your care.

4.2 Two routes to the practice

Printout: The recorded entries can be printed as a PDF document and presented at the practice. On this route no content data is transmitted to our systems at any time; collection, storage and generation of the document take place exclusively on the device.

Encrypted transmission: Alternatively, the entries can be sent to a practice or institution registered with DiggAI. This requires the sender to select the recipient deliberately and to expressly confirm the encrypted transmission.

4.3 Encryption, interim storage and collection

When sending, the contents are encrypted on the device itself using the public key of the selected recipient. X25519 is used to encapsulate the session key and AES-256-GCM for the contents.

We receive only the encrypted envelope and store it for a maximum of 30 days so that the practice can collect it. The practice retrieves the transmissions intended for it using its key and deletes them in the process. If a transmission is not retrieved, we delete it automatically at the latest when the 30 days expire. After collection or expiry, a content-free record entry remains for a further 30 days which holds only the time and delivery status and no longer contains any content data whatsoever.

We hold no private keys, no master key and no technical back door. We therefore cannot read, evaluate, correct, restore or hand over the contents to third parties — not during the storage period either, and not upon official order.

So that the envelope reaches the correct recipient without our database linking recipient and transmission, we do not store the practice identification number but only a check value derived from it using a secret key. Neither the recipient's practice identification number nor the IP address of the sender is stored or logged together with the transmission.

4.4 Return channel to the sender

If the practice replies, this happens in the same way in the opposite direction: the practice encrypts the reply on its device for the public reply key that the sender supplied when sending. We store this reply too only as an encrypted envelope until collection, for a maximum of 30 days. Here as well the content remains permanently inaccessible to us.

4.5 Registration code on the printout

The printed document carries a machine-readable code through which a practice that does not yet use DiggAI can initiate its own registration. The code contains no patient details and does not enable us to link a data subject to a practice.

5. Allocation of roles

5.1 DiggAI as controller in its own right

We decide on purposes and means ourselves in particular for:

• operation of the website and the technically necessary server logs;
• registration, identity verification, customer account, contract handling and billing of practices and institutions;
• operation of the recipient directory and provision of the public keys;
• our own security, abuse and evidence logs;
• handling of contact, contract and support enquiries.

In this role we do not process any patient health data.

5.2 DiggAI as processor

In receiving, temporarily storing, making available for collection and deleting encrypted transmissions, and in respect of the associated delivery logs, we act on behalf of the receiving practice or institution pursuant to Art. 28 GDPR. To that extent the practice or institution is responsible for the purpose, content, legal basis and information of data subjects. A data processing agreement is concluded with every customer before activation. We conclude this contract as a precaution, irrespective of how the legal question in the following paragraph is answered.

Whether the encrypted package constitutes personal data in our hands is assessed differently in legal literature: we cannot read the content, we do not hold the key and we cannot obtain it. We do not take a position on that question; instead we treat receipt, retention and deletion as processing on behalf as a precaution — with a contract, technical measures and a data protection officer. The encryption is a protective measure under Art. 32 GDPR, not an exemption from responsibility.

For rights concerning medical content or the practice's documentation, please therefore contact the relevant practice or institution directly.

5.3 Customer base

DiggAI's customers are healthcare providers. Registered units are practising physicians, joint practices and medical care centres, in each case in relation to the individual place of business and identified by its practice identification number, as well as care facilities and wound centres identified by their institution code. Both groups undergo the same verification procedure and are listed in the same directory. Private individuals are not customers and are not registered as recipients.

6. Legal bases

Where we are the controller ourselves, processing is based on:

• Art. 6(1)(b) GDPR for the contract, pre-contractual measures, customer account and agreed functions;
• Art. 6(1)(c) GDPR for legal obligations, in particular retention obligations under commercial and tax law;
• Art. 6(1)(f) GDPR for secure and uninterrupted operation, identity verification of recipients, IT security, error analysis as well as the assertion and defence of legal claims;
• Art. 6(1)(a) GDPR insofar as consent is obtained for an optional purpose;
• Section 25(2)(2) TDDDG for the strictly necessary storage of information on terminal equipment and access to it.

Insofar as health data is transmitted on behalf of a practice or institution, that party determines the legal basis as controller under Art. 6 and Art. 9 GDPR and under professional medical law. We do not use these contents for our own purposes.

7. Website and server logs

When you visit the website, we process your IP address and the technical connection data only transiently, for the duration of the connection — to deliver the page and to defend against overload and automated attacks. We do not keep a persistent web server access log: requested addresses, referrer, browser type and operating system are not stored. The legal basis is Art. 6(1)(f) GDPR.

Persistent logging takes place only for security-relevant operations in the protected area, for example when a practice or institution retrieves or deletes items; this includes their IP address. These logs contain no content data and are deleted automatically after 90 days.

Transmission is exclusively TLS-encrypted. In the event of a specific security incident, affected data may be stored longer until the incident has been resolved.

8. Hosting

The website, the application and the database are operated at Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany. The place of processing is the Helsinki data centre in Finland. Processing therefore takes place entirely within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner; it is currently being transferred to the company.

No sub-processors outside the European Union are used.

