Privacy policy for the TK Bonus Plan

The TK Bonus Plan promoting health-conscious behaviour

TK’s privacy policy for the TK Bonus Plan is set out below.

The TK Bonus Plan is a scheme designed to encourage you to take steps to improve your health. Naturally, the data collected as part of the TK Bonus Plan will not be used to analyse the state of your health or the benefits to which you are entitled. The data collected under the TK Bonus Plan is collected and processed solely for administrative purposes.

This privacy policy informs users about the nature, scope and purposes of the collection and use of personal data by the data controller. The legal basis for data protection is set out in the General Data Protection Regulation (GDPR), the German Social Code (SGB) and the German Federal Data Protection Act (BDSG). TK collects and uses your personal data exclusively in accordance with these provisions.

The TK Bonus Plan is constantly being developed. Such developments may necessitate changes to this privacy policy. We therefore recommend that you visit this page at regular intervals to keep up to date.

1. Data controller and data protection officer

The organisation responsible for the collection, processing and use of personal data in connection with this service is

Techniker Krankenkasse (TK)
Bramfelder Straße 140
22305 Hamburg, Germany

Contact details of the data protection officer

Techniker Krankenkasse
Beauftragte für den Datenschutz
Data protection officer
Bramfelder Str. 140
22305 Hamburg, Germany
E-mail: datenschutz@tk.de

2. What data is required to use the TK Bonus Plan? For what purpose and on what legal basis is the data processed?

In the following, we would like to inform you about the data that is collected, processed and stored for the TK Bonus Plan, and the legal basis on which this is done.

2.1 Legal basis

Where personal data is collected, this is done exclusively on a legal basis. For participation in and the operation of the TK Bonus Plan, this is Section 67b(1), first sentence, of SGB X [German Social Code] in conjunction with Section 65a of SGB V. If you wish to use the TK Bonus Plan, we will collect and store only the data necessary to enable you to do so. The data stored will be used only for the purposes stated. To assess your eligibility for a bonus, we use only the data that you have provided to us for this purpose.

2.2 Intended uses

We process your data for the following purposes:

to provide the service; in particular, to enable registration for the TK Bonus Plan, participation in challenges and the submission of activities in the form of evidence

to settle submitted activities and participation in challenges

to communicate with participants

to ensure the quality of the service

to compile anonymised statistics, in particular to improve the service or to provide authorities with evidence of the economic justification for this offer

2.3 Personal data

Personal data is any information relating to an identified or identifiable individual. This includes the following categories of personal data that are processed:

Contact details and, where applicable, address details (such as first name and family name, postal address, e-mail address and telephone number), provided you have supplied us with your contact details, as well as your insurance number.

Correspondence with TK, where contact had been made with TK.

The following information is collected when registering for the TK Bonus Plan

the date and time of the application to join

the communication channel

the age group

the applicable bonus plan based on the currently valid TK Statutes

the start and end dates of participation

When an activity is submitted, the following details are processed:

the date on which the activity was sent to TK

the channel through which the activity was submitted

the specific activity in question

the date of the treatment or the end of the course

TK’s decision whether a bonus can be awarded. If a bonus cannot be awarded for the activity, the reason for this is also recorded.

The following information is collected for the purposes of settlement:

the type and amount of the health bonus

the bank details (where provided)

the channel through which the settlement request was submitted

the date on which eligible activities were settled

2.3.1 Optional consent to the use of activity data in the TK-App

Subject to consent, the following personal data may also be processed:

Date of consent

Start and end date of individual fitness activities. These are deleted if the activity is cancelled.

