Privacy policy

1. Name/contact details of the controller
   Medizinische Einrichtungen des Bezirks Oberpfalz - Kommunalunternehmen (Anstalt des öffentlichen Rechts) - hereinafter medbo -, Universitätsstr. 84, 93053 Regensburg, Phone +49 (0)941/941-0, 
   Email: info@medbo.de, Director: Dr med. Dr jur. Helmut Hausner
    
2. Contact details of the data protection officer
   Andreas Eisenhart, medbo KU, August-Holz-Straße 1, 93413 Cham, phone +49 (0)9971/76655-9676, 
   e-mail: datenschutz@medbo.de 
    
3. Purposes for which the personal data is to be processed
   The purpose of data collection is to provide you with information for a future application and to remain in contact with you until your application. 
   For this purpose, we process (in particular store) all the data you provide to us as part of your contact card. Based on the data provided in the contact card, we check which information is of interest to you and send it to you by e-mail several times a year. If you apply for a job with us, you will be informed separately about the additional personal data to be collected as part of the application process.
    
4. Legal basis for processing
   The legal basis for data collection and data processing is, in particular, Article 6(1) sentence 1 point (b).
    
5. Recipients or categories of recipients of the personal data
   Your personal data will be forwarded to or can be viewed by our Education, Personnel Development and Content Marketing department - Content Marketing division.
    
6. Duration of data storage:
   We store your data for a maximum of five years. Unless you inform us beforehand by email that we should delete you from our contact list. 
    
7. Your rights under the GDPR:
   If your personal data is processed, you have the right to obtain information about the personal data stored about you (Article 15 GDPR).
   If incorrect personal data is processed, you have the right to rectification (Article 16 GDPR).
   If the legal requirements are met, you can request the erasure or restriction of processing and object to processing (Articles 17, 18 and 21(1) GDPR). 
   You also have the right to lodge a complaint with the Bavarian State Commissioner for Data Protection. You can contact them using the following contact details:
   
   Der Bayerische Landesbeauftragter für den Datenschutz (BayLfD)
   Wagmüllerstraße 18, 80538 München
   Postal address: Postfach 22 12 19, 80502 München
   Phone +49 (0) 89/212672-0 | Fax +49 (0) 89/212672-50
   Email: poststelle@datenschutz-bayern.de
   Internet: www.datenschutz-bayern.de
   
   If you make use of the above rights, medbo will check whether the legal requirements for this are met.

Data protection information in accordance with Art. 13 GDPR

1. Responsible body
   Name of the responsible body:
   Medizinische Einrichtungen des Bezirks Oberpfalz - Kommunalunternehmen (Anstalt des öffentlichen Rechts)
   Director: Dr med. Dr jur. Helmut Hausner
   
   Address of the responsible body:
   Universitätsstr. 84, 93053 Regensburg
   Telephone: +49 (0)941/941-0
   Email: info@medbo.de
    
2. Data Protection Officer
   Name of the Data Protection Officer:
   Andreas Eisenhart
   
   Address:
   medbo KU, August-Holz-Straße 1, 93413 Cham
   Phone: +49 (0) 9971/76655-9676
   Email: datenschutz@medbo.de
    
3. Purpose of data collection, storage, processing or use
   Your data will be processed
   • to conclude an employment contract or other employment relationship and to fulfil the contractual relationship
   • to terminate the employment relationship and to wind up the contractual relationship.
      
4. Collection of data from third parties
   In principle, the controller collects personal data from the data subject. If, in exceptional cases, the controller collects data from third parties, the data subject will be informed in accordance with the provisions of Art. 14 GDPR, including the source.
    
5. Legal basis
   The legal basis for data collection and data processing in the context of recruitment and employment is in particular Art. 6 para. 1 sentence 1 lit. b, lit. c and e GDPR, Art. 9 para. 2 letters b and h GDPR, Art. 88 para. 1 GDPR, Art. 8 para. 1 sentence 1 no. 2 and 3 BayDSG, § 611 BGB, § 3 para. 4 TVöD-K, § 3 para. 5 TV-Ärzte/VKA, § 4 TVAöD (BBiG, Pflege) § 4 TVPöD; for recruitment in the driving service additionally § 31 para. 2 StVZO, § 11 para. 9 in conjunction with Annex 5 FeV, § 12 in conjunction with Annex 6 No. 2 FeV.
    