9. Registration and identity verification

For inclusion in the recipient directory we process: name and address of the practice or institution, the practice or institution identifier, the public key, an address for arrival notifications, a telephone number for confirmation, and the time and outcome of the verification, together with contract and tariff data. We do not require the name or role of any individual person. There is no password — the institution identifies itself through possession of its key. Your earlier enquiry via the registration form (practice name, town, e-mail, telephone number and an optional message) reaches us by e-mail and is not stored in our database.

Before activation we verify the identity. To do so we obtain the telephone number from a source independent of the practice or institution and have the registration and the fingerprint of the public key confirmed via that channel. The purpose is to protect patients from sending their data to the wrong recipient. The legal bases are Art. 6(1)(b) and (f) GDPR. The verification is logged.

Without the mandatory information no verified account can be set up.

10. Recipient directory and public keys

Verified practices and institutions are listed in a directory so that senders can select the correct recipient and encrypt for them. The following are processed and in part displayed publicly: name and address, practice identification number or institution code, status of the identity verification, the public key and its revocation or update status.

The legal basis is Art. 6(1)(b) GDPR for the contractually agreed listing and Art. 6(1)(f) GDPR for a reliable recipient directory. In the case of single-doctor practices, the directory entries may relate to an identifiable person.

Private keys are not stored in the directory and are not accessible to us. The public key is deliberately public: it serves to enable encryption for the recipient and permits no inference whatsoever about contents.

11. What arises when patients use the service

No DiggAI account is required in order to use the service. The key pair for the return route is generated locally on the device; only the public part leaves the device.

When sending, the following arise at our end:

• the encrypted envelope (content not readable by us);
• the public reply key sent along with it;
• a check value derived from the recipient identifier (not the identifier itself);
• time of receipt and collection, size of the transmission, delivery status;
• a random collection identifier which is communicated exclusively to the sender and allows them to query the delivery status.

The following are not stored: the recipient's practice identification number, the IP address or a session identifier of the sender, and their name or contact details. Name, date of birth and contact details travel exclusively inside the encrypted envelope and are not accessible to us.

IP addresses of sending devices arise exclusively in the general server and security logs; these logs are not linked to individual transmissions.

Use of the service is voluntary. Which other contact routes it offers is determined by the respective practice.

12. Functions that take place exclusively on your device

A substantial part of the application runs entirely on your device. For all functions listed below the following applies uniformly: no contents are transmitted to us or to third parties, and we have no access to them at any time.

• the personal health record with documents and history;
• the emergency pass with long-term medication, allergies, intolerances, implants and emergency contacts, including the printable emergency card;
• the vaccination documentation;
• reading in and evaluating documents (text recognition from photos and PDF files) in order to complete forms;
• language support: the interface and the predefined questionnaires are presented in up to thirteen languages using a dictionary stored within the application. Free text and attached documents are not translated; they reach the practice in the original;
• voice input and output, insofar as provided by your device;
• local language models: on high-performance devices a summary of your entries can be produced on the device itself. The model required for this is downloaded once from our server — in doing so only technical retrieval data is transmitted, never your entries. The computation takes place entirely on your device.

Your responsibility for local data: private keys and local records fall within your area of responsibility. If the device storage is cleared, a different device or browser is used, or the private key is lost, the data concerned is no longer accessible. We cannot restore it. On shared devices, third parties may be able to access locally stored entries.

The application offers you the option of exporting your record and your keys as a backup file and transferring them to another device; this process too takes place without any involvement of our systems.

13. Notifications

At the practice's request we notify it by e-mail of the arrival of a new transmission. We process the receiving address stored by the practice and the delivery status. The notification contains only the information that a transmission has arrived and the time of its expiry — no patient data, no health information and no meaningful subject lines. The legal basis is Art. 6(1)(b) GDPR.

For sending e-mail we use Brevo (Sendinblue) as a processor. Processing takes place within the European Union.

Text messages to patients are sent, where the practice uses this option, directly from a device belonging to the practice. No text messaging provider is involved; the mobile number is not transmitted to us and is not stored by us.

14. Contact, support and feedback

For enquiries by e-mail, telephone or form we process contact details, the content and time of the enquiry and, where applicable, contract data. The legal basis is Art. 6(1)(b) GDPR where there is a contractual connection, and otherwise Art. 6(1)(f) GDPR.

The application offers the option of rating the service and leaving free text. This feedback reaches us in plain text and serves exclusively to improve the service; the legal basis is Art. 6(1)(f) GDPR. Providing it is voluntary. No automated assessment of the content of the feedback takes place.

Please do not enter any health data or any details about your person in this free-text field. The encrypted route is intended exclusively for medical matters.

In the course of fault handling we access only technical log and delivery data. No remote maintenance of practice systems takes place, and we do not request screenshots containing patient references. Please do not send unencrypted health data or private keys to support.

15. Security and operational data

To protect accounts, the directory and key exchange we process login times, IP addresses, device and browser data, failed access attempts, administrative changes, blocks, key changes, delivery errors and other security events. The legal basis is Art. 6(1)(f) GDPR, and additionally Art. 6(1)(c) GDPR where records are required by law.

