This page contains two separate sets of terms. Choose the one that applies to you.
Welcome to our website and thank you for your interest in our company. We take the protection of your personal data very seriously. We process your data in accordance with the applicable legal provisions for the protection of personal data, in particular the EU General Data Protection Regulation (EU GDPR) and the country-specific laws applicable to us. With the help of this privacy notice, we inform you comprehensively about the processing of your personal data by ONCARE GmbH (hereinafter referred to as "Oncare") when using our website and the rights to which you are entitled.
Personal data is any information that makes it possible to identify a natural person. This includes, in particular, your name, date of birth, address, telephone number, email address and IP address. Data is considered anonymous if no personal reference to the individual/ user can be made.
Postal address:
Balanstrasse 71a
81541 Munich
E | service@myoncare.com
Contact info of the data protection officer
privacy@myoncare.com
Last updated on 23 May 2024.
We would first like to inform you of your rights as a data subject. These rights are set out in Articles 15 – 22 GDPR, and include:
To exercise these rights, please contact: privacy@myoncare.com. The same applies if you have any questions regarding data processing at our company or when you withdraw your consent. You also have the right of appeal to the relevant data protection supervisory authority.
Please note the following with respect to your right to object:
When we process your personal data for the purpose of direct marketing, you have the right to object to this data processing at any time without providing the reasons for such objection. This also applies to profiling insofar as it is associated with direct marketing.
If you object to the processing for direct marketing purposes, we will no longer process your personal data for such purposes. The objection is free of charge and can be made in any form, if possible to: privacy@myoncare.com
Should we process your data to protect legitimate interests, you may object to such processing at any time for reasons that arise from your specific situation; this also applies to profiling based on these provisions.
We will then cease to process your personal information unless we can demonstrate compelling legitimate grounds for processing such information that outweigh your interests, rights and freedoms, or the processing is intended to assert, exercise or defend legal claims.
The processing of your personal data complies with the provisions of the EU GDPR and all other applicable data protection regulations. Legal bases for data processing arise in particular from Art. 6 GDPR.
We use your data to initiate business, to fulfil contractual and legal obligations, to conduct the contractual relationship, to offer products and services and to consolidate customer relationships, which may include marketing and direct marketing.
Your consent also constitutes permission to data processing under data privacy law. In this respect, we will inform you of the purposes of data processing and your right of objection. If the consent also relates to the processing of special categories of personal data, we will explicitly notify you in the consent process.
In many cases, service providers assist our specialist departments to fulfil their tasks. The necessary data protection contracts have been concluded with all service providers.
Processing of special categories of personal data within the meaning of Art. 9 (1) GDPR may only take place where necessary on the grounds of legal regulations and there is no reason to assume that your legitimate interests should prevail to the exclusion of processing such data or you have given your consent to the processing of these data according to Art. 9 (2) GDPR.
Google services may transfer data to countries outside the EU/EEA (third country data transfer), e.g. to the USA, as part of the processing for the aforementioned purposes. Countries outside the European Economic Area may not offer a level of data protection comparable to that in Europe. Such countries for which the Commission has not explicitly determined that they provide an adequate level of protection with respect to data privacy are referred to as "unsafe third countries." There is an increased risk that government authorities may access this data. We have no influence on these processing activities.
We will only transmit your data to third parties within the scope of given statutory provisions or based on consent. In all other cases, information will not be transferred to third parties unless we are obliged to do so owing to mandatory legal regulations (disclosure to external bodies, including the supervisory authorities or law enforcement authorities).
In our organisation, we ensure that only individuals who are required to process the relevant data to fulfil their contractual and legal obligations are authorised to handle personal data.
A transfer of data to third countries (outside the European Union or the European Economic Area) shall only take place if required by law or if you have provided your consent for such a transfer.
We transfer your personal data to service providers or group companies outside the European Economic Area as follows: United States of America.