6. Recipients or categories of recipients of the personal data
   • Public bodies that receive data on the basis of statutory provisions (existence of overriding legal provisions) (in particular authorities and social insurance institutions), e.g. German Federal Pension Insurance, responsible tax office, occupational pension schemes. Additionally for people with severe disabilities or equalisation: Due to a proven severe disability or equalisation as part of the recruitment process, personal data is also passed on to the following external bodies: Federal Employment Agency: In order to fulfil the obligation under Section 163 (2) SGB IX, the Ministry of State transmits personal data to the Federal Employment Agency annually in the form of a list of employees with severe disabilities and equivalent status.
   • Internal departments involved in the execution of the respective processes, e.g. Human Resources Management Department, Payroll, Bookkeeping, Accounting, Auditing, Purchasing, Staff Council to safeguard its rights, Company Health Management, IT.
   • External contractors pursuant to Art. 28 GDPR (processing or use of personal data on behalf of third parties) and external companies, if necessary, e.g. Anstalt für Kommunale Datenverarbeitung in Bayern (AKDB) for the purpose of payroll accounting, Consal Service GmbH, postal service providers for the delivery of letters, financial institutions for the processing of payments to you, Bayerische Versorgungskammer (Bayerischer Versorgungsverband, supplementary pension scheme), pension providers, the State Office for Statistics, Kommunale Unfallversicherung Bayern (KUVB), provident funds, Versicherungskammer Bayern - Sparkasse Regensburg, employers concerned in the case of multiple employment or insurance companies.
      
7. Transfer to third countries
   There are no plans to transfer your data to third countries.
    
8. Automated decision-making (profiling)
   Unless otherwise stated in separate information on the processing activity, no personal automated decision-making (profiling) takes place at the controller.
    
9. Storage periods and deletion of data
   We store and process data for as long as we need it to fulfil the purposes described above. Application documents are generally stored for six months, unless a contractual relationship is subsequently established. If an application is unsuccessful or is withdrawn, we will destroy the data submitted as part of an application no later than six months after notification of rejection. Storage within these periods is necessary in the event of any legal disputes on legal grounds. If the person concerned is hired, he/she will be informed separately about the regulations then applicable to the handling of personnel data, in particular with regard to the creation of personnel files.
    
10. Notification in the event of a breach of data protection
    In the event of a breach of data protection, the controller shall notify the competent data protection supervisory authority. If the breach results in a high risk to the personal rights and freedoms of a natural person, the controller will notify the data subject.
     
11. Rights of data subjects
    We would also like to inform you about the rights to which you are entitled under the GDPR (in particular Art. 15 to 21, 77 GDPR) in the event that you are affected:

• If your personal data is processed, you have the right to obtain information about the personal data stored about you.
• If incorrect personal data is processed, you have the right to rectification.
• If the legal requirements are met, you can request the deletion or restriction of processing.
• You also have the right to lodge a complaint with the Bavarian State Commissioner for Data Protection. You can contact them using the following contact details:
  The Bavarian State Commissioner for Data Protection (BayLfD), Wagmüllerstraße 18, 80538 Munich, postal address: Postfach 22 12 19, 80502 Munich, telephone: 089 212672-0, fax: 089 212672-50, e-mail: poststelle@datenschutz-bayern.de, Internet: www.datenschutz-bayern.de
  
  As a data subject, you can also exercise your right to object at any time without giving reasons and amend or completely revoke a declaration of consent with effect for the future. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. This does not affect the data processing carried out up to the time of cancellation. You can send your cancellation to the contractual partner either by post, e-mail or fax. You will not incur any costs other than the postage costs or the transmission costs according to the existing basic tariffs.
  