These logs contain no private keys and no message contents.

16. Cookies and storage on your device

We use exclusively technically necessary cookies and local storage mechanisms. We do not use technologies requiring consent within the meaning of Section 25(1) TDDDG — in particular analytics, reach measurement or advertising technologies. A consent banner is therefore not required. The basis for access is Section 25(2)(2) TDDDG.

No third-party content is embedded: no external fonts, no maps, no advertising networks, no captcha or form services, no external analytics services.

In browser storage (localStorage) we store: language setting, display and accessibility settings, consent and signature evidence for the current case, the queue of entries not yet sent, and on practice devices the practice's key.

The device database (IndexedDB) holds: the local health record, the vaccination documentation, the patient key pair and its backup, the patient profile, signature keys, evidence packages and, on practice devices, the key vault and the locally stored cases.

The local health record and the private keys are stored on the user's device at their express request; this is the technical prerequisite for end-to-end encryption. We have no access to it. You can delete this data completely at any time via the application settings or via your browser.

17. Recipients and processors

Within DiggAI, only persons who need it for their task are granted access. They are bound to confidentiality and, as other participating persons under Section 203(3) sentence 2 of the German Criminal Code, to secrecy. In addition, data may reach the following recipients:

• Hetzner Online GmbH, Gunzenhausen — hosting and infrastructure (Finland data centre);
• Brevo (Sendinblue) — sending of arrival notifications by e-mail;
• banks and payment service providers as well as tax and legal advisers, insofar as necessary for the contract, payment or legal obligations;
• authorities and courts, insofar as we are legally obliged or are pursuing legal claims.

Processors are bound in accordance with Art. 28 GDPR. Data is not passed on for advertising purposes and data is not sold.

18. Transfers to third countries

No personal data is transferred to countries outside the European Union and the European Economic Area.

19. Storage period and deletion

We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist.

20. Security of processing

We take technical and organisational measures in accordance with Art. 25 and Art. 32 GDPR. These include in particular:

• end-to-end encryption of contents before they leave the sending device;
• local generation of the key pairs, in which only the public key is transmitted; private keys are stored on practice devices in such a way that they cannot technically be read out;
• storage of the recipient reference exclusively as a cryptographically derived check value, so that the database does not link recipient and transmission;
• additional transport encryption of all connections;
• role-based access rights with separate protection of administrative access and separation of tenants;
• no content data in any logs;
• verification of the identity of every recipient before activation, and display of the key fingerprint before sending;
• attack detection, access limitation and a documented process for security incidents;
• regular security testing of the application.

The specific arrangements are described in the annex on technical and organisational measures to the data processing agreement.

21. Automated decisions, profiling and artificial intelligence

No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place, and no profiling using health or communication data.

Content data is not used to train, fine-tune or evaluate artificial intelligence systems. No server-side translation or AI service is used. Insofar as the application offers an automatic summary, this is computed exclusively on your own device.

Optional third-party modules are not part of DiggAI. The respective provider is independently responsible for their data processing and provides separate information.

22. Minors and representation

Records for minors or dependants in your care can be kept on one device. These may only be maintained and released by persons authorised to do so. Assessing the capacity to consent and the power of representation is the responsibility of the authorised person and of the practice or institution providing care.

23. Origin of the data

We receive personal data directly from you when you visit the website, register, make contact or use the service, from a registered practice or institution, from publicly accessible directories in the course of identity verification, and automatically from our systems and the hosting infrastructure. Medical content reaches us exclusively as an encrypted envelope.

24. Obligation to provide data

Certain information is necessary for registration, identity verification, conclusion of contract, billing and secure delivery. Without it we cannot provide the respective function, or cannot provide it securely. Optional information is marked as such. Patients are not required to register or to provide any personal data to DiggAI in order to use the service.

25. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21). You may withdraw consent you have given at any time with effect for the future.

Please address enquiries regarding processing for which DiggAI is itself responsible to the address given above. In order to prevent unauthorised disclosure, we may require reasonable proof of identity.

For medical content and practice records, please contact the relevant practice or institution. We hold no private keys and cannot read, correct or export encrypted content; we support the responsible party within the scope of our technical possibilities.

26. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The competent authority for the controller's place of business is the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstrasse 98, 24103 Kiel, Germany. You may also contact any other supervisory authority competent under Art. 77 GDPR.

27. Processing on your device

Some functions run entirely on your device without any data being transmitted to us. These include the health record you create and maintain locally, and the preparation of questions with a language model that is downloaded into your browser once and then computes there.

For these operations we are not the controller within the meaning of Art. 4(7) GDPR, because we neither receive, store nor can access the content processed. Before first use you decide by separate consent whether to use these functions; the consent is recorded solely on your device.

Only when you decide to send content to a practice does the transmission described in this statement apply — and then exclusively in encrypted form, without us being able to read the content.

What stays on your device we also cannot hand over or restore. Save your health record as a file yourself if you wish to keep it.

28. Changes to this policy

We adapt this policy when the legal situation, services, data flows, recipients or the security architecture change. The current version is always available at diggai.de/datenschutz. We retain earlier versions with a version number and date.