Privacy state­ment for the TK-Doc app

As a TK insuree, the TK-Doc app offers various possibilities for you to contact the "TK-MediCall" doctors (chat, video chat, e-mail and telephone) and ask any medical questions you may have.

You can also access a wide range of healthcare services to receive remote medical treatment (TK online consultation) or obtain information on laboratory results (LabTester) and diagnoses (ICD codes). There is an additional privacy statement for the "Symptom Checker", which you must agree to separately when using this function.

You can find more information about each service in the app.

1. Controller 

The following party is responsible for collecting, processing and using personal data within the TK-Doc app: 

Techniker Krankenkasse
Bramfelder Str. 140
22305 Hamburg
Germany
Tel.: 0800 - 285 85 85
E-mail: service@tk.de

TK has commissioned the following company to host the app:

ife Gesundheits-GmbH
Gut Nehmten
24326 Nehmten
Germany
Tel.: +49 4526 - 381-0
E-mail: ife@telearzt.de

2. Installation of the TK-Doc app 

The app is available on third-party sales platforms (app stores). Before downloading the app, you may have to register with the relevant app store and install the app store software. Techniker Krankenkasse (TK) has no control over the collection, processing and use of personal data when you register and download content from the relevant app store or app store software. This is the sole responsibility of the company that operates the app store in question. If necessary, please contact that company directly.

3. Necessary permissions

The permissions listed below are disabled by default; you will have to activate them if you would like to use certain features of the app. You can also activate / disable these permissions at any time by changing the settings on your smartphone. 

3.1 Access to network information

Network access is required because the app can only be used online.

3.2 Access to camera / microphone

The video function is offered by an external provider, Red Medical. If you want to use this feature, Red Medical will have to access your camera and microphone. In the chat, you can take a photo in the app and send it to the "TK-MediCall" doctors. Your camera will have to be accessed for this purpose.

3.3 Access to camera roll

Your camera roll will have to be accessed if you would like to send the "TK-MediCall" doctors a photograph saved on your smartphone.

3.4 Access to telephone

If you choose to contact a doctor by phone, the app will require the relevant permission to access your telephone.

3.5 Push notifications

The app can send you push notifications when you receive a new chat message, when your session has expired or when your results are available for the Symptom Checker. You will have to allow push notifications for this purpose.

4. Protection of minors

You must be at least 16 years of age to use the TK-Doc app. Your age will be verified by comparing your insurance number and date of birth with the insurance data held by TK. 

5. Data required to use the service

Details of how your data are processed via the TK-Doc app are given below.

5.1 Configuration data

Once you have installed the TK-Doc app, you will have to enter the following configuration data: insurance number, date of birth and password. This configuration data are required for the app to work. Your insurance number and date of birth will help to clearly identify that you are insured with TK. This information has to be entered when you first launch the app. Whenever you log in after that, a technically generated code (hash value) will be used for identification purposes. This will be stored locally in a secure area of the app. 

You will have to set a password to prevent the app from being accessed by unauthorised third parties. You can choose to save your password locally in a secure area of the app or re-enter it every time you log in.

5.2 Medical advice, information on health complaints as part of the TK online consultation, laboratory results and ICD codes (chat, video chat, e-mail, TK online consultation, LabTester, ICD code search)

You can use the app to discuss any medical questions you might have with the "TK-MediCall" doctors and to obtain more information on your laboratory results or ICD codes. To able to use the online consultation service, you must provide information about your health problems in preparation for the doctor's consultation. All aspects of the medical advice you receive, the information about your health problems, your laboratory results and the ICD codes will be sent to ife Gesundheits-GmbH using secure end-to-end encryption.

5.3 Registration data for the TK online consultation

If you wish to access the TK online consultation, you have to register via "Meine TK". To do this, please log in with your username / insurance number and password. These data will help to confirm your identity. As an additional security step, you must have registered your phone number for the smsTAN service.

You can find the German-language privacy statement for "Meine TK"  here .

5.4 Data collected when using push notifications

Even when you are not using the app, you can be notified of new text messages in the chat, about expiry of the session and when your results are available in the Symptom Checker. For this, your smartphone will be registered with the relevant push service ("Apple Push Notification" or "Firebase Cloud Messaging") after it has been configured. The service will then send a token to your device. The token will be sent from the TK-Doc app to ife and then stored in a database. Whenever there is a new notification for you, ife will send the message with the token to the push service, which will forward the message to your device. 