  If you make use of your above-mentioned rights, medbo will check whether the legal requirements for this are met.'
  If the deletion of the applicant data is requested during the application procedure, this will be regarded as a withdrawal of the application.
  (Human Resources Department, as of August 2018)

In accordance with Article 13 of the GDPR, we are obliged to provide you with the following information when collecting data:

1. Name and contact details of the controller
   Medizinische Einrichtungen des Bezirks Oberpfalz - KU (Anstalt des öffentlichen Rechts, "medbo" for short)
   Universitätsstr. 84
   93053 Regensburg
   Tel +49 (0)941/941-0
   Fax +49 (0)941/941-1105
   Email: info@medbo.de 
    
2. Contact details of the data protection officer
   Medizinische Einrichtungen des Bezirks Oberpfalz - KU (Anstalt des öffentlichen Rechts)
   Data protection officer
   Universitätsstr. 84
   93053 Regensburg
   Email: datenschutz@medbo.de 
    
3. Purpose of processing 
   Your data will be used for the purpose of contract fulfilment in accordance with Article 6, paragraph 1 b GDPR by the Institute for Education and Personnel Development of the Bezirksklinikum Regensburg. 
    
4. Recipients of the data
   The recipients of your data are therefore the Institute for Education and Personnel Development of the District Hospital Regensburg.
    
5. Duration of data storage
   Your data will be deleted after the purpose for which it was collected no longer applies and after the statutory retention period.
    
6. Right to information, rectification and erasure
   In accordance with Article 15 GDPR, you have the right to request information about whether and how we use your personal data. Article 16 GDPR grants you the right to request the rectification of your personal data. You also have the right to request the erasure of your data if one of the grounds in Article 17 GDPR applies.
    
7. Right to restriction of processing
   Under the conditions of Article 18 GDPR, you have the right to restrict the processing of your personal data.
    
8. Right to withdraw consent
   If the processing of your data is based on consent that you have given to the Institute for Education and Personnel Development of the Bezirksklinikum Regensburg, you have the right to withdraw your consent at any time. You can send this declaration - in writing / by e-mail / fax - to the Institute for Education and Personnel Development of the District Hospital Regensburg. It is not necessary to give reasons for this. However, your cancellation is only valid from the time you make it. It has no retroactive effect. The processing of your data up to this point in time remains lawful.
    
9. Right to lodge a complaint
   Irrespective of the fact that you are also free to seek judicial assistance, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of your data is not permitted under data protection law. This arises from Art. 77 GDPR. The complaint to the supervisory authority can be made informally. In accordance with Art. 15 BayDSG, the Bavarian State Commissioner for Data Protection is responsible for monitoring compliance with data protection regulations at the public bodies of the Free State of Bavaria and also at medbo.
   
   Bayerischer Landesbeauftragter für den Datenschutz
   (Telephone: (089) 2 1 26 72 - 0 | Email: poststelle@datenschutz-bayern.de)
   Internet: www.datenschutz-bayern.de

In accordance with Article 13 of the GDPR, we are obliged to provide you with the following information when collecting data:

1. Name and contact details of the controller
   Medizinische Einrichtungen des Bezirks Oberpfalz - KU (Anstalt des öffentlichen Rechts, "medbo" for short)
   Universitätsstr. 84
   93053 Regensburg
   Tel +49 (0)941/941-0
   Fax +49 (0)941/941-1105
   Email: info@medbo.de
    
2. Contact details of the data protection officer
   Medizinische Einrichtungen des Bezirks Oberpfalz - KU (Anstalt des öffentlichen Rechts)
   Data protection officer
   Universitätsstr. 84
   93053 Regensburg
   Email: datenschutz@medbo.de
    
3. Purpose of processing 
   Your data will be processed by medbo for the purpose of sending you the newsletter or invitations to events or job offers. Your personal data will not be used for any other purpose. Data processing is carried out on the basis of Art. 6 para. 1 letter a GDPR
    
4. Recipient of the data
   The recipient of your data is exclusively the respective office responsible for dispatch within medbo.
    
5. Duration of data storage
   Your data will be deleted after you withdraw your consent.
    
6. Right of access, rectification and erasure
   In accordance with Article 15 GDPR, you have the right to request information about whether and how we use your personal data. Article 16 GDPR grants you the right to request the rectification of your personal data. You also have the right to request the erasure of your data if one of the grounds in Article 17 GDPR applies.
    
7. Right to restriction of processing
   Under the conditions of Article 18 GDPR, you have the right to restrict the processing of your personal data.
    