In such cases, compliance with the required level of data protection is ensured by EU standard contractual clauses, the binding corporate data protection regulations of the service provider according to the established data protection contracts.
We store your data for as long as such is required for the relevant processing purposes. Please note that numerous retention statutory periods require that data must be stored for a specific period of time. This relates in particular to retention obligations for commercial or fiscal purposes (e.g. commercial code, tax code, etc.). The data will be routinely deleted after use unless a further period of retention is required.
We may also retain data if you have given us your permission to do so, or in the event of any legal disputes and we use the evidence within the statutory limitation period, which may be up to 30 years; the standard limitation period is 3 years.
We implement the appropriate technical and organisational security measures to ensure the optimal protection of the data stored by us against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. The security levels are continuously reviewed in collaboration with security experts and adapted to new security standards.
The data exchange to and from our website is encrypted. We provide https as the transmission protocol for our website and always use the latest encryption protocols. When you use the contact form on our website to get in touch with us, the content is sent via https to a secure server of Site Ground, where the data of the form is stored in an encrypted database. Site Ground employees do not have direct access to this data.
It is also possible to use alternative communication channels.
A range of personal data is required to establish, implement and terminate the obligation and the fulfilment of the relevant contractual and legal obligations. The same applies to the use of our website and the various functions we provide.
We have summarised the relevant details in the above point. In some cases, legal regulations require data to be collected or made available. Please note that it will not be possible to process your request or execute the underlying contractual obligation without this information.
The data we process is defined by the relevant context: it depends on whether, for example, you enter a request on our contact form or if you want to send us an application or submit a complaint.
Please note that we may also provide information at specific points for specific processing situations separately where appropriate, e.g. when downloading our flyer or when making a contact request.
We collect and process the following data when you visit our website:
Your IP address which is immediately hashed by removing the last two digits. The URL and the title of the page you are viewing. The browser (name) you are using Viewport or viewing pane (the size of the browser window)
Your screen resolution. Whether or not you have Java enabled. The language enabled in your browser. For reasons of technical security (in particular to safeguard against attempts to attack our web server), this data is stored in accordance with Article 6 (1) lit f GDPR. Anonymisation takes place immediately by abbreviating the IP address so that no reference is made to the user.
The provider is Webflow, Inc, 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter referred to as Webflow). When you visit our website, Webflow collects various log files including your IP addresses. Webflow is a tool for creating and hosting websites. Webflow stores cookies or other recognition technologies that are required to display the page, to provide certain website functions and to ensure security (necessary cookies).
Details can be found in Webflow's privacy policy: https://webflow.com/legal/eu-privacy-policy.
Webflow is used on the basis of Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in displaying our website as reliably as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art.6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://webflow.com/legal/eu-privacy-policy.
We use Sendgrid for sending emails. The provider is Sendgrid Inc., 1801 California Street Suite 500, Denver, CO 80202, USA. Sendgrid is a service with which the sending of emails can be organized. Sendgrid is used to send confirmation emails, transaction confirmations and emails with important information regarding existing requests. The data you enter for the purpose of receiving emails is stored on Sendgrid’s servers. When we send email on your behalf through SendGrid, we use an SSL secured connection.
For the purpose of analysis, the e-mails sent with SendGrid contain a so-called “tracking pixel”, which connects to Sendgrid’s servers when the e-mail is opened. By this, it is possible to determine whether an email message has been opened.
Legal basis: The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time. The legality of the data processing operations already carried out remains unaffected by the revocation.
Storage period: The data you provide us for the purpose of receiving emails will be stored by us until you unsubscribe from our services and will be deleted from our servers as well as from the servers of Sendgrid after you unsubscribe.
Please note that your data is usually transmitted by us to a SendGrid server in the USA and stored there. We have concluded a contract with Sendgrid incorporating the EU standard contractual clauses. This ensures that a level of protection comparable to that in the EU exists.