5.5 User surveys

TK offers you the opportunity to take part in surveys. You are free to choose whether to participate in such surveys. TK does not conduct the surveys itself, but uses the services provided by Netigate GmbH, 60329 Frankfurt am Main, Germany (Netigate). If you choose to participate in a survey, you will be redirected from the TK-Doc app to the Netigate website. TK will not provide Netigate with any of your personal data. Your survey responses will remain anonymous unless you provide personal data in the response fields.
 

6. Do TK, ife Gesundheits-GmbH or other companies receive data and for what purpose?

The companies listed below will receive and process the data you provide in the TK-Doc app for specific purposes. More detailed information about the purposes and recipients is provided below:

6.1 ife Gesundheits-GmbH:

ife Gesundheits-GmbH will receive your insurance number and date of birth or the hash value used to confirm your identity. In addition, medical content will be transmitted for the purpose of providing you with information and for providing details of your health problems in preparation for the doctor's online consultation. As ife Gesundheits-GmbH is obliged to keep medical records in accordance with Section 10 of the Model Professional Code for Physicians in Germany (MBO-Ä), these data will be stored on its local server. TK will not receive any information on such medical content.

6.2 Apple and Google

For security reasons (to prevent the misuse of the app), a unique code will be assigned to each of your devices when you install the app on iOS or Android ("device token" or "instance ID"). These codes will be transferred to the Apple or Google server to check whether the request comes from an app that has been installed from a certified app store. No further data (e.g. IP address) will be transmitted. 

6.3 Techniker Krankenkasse

Your insurance number will be forwarded to TK to confirm that you are an insuree. In addition, ife Gesundheits-GmbH will provide TK with the following billing-relevant contact details:

• Insurance number
• Time of contact
• Means of contact (chat, video chat, telephone or e-mail)

TK will receive the following anonymous data for the purpose of improving its services: 

• Number of enquiries received via each channel (chat, video chat, telephone and e-mail)
• Time of day at which enquiries are received via each channel
• Duration of contact via each channel (except e-mail)
• Medical reason for enquiry via each channel
• Number and type of channel changes
• Service level (chat and video chat)
• Number and type of errors (crash reports)
• Number and type of complaints

6.4 Red Medical Systems GmbH

The technical aspects of the video chat service are implemented using the RED Connect system from Red Medical. RED Connect is listed by the National Association of Statutory Health Insurance Physicians (KBV) as a certified video service provider. In order to create the video link used to access the video room with the doctor, the date of your appointment will be sent to Red Medical when you request an appointment.

6.5 Additional important information

Whenever your data are sent from the TK-Doc app to the recipients described above (and vice versa), a state-of-the-art SSL encryption method will be used. Your international mobile equipment identity (IMEI), which enables you to be uniquely identified as the owner of your device, will not be recorded by the app.
 

7. Data collection for analysis purposes and troubleshooting

Data are collected in the TK-Doc app to ensure error-free provision of the app (crash reports) and to further develop the app in line with demand (app analysis). The information collected is stored exclusively on servers in Germany. You can change your consent to or rejection of the analysis to ensure error-free operation and demand-oriented further development in the app settings under "App analysis".

7.1  Analysis to ensure trouble-free operation (crash reports) 

TK uses crash reporting to ensure the error-free operation of the TK-Doc app. Crash reporting ensures that if an error occurs, it can be subsequently traced to find out where this occurred and thus determine the cause thereof.

The following data are collected:

• User ID (UUID, generated during registration)
• Time of access
• Features used (chat, video chat, telephony, etc.)
• Operating system used

7.2 Analysis for demand-oriented further development (app analysis)

In order to further develop the app in line with demand, TK uses the open source tool Matomo. Matomo stores the data in pseudonymised form in the Matomo cloud. Neither Matomo nor other third parties have access to personal data. 