8. Right to withdraw consent
   If the processing of your data is based on consent that you have given to medbo, you have the right to withdraw your consent at any time. You can send this declaration - in writing / by e-mail / fax - to medbo. You do not need to give reasons for this. However, your cancellation is only valid from the time you make it. It has no retroactive effect. The processing of your data up to this point in time remains lawful.
   If you no longer wish to receive a newsletter, event invitations or job offers in the future, please follow the steps at the end of the respective notification.
    
9. Right to lodge a complaint
   Irrespective of the fact that you are also free to seek judicial assistance, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of your data is not permitted under data protection law. This arises from Art. 77 GDPR. The complaint to the supervisory authority can be made informally. In accordance with Art. 15 BayDSG, the Bavarian State Commissioner for Data Protection is responsible for monitoring compliance with data protection regulations at the public bodies of the Free State of Bavaria and also at medbo.
   Contact:
   Bavarian State Commissioner for Data Protection
   (Telephone: (089) 2 1 26 72 - 0,
   E-mail: poststelle@datenschutz-bayern.de)
   Internet: www.datenschutz-bayern.de

We would like to inform you below about the processing of personal data in connection with the use of "Zoom".

1. Purpose of processing
   We use the "Zoom" tool to conduct telephone conferences, online meetings, video conferences and/or webinars (hereinafter: "online meetings"). "Zoom" is a service provided by Zoom Video Communications, Inc. based in the USA.
    
2. Responsible party
   The party responsible for data processing that is directly related to the organisation of "online meetings" is the Medizinisches Einrichtungen des Bezirks Oberpfalz - KU (medbo for short), possibly in conjunction with an external speaker.
   
   Note: If you access the "Zoom" website, the provider of "Zoom" is responsible for data processing. However, accessing the website is only necessary to use Zoom in order to download the software for using Zoom. 
   You can also use Zoom if you enter the relevant meeting ID and any other access data for the meeting directly in the Zoom app.
   
   If you do not want to or cannot use the Zoom app, the basic functions can also be used via a browser version, which you can also find on the Zoom website. 
    
3. What data is processed?
   Various types of data are processed when you use Zoom. The scope of the data also depends on the data you provide before or when participating in an "online meeting".
   
   The following personal data is processed:
   User details: first name, surname, telephone (optional), email address, password (if "single sign-on" is not used), profile picture (optional), department (optional)
   Meeting metadata: topic, description (optional), participant IP addresses, device/hardware information.
   For recordings (optional): MP4 file of all video, audio and presentation recordings, M4A file of all audio recordings, text file of the online meeting chat.
   When dialling in by telephone: details of the incoming and outgoing telephone number, country name, start and end time. If necessary, further connection data such as the IP address of the device may be stored.
   Text, audio and video data: You may have the opportunity to use the chat, question or survey functions in an "online meeting". In this respect, the text entries you make are processed in order to display them in the "online meeting" and, if necessary, to log them. In order to enable the display of video and the playback of audio, the data from the microphone of your end device and from any video camera of the end device will be processed accordingly for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time via the "Zoom" applications.
   
   To participate in an "online meeting" or enter the "meeting room", you must at least provide information about your name (although you can also use a pseudonym here).
    
4. Scope of processing
   We use "Zoom" to conduct "online meetings". If we want to record "online meetings", we will inform you transparently in advance and - if necessary - ask for your consent. The fact of the recording will also be displayed to you in the "Zoom" app.
   If it is necessary for the purpose of logging the results of an online meeting, we will log the chat content. However, this will not usually be the case.
   In the case of webinars, we may also process the questions asked by webinar participants for the purposes of recording and following up on webinars. 
   If you are registered as a user with "Zoom", reports on "online meetings" (meeting metadata, telephone dialling data, questions and answers in webinars, survey function in webinars) can be stored for up to one month at "Zoom".
   The possibility of software-based "attention monitoring" ("attention tracking") in "online meeting" tools such as "Zoom" is deactivated.
   Automated decision-making within the meaning of Art. 22 GDPR is not used.
    
5. Legal basis for data processing
   Insofar as personal data of medbo employees and, if applicable, their authorised representatives are processed, Section 26 BDSG is the legal basis for data processing. If, in connection with the use of "Zoom", personal data is not required for the establishment, implementation or termination of the employment relationship, but is nevertheless an elementary component of the use of "Zoom", Art. 6 para. 1 lit. f) GDPR is the legal basis for data processing. In these cases, our interest lies in the effective organisation of "online meetings".
   Otherwise, the legal basis for data processing when holding "online meetings" is Art. 6 para. 1 lit. b) GDPR, insofar as the meetings are held within the framework of contractual relationships. 
   If there is no contractual relationship, the legal basis is Art. 6 para. 1 lit. f) GDPR. Here too, we are interested in the effective organisation of "online meetings".
    