SendGrid (Privacy Policy): https://sendgrid.com/resource/general-data-protection-regulation-2/
We use Google Fonts provided by Google Inc on our website. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for the European area. We have embedded the Google fonts locally, on our web server – not on Google’s servers. This means that there is no connection to Google servers and therefore no data transfer or storage. This is an interactive directory of over 800 fonts that Google provides free of charge. To prevent any information transfer to Google servers, we have downloaded the fonts to our server. In this way, we act in a privacy compliant manner and do not send any data to Google Fonts.
We use the consent management service Cookiebot, from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (Usercentrics). This enables us to obtain and manage the consent of website users for data processing. The processing is necessary to fulfill a legal obligation (Art. 7 para. 1 GDPR) to which we are subject (Art. 6 para. 1 sentence 1 lit. c GDPR). For this purpose, the following data is processed with the help of cookies.
Your IP address (the last three digits are set to '0'). Date and time of consent. Browser information URL from which the consent was sent. An anonymous, random and encrypted key Your consent status of the end user, as proof of consent
The key and consent status are stored in the browser for 12 months using the "CookieConsent" cookie. This retains your cookie preference for subsequent page requests. With the help of the key, your consent can be verified and tracked.
If you enable the "bulk consent" service feature to enable consent for multiple websites through a single end-user consent, the service will additionally store a separate, random, unique ID with your consent. If all of the following criteria are met, this key is stored in the third-party cookie "CookieConsentBulkTicket" in your browser in encrypted form: You activate the bulk consent function in the service configuration. You allow third-party cookies via browser settings. You have deactivated "Do not track" via the browser settings. You accept all or at least certain types of cookies when you give your consent.
The functionality of the website is not guaranteed without the processing.
Usercentrics is the recipient of your personal data and acts as a processor for us.
The processing takes place in the European Union. Further information on objection and removal options vis-à-vis Usercentrics can be found at: https://www.cookiebot.com/de/privacy-policy/
Your personal data will be deleted on an ongoing basis after 12 months or immediately after termination of the contract between us and Usercentrics.
Please note our general information on the deletion and deactivation of cookies above.
We collect and process the following data as part of a contact request:
A contact form is available on our website which can be used to contact us electronically. If you write to us using the contact form, we will process the data you submitted in the contact form to respond to your queries and requests.
In so doing, we respect the principle of data minimisation and data avoidance, such that you only have to provide the information we require to contact you, which is your name, salutation, email address and the type of your request. Your IP address will also be processed (and hashed immediately) for technical reasons and for legal protection. All other data is voluntary, and additional fields are optional (e.g. to provide a more detailed response to your questions).
If you contact us by email, we will process the personal information provided in the email solely for the purpose of processing your request.
We process the following data as part of a job application you send us:
We collect and process the following data in the context of job applications:
Last name, first name (maybe also title)
Address
Contact details (telephone number, e-mail address)
If applicable, contact data in electronic communication solutions (e.g. Skye, MS Teams) that you submit to us
Qualification data (CV, professional qualifications, work experience)
In addition, we use data that we have permissibly obtained from publicly accessible directories (e.g. professional networks).
Thank you for your interest in working for Oncare GmbH. We are aware of the importance of your data and process the personal data you provide us only for the purpose of effective and correct processing and for contacting you as part of the job application process. The data will not be transferred to third parties without your consent.
You will be asked to provide personal information. We observe the principle of data economy and data avoidance by only requiring you to provide us with data that we need to review your job application documents, such as your CV, or that we are legally obligated to collect. To protect the security and confidentiality of your data, we implement appropriate security measures. In addition, we recommend that you send us your application documents in “zipped” form (e.g. 7z or .zip) with password protection by e-mail. Afterwards, please give us the password by telephone. Alternatively, you can also send us your application documents by post mail. We store your data for the above-mentioned purposes until the application process has been completed and related deadlines have expired – at the latest six months after receipt of a decision.
