The controller responsible for the processing of personal data is:
Katrina Bauersachs
Midwife
Postfach 250242
90127 Nuremberg
Germany
Phone: 01794903534
Email: hebammekat@gmx.de
When handling enquiries, registrations, courses and midwifery services, I process the personal data required for the respective service.
This may include, in particular, your name, contact details, date of birth, insurance and billing information, booking and course details and, where applicable, information relating to a partner, support person or child. Where necessary for the provision of midwifery care, health data will also be processed.
Your data is processed in order to respond to enquiries and registrations, organise and provide the agreed services, communicate with you, fulfil statutory documentation requirements and handle billing.
The legal basis for processing general personal data is, in particular, Art. 6(1)(b) GDPR for taking steps prior to entering into a contract and for the performance of a contract, as well as Art. 6(1)(c) GDPR where processing is necessary to comply with a legal obligation.
Where health data is processed as part of my work as a midwife, this is based in particular on Art. 9(2)(h) GDPR in conjunction with Section 22(1)(1)(b) of the German Federal Data Protection Act (BDSG). Separate consent is only obtained where the processing is not already permitted on another legal basis. Section 22 BDSG permits the processing of special categories of personal data, including for the purposes of healthcare and treatment by healthcare professionals.
Where certain information is required in order to provide or bill for a booked service, it may not be possible to provide the service without this information.
For enquiries, course registrations and the organisation of my midwifery work, I use the midwifery software Hebamio, provided by:
Somedio Software GmbH
Kronstadter Straße 4
81677 Munich
Germany
The data required for the respective registration or care arrangement is processed and stored via Hebamio. Where Somedio Software GmbH processes personal data on my behalf, this takes place under a data processing agreement in accordance with Art. 28 GDPR.
The specific data collected via Hebamio depends on the service and on the information required in the relevant registration form. This may include contact details, date of birth, expected due date and information relating to the requested service.
For billing my midwifery services, I use:
AZH – Abrechnungszentrale für Hebammen GmbH
Alois-Moser-Str. 7
89415 Lauingen
Germany
The personal and service-related data required for billing is transmitted to AZH.
For patients covered by German statutory health insurance, billing is carried out with the relevant statutory payers in accordance with the applicable legal requirements. Section 301a SGB V expressly provides for the electronic transmission of the insured person’s data, service details, dates and times and, where applicable, travel expenses and other reimbursable expenses required for midwifery billing. It also provides for billing through a central billing service.
For privately insured patients, personal and treatment-related data is only transmitted to AZH for the preparation and processing of private invoices on the basis of separately given consent and, where required, an appropriate release from the duty of confidentiality.
If this consent is not given or is withdrawn for the future, privately payable midwifery services will be billed directly by me.
Pure self-pay services that are not midwifery services billed through AZH are billed directly between you and me. No billing data relating to these services is transmitted to AZH.
Personal data is only shared where this is necessary for the provision, documentation or billing of a service, where there is a legal obligation to do so, or where you have given the relevant consent.
Depending on the type of care provided, recipients may include statutory health insurance providers, billing service providers, medical laboratories, doctors involved in your care, other healthcare professionals involved in your treatment or care, and legally authorised public authorities.
Your personal data will not be shared for advertising purposes.
Personal data is generally stored only for as long as necessary for the respective purpose, or for as long as there are statutory or legitimate grounds for further retention.
Treatment and care records are generally retained for at least ten years after the end of care. This is in accordance with both Section 5 of the Bavarian Professional Code for Midwives (Bayerische Hebammenberufsordnung) and Section 630f(3) of the German Civil Code (BGB).
Records relating to home births are retained for up to 30 years. The longer retention period is based on the possibility of long-term liability claims and the need to establish, exercise or defend legal claims. The legal basis for this is Art. 6(1)(f) GDPR and, where health data is concerned, Art. 9(2)(f) GDPR. Section 199(2) BGB provides for a maximum limitation period of 30 years for claims for damages arising from injury to life, body or health.