6. Recipients / disclosure of data
   Personal data that is processed in connection with participation in "online meetings" is generally not disclosed to third parties (exception: you explicitly consent to the disclosure of data).
   Other recipients: The provider of "Zoom" necessarily receives knowledge of the above-mentioned data, insofar as this is provided for in our order processing contract with "Zoom".
    
7. Data processing outside the European Union
   "Zoom" is a service provided by a provider from the USA. Personal data is therefore also processed in a third country. We have concluded an order processing contract with the provider of "Zoom" that meets the requirements of Art. 28 GDPR. 
   An adequate level of data protection is guaranteed by the conclusion of the so-called EU standard contractual clauses. In our account with Zoom, we have stipulated that only German or European data centres will be used. This means that your personal data is never sent to the USA. We also ensure that all data relating to an online conference is deleted by us no later than 48 hours after the end of the conference. In this way, we work with Zoom in the most data-efficient way possible.
   Zoom nevertheless processes data outside the EU. In this case, however, it is not your personal data, but data from us that is used for billing purposes.
   
   We make sure that as little personal data as possible is processed by Zoom. For example, we do not send invitations to online conferences via the Zoom invitation tool, but by email or newsletter via medbo accounts. When participating in an online conference, you can control which data you share yourself.
    
8. Data protection officer
   You can contact our data protection officer as follows: 
   Medizinische Einrichtungen des Bezirks Oberpfalz - KU (Anstalt des öffentlichen Rechts)
   Data protection officer
   Universitätsstr. 84
   93053 Regensburg
   Email: datenschutz@medbo.de
    
9. Your rights as a data subject
   As a data subject, you have a right to information about the use of personal data concerning you. We will provide you with information at any time. If possible, please submit your request for information in writing. We ask for your understanding that we will request appropriate proof of authentication from you for any request for information that is not made in writing - you must be able to prove that you are the person you claim to be.
   You have the right to rectification, erasure or restriction of the processing of your personal data to the extent that you are legally entitled to do so. 
   You have a legally defined right to object to the processing of your personal data.
   You also have the right to data portability under data protection law.
    
10. Deletion of data
    We generally delete personal data when there is no need for further storage. A requirement may exist in particular if the data is still needed to fulfil contractual services, to check and grant or defend against warranty and guarantee claims. In the case of statutory retention obligations, erasure will only be considered after the respective retention obligation has expired.
     
11. Right to lodge a complaint with a supervisory authority 
    You have the right to lodge a complaint about the processing of personal data by us with a supervisory authority for data protection. The competent supervisory authority is the Bavarian State Commissioner for Data Protection:
    
    Contact details:
    Bavarian State Commissioner for Data Protection
    (phone: (089) 2 1 26 72 - 0,
    e-mail: poststelle@datenschutz-bayern.de)
    Internet: www.datenschutz-bayern.de

The other data protection declarations of medbo - in particular the data protection declaration for applicants - can be found at www.medbo.de/datenschutz. The following statements only apply to the processing of data if you wish to contact us via WhatsApp.

1. For the information service offered here, medbo uses the technical platform and services of WhatsApp Ireland Ltd, 4 Grand Canal Square Grand Canal Harbour, Dublin 2, Ireland. The controller within the meaning of the GDPR for the WhatsApp messenger service is WhatsApp Ireland; the competent supervisory authority is the Irish Data Protection Authority. medbo uses hardware and software components from Userlike UG and 360dialog GmbH in order to be able to offer communication via WhatsApp in compliance with the GDPR as far as possible. In this context, medbo has concluded contracts with both companies (data protection information Userlike: https://www.userlike.com/de/data-privacy, data protection information 360dialog GmbH: https://www.360dialog.com/de/kontakt#dataprivacy). Userlike and 360dialog provide medbo with the necessary platform to communicate with you via WhatsApp.
    