If your job application is unfortunately unsuccessful, your data will be deleted by us within six months of rejection. If your application is successful, your application documents will be included on the HR files and will only be deleted after you have left the company and statutory retention periods have expired.
We are supported by our service provider JOIN Solutions GmbH (hereinafter “Join”) in carrying out the application process. For this purpose, we use a widget of the provider JOIN, Schönhauser Allee 36, 10435 Berlin, Germany. If you apply to a job, your application data will be processed by Join on our behalf as instructed. We have concluded the required data protection agreement with Join for data processing on our behalf, in which Join is obligated to process the data in accordance with the principles of GDPR and in accordance with our instructions.
Join widget: We use a Join widget to display current job offers. Cookies are set by the Join widget. The legal basis for the processing is Art. 6 (1) p. 1 lit. a GDPR.
On our website, we offer the option of (pre)booking appointments via the Calendly tool. By clicking on the "Book your free consultation now" button, you will be redirected to the website calendly.com of the company Calendly LLC, BB&T Tower, 271 17th St NW, Atlanta, GA 30363, USA (hereinafter referred to as "Calendly"). When making an appointment, it is generally necessary to provide personal data; please refer to the form to be completed to find out what this is. When booking an appointment via Calendly, your data entered on the Calendly website will be forwarded to us by Calendly and stored and processed by us in order to carry out the appointment. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b GDPR. With regard to the processing of your data by Calendly itself, we refer you to Calendly's privacy policy, available at: https://calendly.com/pages/privacy.
It cannot be ruled out that your data will be transferred to the USA and thus to an insecure third country. You can find more information on this here: https://calendly.com/pages/security. Calendly's terms of use, which we agreed to when we registered with Calendly, also contain the following data processing addendum: https://calendly.com/pages/dpa with which Calendly promises you additional protection with regard to data transfer to the USA in order to comply with the GDPR requirements. There is currently neither an EU adequacy decision nor any other suitable guarantees for the USA. The protection of your data cannot be guaranteed in the USA.
There is currently no level of data protection in the USA that is equivalent to that in the EU. Therefore, the transfer is associated with corresponding risks. In particular, there are no guarantees that your transferred data will not be accessed by government agencies. For example, it cannot be ruled out that US authorities may access your data on the basis of Section 702 of the Foreign Intelligence Surveillance Act (FISA for short) and/or on the basis of the so-called CLOUD Act (Clarifying Lawful Overseas Use of Data Act). In this context, we would like to expressly point out that, as an EU citizen, you have no effective legal protection against the processing of your data by US authorities. If you book an appointment via Calendly, you do so in full knowledge of these risks, which you thereby consciously accept.
We use "Google reCAPTCHA" (hereinafter referred to as "reCAPTCHA") on our websites. It is also integrated as standard in Calendly. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). The purpose of reCAPTCHA is to check whether the data input on our websites (e.g. in a contact form) is made by a human or by an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent on the website by the website visitor or mouse movements made by the user). The data collected during the analysis is forwarded to Google.
The reCAPTCHA analyses run completely in the background. Website visitors are not informed that an analysis is taking place. reCAPTCHA is only loaded after you have agreed to our essential cookies. Data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its website from abusive automated spying and SPAM.
Further information about Google reCAPTCHA and Google's privacy policy can be found at the following links: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.
Our website contains links to external AI services provided by third parties: ChatGPT (OpenAI), Perplexity, Gemini (Google), Grok (xAI), and Claude (Anthropic). When you click on one of these links, you leave our website and connection data (in particular your IP address and other technical information) is transmitted to the respective provider. In addition, the prompt text provided by us is transmitted as part of the URL. Further processing of your data is the responsibility of the respective provider; their privacy policy applies. Please do not enter any personal or confidential data in the AI services. We do not integrate any AI services on our website and do not transmit any data to these providers without your click.
We do not use purely automated processing to make decisions.