Successful and unsuccessful weekly targets

Active and expired promotional codes from partner companies

Knowledge tests completed per challenge

Pseudonymised user ID of the fitness tracker

Selected external data sources

Date on which the data sources were changed

In order to provide relevant data sources on the use of activity data, as well as further support and motivational services, we have commissioned the company mHealth Pioneers GmbH and its Thryve service.

mHealth Pioneers GmbH
Körtestraße 10
10967 Berlin, Germany
info@thryve.de
thryve.health

Thryve, provided by mHealth Pioneers GmbH, offers an interface that includes a wide range of data sources and trackers which can be used in the TK Bonus Plan. mHealth Pioneers GmbH stores, on our behalf, only the activity data and the achievements attained in the form of badges and medals that are required for the Plan's use.

Once consent has been given, Thryve will do the following:

Registration is carried out using an automatically generated and pseudonymised user ID.

The activity data (e.g., steps) required for functionality is retrieved from the relevant data source account (e.g., Garmin, Apple Health, etc.) and stored by Thryve. Any additional activity data that the relevant provider may transmit to Thryve, and which is not relevant to the TK Bonus Plan, is deleted by Thryve immediately.

To ensure that existing activity data can be displayed seamlessly in the TK Bonus Plan, Thryve can retrieve activity data retrospectively for a period of up to 3 months after the initial connection. This is not possible for the Polar data source.

For certain data sources, it is not possible to transfer activity data directly between the data source and Thryve. For this reason, the connection is established via the TK-App. To do this, the transfer is carried out automatically in the background at regular intervals. This is only required for the following data sources:

Apple Health

Health Connect

Samsung Health

Note: The actual activity data (steps, duration and distances) is not transmitted to TK, but is only displayed temporarily on the smartphone.

2.3.1.1 Withdrawal of consent to the use of activity data in the TK-App

Consent to the use of activity data is voluntary and may be withdrawn at any time. Withdrawal of consent whilst a challenge is in progress will result in immediate termination of the challenge, and any rewards earned will no longer be taken into account. Participation in TK challenges is not possible without consent.

You may exercise your rights to rectification, access, restriction and erasure at any time by contacting TK.

2.4 When is the data deleted?

TK is obliged to retain the data resulting from the TK Bonus Plan for 10 years. Once these 10 years have elapsed, the data will be deleted.

2.4.1. Where consent has been given for the use of activity data in the TK-App

In the event of a withdrawal of consent to the use of activity data, all data will be automatically deleted from Thryve.

All data held by Thryve is also automatically deleted if no data has been accessed for 3 months - in other words, if the TK Bonus Plan has not been accessed for 3 months.

3. Third parties, source of data, processing in third countries, automated decision-making, profiling

All data processed is collected exclusively directly from the data subjects and is not passed on to any third parties. No processing takes place in so-called third countries (countries outside the EU).

Furthermore, no automated decision-making or profiling takes place in accordance with Article 22(1) and (4) of the GDPR.

4. General rights of data subjects

Consent that has been given may be withdrawn at any time with effect for the future (Article 7(3) of the GDPR).

In addition, you have the following rights:

To request information regarding the categories of data processed, the purposes of processing, any recipients of the data, and the intended retention period (Article 15 of the GDPR);

to request the rectification or completion of inaccurate or incomplete data (Article 16 of the GDPR);

in certain cases, to request the erasure of data under Article 17 of the GDPR - in particular where the data is no longer necessary for the intended purpose, or is being processed unlawfully, or where consent has been withdrawn;

to request the restriction of data under certain conditions, where erasure is not possible or the obligation to erase is disputed (Article 18 of the GDPR);

the right to data portability; that is to say, the data provided may be received in a commonly used machine-readable format, such as CSV, and, where appropriate, transferred to others (Article 20 of the GDPR), as well as

the right to lodge a complaint with a supervisory authority (Article 77 of the GDPR). The contact details of the supervisory authorities are set out below.

5. Contact details of the relevant supervisory authorities

Der Bundesbeauftragte für Datenschutz und die Informationsfreiheit
The Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Str. 153
53117 Bonn, Germany
poststelle@bfdi.bund.de or poststelle@bfdi.de-mail.de

6. Amendments or changes to the privacy policy

This privacy policy is currently valid and is dated 1 September 2026.