2. When using WhatsApp, WhatsApp collects, among other things, your IP address and individual IDs for products from meta-companies that are linked to the same account or device, in accordance with its own statements. WhatsApp provides more information on this, as well as on other automatically collected information, in its own privacy policy. You can find the complete WhatsApp privacy policy here: https://www.whatsapp.com/legal/privacy-policy-eea
    
3. The data collected about you in this context will be processed by WhatsApp or Meta and may be transferred to countries outside the European Union. WhatsApp describes in general terms what information WhatsApp receives and how it is used in the aforementioned privacy policy. We would like to point out that WhatsApp and Meta may use certain personal data collected in the course of WhatsApp communication for their own purposes. medbo has no influence on this processing.
    
4. Communication via WhatsApp is end-to-end encrypted. However, the way in which WhatsApp uses the data for its own purposes, the extent to which activities are assigned to individual users, how long WhatsApp stores this data and whether data is passed on to third parties is not conclusively and clearly stated by WhatsApp and is not known to us.
    
5. Further information on data processing can be found in the WhatsApp help section: https://faq.whatsapp.com/.
    
6. You can contact WhatsApp Support here for answers to further questions - in particular regarding the rights of data subjects under the GDPR:
7. https://www.whatsapp.com/contact/?lang=de&subject=messenger.
    
8. By contacting us via WhatsApp, you accept the above points, in particular the transfer of data to Meta, in the sense of consent pursuant to Art. 6 para. 1 lit. a GDPR. medbo uses WhatsApp exclusively for the purpose of answering your questions. The following information is collected by medbo in the course of communication Date and time of a communication, specified name, user name, telephone number and content of the communication as well as any information that you transmit to us as part of the chat communication.
    
9. You are under no obligation to use WhatsApp to contact medbo or to provide us with information via this messenger service. Alternatively, you can reach us via the contact options listed above.
   You have the right to withdraw your consent at any time without giving reasons. In the event of revocation, we will delete the data collected by medbo and instruct our processors Userlike and 360dialog to delete all data as well. We have no influence on the deletion of the data collected by WhatsApp/ Meta. We do not use data for purposes other than the WhatsApp chat. The deletion of the chat data stored by medbo itself takes place after the chat conversation has ended.
    
10. If you have any further questions, you can contact our data protection officer:
    Medizinische Einrichtungen des Bezirks Oberpfalz - KU (Anstalt des öffentlichen Rechts)
    Data Protection Officer, Universitätsstr. 84 | 93053 Regensburg
    Email: datenschutz@medbo.de
     
11. Right to lodge a complaint with a supervisory authority 
    You have the right to lodge a complaint about the processing of personal data by us with a supervisory authority for data protection. The competent supervisory authority is the Bavarian State Commissioner for Data Protection:
    Contact details:
    Bavarian State Commissioner for Data Protection
    (phone: (089) 2 1 26 72 - 0,
    e-mail: poststelle@datenschutz-bayern.de)
    Internet: www.datenschutz-bayern.de

1. responsible body

Name of the responsible body: Medizinische Einrichtungen des Bezirks Oberpfalz - Kommunalunternehmen (Anstalt des öffentlichen Rechts) Management Board: Dr med. Dr jur. Helmut Hausner Address of the responsible body: Universitätsstr. 84, 93053 Regensburg, phone +49 (0)941/941-0, e-mail: info@medbo.de

2. data protection officer

Name of the data protection officer: Andreas Eisenhart Address: medbo KU, August-Holz-Straße 1, 93413 Cham Phone +49 (0) 9971/76655-9676 Email: datenschutz@medbo.de

3. purpose of data collection, storage, processing or use

The purpose of data processing is to ensure that medbo can be reached by telephone and to process your enquiry in a time-saving manner.

4 Scope of data processing

medbo uses the VITAS telephone assistant from VITAS GmbH, Zollhof 7, 90443 Nuremberg, which is based on artificial intelligence and is able to answer calls for us and ask for all the data necessary to process your enquiry in a natural flow of conversation. Your personal data is recorded and converted into text form so that it can then be made available to our team in a clearly organised format. The telephone assistant ensures that we are available to you by telephone. As the party responsible for data processing, we have determined in advance which data the VITAS telephone assistant requests and collects on our behalf when configuring the telephone assistant. You yourself determine which data you wish to communicate to the telephone assistant during the course of the call.