Our website uses “cookies” at various locations, which serve to make our offer more user-friendly, effective and secure. Cookies are small text files that are placed on your computer and stored by your browser (locally on your hard disk). Cookies enable us to analyse how users use our websites so we can design the website content in accordance with the visitor’s needs. Cookies also allow us to measure the effectiveness of a particular advertisement and, for example, to place it based on the user’s interests.
When you first visit our website, a pop-up (CookiePro) opens from which you can give your consent to the use of categories of cookies which are described below as well as in the CookiePro pop-up itself.
The following categories of cookies are used on our website:
Necessary cookies: These cookies are necessary for the website to function and cannot be switched off in our systems. These cookies include for example the ones used by CookiePro (OneTrust) to maintain cookies based on your consent. You can set your browser to block or alert you about these cookies, but some parts of the site will then not work. These cookies do not store any personally identifiable information.
Performance cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site and will not be able to monitor its performance.
Targeting cookies: These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Most of the cookies we use are “session cookies”, which will be automatically deleted after your visit. Persistent cookies are automatically deleted from your computer when their validity period (maximum 14 months) has expired, or you delete them yourself prior to expiry.
In order to revoke your consent to the use of cookies (except for strictly necessary cookies which are always enabled), you can navigate to the footer of the website and deactivate categories of cookies in the CookiePro pop-up via the link ‘Cookies Settings’.
Furthermore, cookies are stored on the user’s computer which then transmits them to us. As a user, you therefore exercise full control over the use of cookies. You can change the settings in your Internet browser to disable or restrict the sending of cookies. In addition, cookies that have already been saved on your computer can be deleted at any time via an Internet browser or other software programs. All this is possible in all the current Internet browsers.
Please note: If you deactivate the placing of cookies on your device, you may not be able to access all our website functions in certain circumstances.
Google Analytics
Based on your consent (Art. 6 (1) lit a EU GDPR) we use Google Analytics, a web analysis service of Google LLC (“Google”). Google uses cookies. The information generated by the cookie about the use of the website by the user is usually transferred to a Google server in the USA and stored there.
Google will use this information on our behalf to evaluate the use of our online offer by users, to compile reports on the activities within this online offer and to provide us with further services associated with the use of this online offer and the use of the Internet. The processed data can be used to create pseudonymous user profiles of the users.
We only use Google Analytics with activated IP anonymisation. This means that the IP address of users is shortened by Google within member states of the European Union or in other states that are parties to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
The IP address transmitted by the user’s browser is not merged with other data from Google. Users can prevent the storage of cookies by adjusting their browser software accordingly; users can also prevent the collection of data generated by the cookie and related to their use of the online offer to Google and the processing of this data by Google as described in section ‘Cookies’ above.
Further information on the use of data by Google, setting and objection options, can be found in the privacy policy of Google and in the settings for the display of advertising by Google.
The personal data of users will be deleted or made anonymous after 12 months.
YouTube-Plugin
Our website uses YouTube plugins, YouTube is operated by Google. The operator is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. When you visit one of our pages equipped with a YouTube plugin, a connection to YouTube’s servers is established. This informs the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surf behavior directly to your personal profile. You can prevent this by logging out of your YouTube account. For more information on the handling of user data, please see YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy
Vimeo
We may have integrated videos from the provider Vimeo LLC, headquartered at 555 West 18th Street, New York, New York 10011. Some of our Internet pages contain videos from Vimeo. When you access such a page on our website, a connection to the Vimeo servers is established. This tells the Vimeo server which of our web pages you have visited. If you are logged in as a member of Vimeo, Vimeo assigns this information to your personal user account. When you click on the start button of a video, this information can also be assigned to an existing user account. You can prevent this assignment by logging out of your Vimeo user account before using our website and deleting the corresponding cookies from Vimeo. We use this service within our online offer on the basis of a legitimate interest - in the analysis, optimization and economic operation of our online offer. The legal basis is Art. 6 para. 1 lit. f.) GDPR.