The following data are collected:

• Date and time of access
• A technical code (random pseudonymised tracking ID), which does not contain any information about your person and is valid for the duration of your current registration in the app. This code is stored in an encrypted database in your app. The code is deleted as soon as the app is reset or deleted.   
• Technical data about your device such as operating system, app version 
• Content and functions accessed

The following is recorded for the app analysis: 

• User navigation through the app  
• Number of users by days and months
• Frequency of use in hours
• Number of users by operating system
• Number of users by app version
• Usage patterns in certain features (lab value checker, online consultation, video consultation, chat, symptom checker, ICD code search, call, doctor feedback)

The processing, storage and evaluation of the data from the app analysis are carried out in such a way that it is not possible to draw conclusions about your person. The evaluation is only available in aggregated, anonymised form (e.g. "50% of users in the month of May who used the TK-Doc app use the Android operating system").

Data processing for the above-mentioned app analysis is based on the legal provisions of Art. 6 (1) p. 1 lit. f GDPR. In this case, our legitimate interest is the optimisation of our TK-Doc app.

7.3 Feedback function

When using the integrated feedback function, anonymous data, which are required for subsequent troubleshooting, are also sent. These details are sent:

• Optional e-mail
• Date and time
• TK-Doc version

When writing your feedback, please ensure that it does not contain any personal details and/or social data. All feedback is sent to us in the form of an encrypted text message and is stored for the duration of the feedback review and then deleted. Please note that you will therefore not receive a reply from us. If you wish to receive a reply, you have the option of entering your e-mail address.

Beyond this, we do not use any analysis options.

8. Retention and deletion of data 

8.1 Retention periods during active use

ife Gesundheits-GmbH is obliged to keep medical records. This obligation is stipulated in Section 57 (1) of the Basic Agreement for Physicians and Dentists in Germany (BMV-Ä) and Section 10 of the Model Professional Code for Physicians in Germany (MBO-Ä). Accordingly, the content of any medical advice you receive will be stored by ife Gesundheits-GmbH in a personalised form for 10 years. 

In addition, ife will continue to store your access data (hash value) for one year after you have stopped using the app.

Your chats and sessions in the Symptom Checker will be automatically closed and deleted 30 minutes after being launched. Similarly, your Symptom Checker results will only be displayed within the app for 30 minutes. 

8.2 Deletion of your data 

All the data within the app will be deleted when you uninstall the app on your device or as soon as you reset the app. To do this, please use the corresponding function in the app settings. 

In accordance with the instructions of the app store operator Google, you can have your account deleted at any time and regardless of the above-mentioned app function. To do this, please send an e-mail stating your insurance number and the request "Account deletion" to gesundheitsapps@tk.de. Your data will then be deleted from the servers.

However, the content of medical advice is subject to the retention periods described in 8.1.

9. Your rights

You have the following rights, which you can assert exclusively via TK:

a)    Right of access (Art. 15 GDPR)
b)    Right to rectification (Art. 16 GDPR)
c)    Right to erasure (Art. 17 GDPR)
d)    Right to restriction of processing (Art. 18 GDPR)
e)    Right to object (Art. 21 GDPR)

The right to data portability (Art. 20 GDPR) does not apply to the TK-Doc app, because users cannot enter any other data besides the configuration data.

The app is not used for profiling or scoring (Art. 22 GDPR).

10. Communication channels

You can use the feedback function to contact ife Gesundheits-GmbH. You can also use the contact details indicated in Section 1.

You can contact TK via the following e-mail address: versorgungsmanagement@tk.de.

11. Contact details of data protection officers and supervisory authorities:

ife Gesundheits-GmbH - data protection officer

Compolicy GmbH
Dr Christian Wolff
Schwedenkai 1
24103 Kiel
Germany
+49 431-90891636
E-mail: datenschutz@telearzt.de

Supervisory authority

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
Holstenstraße 98
24103 Kiel
Germany
Tel.: +49 431 988-1200 

TK’s data protection officer

Techniker Krankenkasse
Beauftragter für den Datenschutz
Bramfelder Str. 140
22305 Hamburg
Germany
E-mail: datenschutz@tk.de

Supervisory authority

Bundesbeauftragte für Datenschutz und die Informationsfreiheit 
Husarenstr. 30
53117 Bonn
Germany
E-mail: poststelle@bfdi.bund.de or poststelle@bfdi.de-mail.de

12. Changes to this privacy statement

This privacy statement is currently valid and dated 16 October 2023. However, it may have to be updated to account for the development of our app or the implementation of new technologies.