Invoices and related documents that must be retained for tax purposes are stored in accordance with the applicable statutory retention periods. Under Section 14b of the German VAT Act (UStG), the current retention period for invoices is generally eight years.
Data relating to enquiries or booking processes that do not result in longer-term care or a statutory documentation requirement will be deleted once it is no longer required for its original purpose and there are no statutory or legitimate grounds for further retention.
If you subscribe to my newsletter, I process your email address in order to occasionally send you information about new courses, services and updates from my midwifery work.
The legal basis for this processing is your voluntary consent in accordance with Art. 6(1)(a) GDPR.
For newsletter registration and delivery, I use:
CleverReach GmbH & Co. KG
Schafjückenweg 2
26180 Rastede
Germany
CleverReach processes the data required for newsletter delivery on my behalf. A data processing agreement pursuant to Art. 28 GDPR may be concluded for this purpose. CleverReach states that the data used for this purpose is stored exclusively in data centres within Europe.
Registration takes place using a double opt-in process. After registering, you will receive an email containing a confirmation link. CleverReach records the registration and confirmation process. This may include the date and time, the URL used and – where this function is enabled – the IP address used for registration and confirmation. This information is used to document that valid consent was given.
You can withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link included in every newsletter or by contacting me directly. Once you unsubscribe, your email address will no longer be used for newsletter delivery. Data required to document that consent was previously given or withdrawn may be retained beyond this point for the duration of any potential legal claims.
No personalised analysis of newsletter opening or click behaviour takes place.
My website is provided by Jimdo GmbH, Stresemannstraße 375, 22761 Hamburg, Germany.
When you visit the website, technically necessary connection and usage data is processed. This may include, in particular, your IP address, the page accessed, the date and time of access, and information about your browser and operating system.
This data is processed in order to provide the website technically and to ensure its stability and security, based on my legitimate interest pursuant to Art. 6(1)(f) GDPR. Jimdo also describes the processing of such server and log data as necessary for technical operation, stability and protection against misuse.
Where Jimdo processes personal data on my behalf, this takes place under a data processing agreement in accordance with Art. 28 GDPR.
Information about cookies and similar technologies, as well as the available choices, is provided through the website’s cookie settings.
For some online services, I use Zoom. When you participate, data such as your name or chosen display name, email address, meeting information and any image, audio or communication data you voluntarily share during the meeting may be processed.
This data is processed in order to provide the booked online service on the basis of Art. 6(1)(b) GDPR. Where health data is shared in connection with a midwifery service, the additional legal bases described in Section 2 above also apply.
Zoom provides customers with a data processing addendum. Where data is processed outside the European Economic Area, Zoom states that it relies, among other mechanisms, on applicable adequacy mechanisms and the European Commission’s Standard Contractual Clauses.
Online courses and video calls are not recorded, unless this has been expressly agreed in an individual case and communicated transparently in advance.
If you contact me by email, the information you provide will be processed in order to respond to your enquiry and for any further communication with you.
For my professional email communication, I use a service provided by:
GMX / 1&1 Mail & Media GmbH
Brauerstr. 48
76135 Karlsruhe
Germany
Depending on the reason for the communication, the legal basis is Art. 6(1)(b) GDPR in connection with an enquiry or an existing contractual relationship, or Art. 6(1)(f) GDPR for other professional communication.
Subject to the applicable legal requirements, you have the right to request information about the personal data I hold about you, to have inaccurate data corrected, to request deletion or restriction of processing, and to receive your data in a portable format. Where applicable, you also have the right to object to the processing of your personal data.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. This does not affect the lawfulness of any processing carried out before your consent was withdrawn.
There is no right to immediate deletion where statutory retention requirements or other lawful grounds require or permit the data to be stored for longer.
You also have the right to lodge a complaint with a data protection supervisory authority. For self-employed professionals and other non-public bodies based in Bavaria, the competent authority is generally the Bavarian State Office for Data Protection Supervision (BayLDA).
I do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.