Further information on data processing and information on data protection by Vimeo can be found at vimeo.com/privacy.
In addition, Vimeo calls up the Google Analytics tracker via an iFrame in which the video is called up. This is Vimeo's own tracking, to which we have no access. You can prevent tracking by Google Analytics by using the deactivation tools that Google offers for some Internet browsers. Users can also prevent Google from collecting the data generated by Google Analytics and relating to their use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout
LinkedIn Insight Tag
Our website uses the conversion tool “LinkedIn Insight Tag” provided by LinkedIn Ireland Unlimited Company. The tool creates a cookie in your web browser that allows the collection of, among other things, the following data: IP address, device and browser properties, and page events (e.g. page views). LinkedIn itself also collects log files (URL, referrer URL, IP address, device and browser properties and time of access). IP addresses are shortened or (if used to reach LinkedIn members across devices) pseudonymized. The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymized data are deleted within 180 days. The data collected by LinkedIn cannot be assigned to specific individuals by us. LinkedIn stores the personal data of the website visitors on its servers in the USA and uses it for its own advertising measures. You can find more detailed information on data protection at LinkedIn in the LinkedIn privacy notices.
The use of LinkedIn Insight is based on Art. 6 para. 1 p. 1 lit. f GDPR.
Oncare GmbH maintains presences in the social medias, especially on Xing and LinkedIn. In case that we have control over the processing of your data, we will ensure that applicable data protection regulations. Below you find the most important information on data protection laws regarding our social media presences.
Name and address of the controller
The following companies are responsible (as controller) for our social media presences, beside Oncare GmbH, according to the EU General Data Protection Regulation (GDPR) and other data protection provisions:
LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
Xing (New Work SE, Dammtorstraße 30, 20354 Hamburg, Deutschland)
However, you use these platforms and their functions on your own responsibility, especially the use of interactive functions (e.g. commenting, sharing, rating). We would also like to point out that your data may be processed outside the European Union.
Purposes and legal basis
We maintain the social media presences in order to communicate with users and to inform them about our products and services. Furthermore, we collect data for statistical purposes in order to develop and optimize our content and to design our products/services more attractive. The data required for this purpose (e.g. total number of page views, page activity and data provided by visitors, interactions) is processed by the social networks and made available to us. We have no influence on the generation and presentation.
In addition, your personal data will be processed by the social media providers for market research and advertising purposes. It is possible that, for example, based on your usage behavior and your interests, usage profiles are created. With the consequence that ads are placed inside and outside platforms that match your interests. Cookies are usually stored on your computer for this purpose. Data that are not collected directly on your end devices may also be stored in your usage profiles. Storage and analysis also takes place across devices; this applies in particular, but not exclusively, if you are registered as a member and logged in your account.
We do not collect or process any further personal data.
The processing of your personal data by Oncare GmbH is based on our legitimate interests to get appropriate information and reach sufficient communication pursuant to Art. 6 (1) p. 1 lit. f. GDPR. If you are asked for consent to data processing, i.e. if you declare your consent by confirming a button or similar (opt-in), the legal basis of the processing is Art. 6 (1) p. 1 lit. a., Art. 7 GDPR.
Your rights / objection option
If you are a member of a social network and do not want the network to collect data about you by our presence and link it to your social media membership data with the respective network, you must
log out of the social network before visiting our social media site,
delete the cookies present on the device and
close and restart your browser.
After logging in again, however, you will once more be recognizable to the network as a specific user. For a detailed description of the processing and the possibilities to object (opt-out), we refer to the following information:
LinkedIn
Privacy Statement: https://www.linkedin.com/legal/privacy-policy
Opt-Out: https://www.linkedin.com/legal/cookie-policy and https://www.youronlinechoices.com
You have the following rights regarding the processing of your personal data:
The right of access, right to rectification, right to erasure / right to be forgotten, right to restriction of data processing, right to data portability, right to object to data processing and the right to file a complaint about unlawful processing of your personal data with the competent data protection authority. As Oncare does not have full access to your personal data, you should contact the social media provider directly if you wish to assert your claim, because your provider has access to the personal data of the users and can take appropriate measures and provide information. If you still need help, we support you.