The data that we process may include

- Address

- Name (surname and first name)

- Your date of birth - Your mobile phone number or landline number

- Biometric data (Art. 4 No. 14 GDPR) in the form of your voice recording

- Health data (Art. 4 No. 15 GDPR)

The data collected varies depending on the call request. The data will only be used to process your request. VITAS GmbH uses processors to provide the service. This may result in the aforementioned data being transferred to a country that does not guarantee the same data protection standards as the European Union. In this case, VITAS GmbH will ensure that the service providers guarantee an equivalent level of data protection by contract or other means. You have the right to be informed about the appropriate guarantees in accordance with Art. 46 GDPR. You are welcome to request a copy of these guarantees from VITAS GmbH. Detailed information on data processing by VITAS GmbH can be found here: https://www.telefonassistent.de/datenschutz

5 Legal basis for data processing

We process your data on the basis of your express consent (Art. 6 para. 1 letter a, Art. 9 para. 2 letter a GDPR), which is collected during the telephone conversation. You can revoke this consent at any time without giving reasons, even after the telephone conversation, by contacting us using the contact details given in point 1 of this data protection notice. In this case, we also undertake to delete all data collected about you, unless we are obliged to observe certain statutory retention periods that may prevent the data from being deleted immediately. The revocation of your consent does not affect the legality of the data processing carried out on the basis of your consent until the revocation. The further use of your data after you have given your consent, for example to make appointments, also serves the purpose of initiating or implementing a treatment contract with us (Art. 6 para. 1 lit. c, e, para. 2, 3 GDPR in conjunction with Art. Art. 9 para. 2 letter h, para. 3, para. 4 GDPR in conjunction with. §§ Sections 630a ff, 630f BGB)

6. duration of storage

We generally store your data for as long as is necessary for the purposes of processing your enquiry and the associated treatment services or for as long as there is a retention obligation. Personal data processed by the VITAS telephone assistant is generally stored for a period of two weeks. After this period has expired, the data is automatically deleted, unless legal requirements demand longer storage. The conversation converted into text is only stored within Europe. Insofar as we use information from the call such as personnel master data and the categorised reason for the call for internal administration (e.g. appointment booking via our internal calendars), it may be stored for a longer period of time if this is necessary for the planning and provision of treatment services.

7. no automated decision-making; use of AI technology

Automated decision-making (profiling) within the meaning of Art. 22 GDPR does not take place. Further processing also takes place when using the VITAS telephone assistant as part of internal administration with the final decision being made by medbo employees. The VITAS telephone assistant is based on artificial intelligence (AI) technologies and generates statements based on probability algorithms and its own training data set. In individual cases, this may result in incorrect or incomprehensible statements. We are in close dialogue with the provider in order to continuously improve the precision of the VITAS telephone assistant; should you therefore notice any errors or inconsistencies, you are welcome to contact medbo's data protection officer (point 2 of this data protection notice) with your feedback. The data you provide during a call will not be used for training purposes.

8 Cancellation and rights of data subjects

You have the right to withdraw (revoke) your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. (Revocation with effect for the future). Please send your cancellation to the contact details under point 1 of this data protection notice. Furthermore, we would like to inform you about your rights under the GDPR (in particular Articles 15 to 21, 77 GDPR) in the event that you are affected:

- If your personal data is processed, you have the right to obtain information about the personal data stored about you.

- If incorrect personal data is processed, you have the right to rectification.

- If the legal requirements are met, you can request the deletion or restriction of processing.

You can exercise these rights at any time by contacting us using the contact details provided in point 1 of this data protection notice. You can also contact our data protection officer (point 2 of this data protection notice), in particular for suggestions and complaints regarding the processing of your personal data.

You also have the right to lodge a complaint with the Bavarian State Commissioner for Data Protection. You can reach him under the following contact details The Bavarian State Commissioner for Data Protection (BayLfD), Wagmüllerstraße 18, 80538 Munich, postal address: Postfach 22 12 19, 80502 Munich, phone +49 (0) 89/212672-0, fax +49 (0) 89/212672-50, e-mail: poststelle@datenschutz-bayern.de, Internet: www.datenschutz-bayern.de