Please contact privacy@myoncare.com
Persons under the age of 16 may not submit personal data to us or give a declaration of consent without the authorisation of their legal guardian. We encourage parents and guardians to actively participate in the online activities and interests of their children.
Our website also contains clearly identifiable links to the Internet sites of other companies. Although we provide links to websites of other providers, we have no influence on their content, and no guarantee or liability can therefore be assumed for such. The content of these pages is always the responsibility of the respective provider or operator of the pages.
The linked pages were checked at the time of linking for potential legal violations and identifiable infringements. No illegal content was identified at the time of linking. However, a permanent content control of the linked pages is not reasonable without concrete evidence of an infringement and, upon notification of a violation of rights, such links will be promptly removed.
For access requests, objections or to withdraw a consent, please contact our Data Protection Officer.
For older versions: Archive
STATUS MARCH 2026
Welcome to myoncare, the digital health platform for efficient and needs-based patient care of Oncare GmbH (hereinafter “ONCARE” or “we”, “we”, “our”).
For us, the protection of your privacy and all personal data is of great importance and significance.
We are aware of the responsibility arising from the processing of your personal data in the myoncare Careplan Manager (also “myoncare platform” or “platform”). Our technology systems used for the myoncare services are therefore set up to the highest standards, and the lawful processing of data is at the center of our ethical understanding as a company.
Please note that this privacy policy consists of two parts:
We process your personal data in accordance with the applicable legal provisions for the protection of personal data, in particular the EU General Data Protection Regulation (“GDPR”) and the country-specific laws applicable to us. In this privacy policy you will learn why and how ONCARE processes your personal data that we collect from you or that you provide to us when you decide to use the myoncare Careplan Manager. In particular, you will find a description of the type of personal data we collect and process, as well as the purpose and basis on which we process the personal data; in addition, you will find the rights to which you are entitled here.
Please read the privacy policy carefully to ensure that you understand each provision. After you have read the privacy policy, you have the option to consent to the processing of your personal data as described in the privacy policy.
“App user” is any user of the myoncare app (your patient).
“Careplan provider” means you or another service provider or third party (e.g., medical device manufacturers, pharmaceutical companies) who makes care plans available to other users of the platform via the myon.clinic Store or other means of data exchange.
“Careplan user” means you or another service provider (platform user) who uses a care plan (“Pathway”) for the treatment of its registered patients.
“Caretasks” are specific tasks or actions within a Pathway that must be carried out by the participating healthcare providers, nursing staff, or the patient themselves.
“Privacy policy for healthcare providers” means this policy made available to you as a user of the myoncare Careplan Manager and describing how we collect, use and store personal data, and informing you about your comprehensive rights. “Privacy policy for patients” means the privacy policy describing the processing of patients’ personal (health) information who use the myoncare app. According to the terms of use, our offer is directed only at persons aged 18 and over. Accordingly, no personal data of children and adolescents under 18 is stored and processed.
“Healthcare provider” means you or another physician, clinic, healthcare facility, healthcare professional, or any other medical or non-medical provider of health, prevention, advisory, or care services acting either independently or on behalf of you or another such provider (intended user).
“Terms of use” means the terms of use for using the myoncare Careplan Manager.
“myoncare app” means the mobile and web app myoncare application for patients who wish to use the services offered by ONCARE via the app.
“myon.clinic Store” is the web shop operated by myon clinic GmbH in which digital care concepts (“Pathways”) can be offered.
“myoncare tools” means the myoncare app and the myoncare Careplan Manager together.
“myoncare PWA” means the browser-based myoncare Progressive Web App application for patients who wish to use the services offered by ONCARE via the PWA and not via the myoncare mobile app.
“myoncare platform” is the myoncare Careplan Manager intended for professional use by platform users and serving as an interface between platform users and app users.
“myoncare services” means the services, functionalities and other offerings that are offered or may be offered to platform users via the platform and/or to app users via the myoncare app.
“ONCARE” means ONCARE GmbH, Germany.
“Pathway” is a standardized treatment plan consisting of several, if applicable, sequential Caretasks that can define the steps for diagnoses and therapies.
“Platform user” means you or another service provider who uses the web-based myoncare platform.
The processing of personal health data takes place exclusively on behalf of the respective healthcare provider within the scope of medical care.
This does not apply to data that has been fully anonymized so that no personal reference exists anymore and re-identification is excluded.
ONCARE is entitled to use such anonymized and aggregated data independently of the respective healthcare provider for research, statistics, quality, regulatory and commercial purposes and to disclose or sell it to third parties.
Oncare GmbH, a company registered with the Local Court of Munich under registration number HRB 219909 and having its registered office at Balanstraße 71a, 81541 Munich, Germany, offers and operates the interactive web portal (for medical professionals), the “myoncare platform”, the myoncare PWA and the mobile application myoncare app (for patients) as access to the myoncare services.
This privacy policy applies to all personal data processed by ONCARE in connection with the use of the myoncare Careplan Manager by the healthcare provider.
Data protection between you, the healthcare provider, and your patient must be regulated by you. A separate privacy policy applies to patients’ use of the myoncare app and PWA: https://www.myoncare.com/privacy-policy
“Personal data” means all information that makes it possible to identify a natural person. This includes, among other things, your first name, your last name, your date of birth, your address, your telephone number, your e-mail address and your IP address.
“Health data” are personal data relating to the physical and mental health of a natural person, including the provision of health services, which reveal information about their health status.
Data are to be regarded as “anonymous” if no personal reference to the person/user can be established.
In contrast, “pseudonymized” data are data from which a personal reference or personally identifiable information is replaced by one or more artificial identifiers or pseudonyms, but which can generally be re-identified by the identifier key. (within the meaning of Art. 4 No. 5 GDPR).
We may process the following categories of data about you when using the myoncare platform:
Operational data: Personal data that you provide to us when registering on our myoncare platform, when contacting us about problems with the platform, or in other interactions with us for the purpose of using the platform.
Treatment data: You collect personal data of your patients, such as first name, last name, age, height, weight, indication, disease symptoms and other information in connection with the treatment of your patients (e.g., in a care plan) on the myoncare platform. Activity data of your connected patients are made available to you in your myoncare platform.
Commercial Store data: Personal data processed in connection with the use of the myon.clinic Store – in particular in connection with authorship, configuration or the acquisition of digital treatment plans (“Pathways”). The Store is operated by myon.clinic GmbH, a subsidiary of Oncare GmbH. Use of the Store requires the processing of your first name, last name, professional contact details as well as, if applicable, payment data (only for paid content).
Activity data: Personal data processed by us when an app user connects the myoncare app with a health application (e.g., AppleHealth, GoogleFit, Withings). The activity data of your connected patients are made available to you in your myoncare platform.
Analysis of anonymized usage data to improve the platform: We process exclusively anonymized, non-personal technical usage data (e.g., aggregated information on frequency of use or system performance) in order to further develop the functionality and user-friendliness of the platform. This data contains no identifying information and does not allow conclusions about individual platform users. Processing of personal data of healthcare providers for research or commercial purposes does not take place.
Data from device manufacturers or laboratories: In addition, within integrated care processes, personal data may be processed by connected medical device manufacturers or laboratory service providers, provided these are commissioned or used by the healthcare provider via the myoncare platform.
Product safety data: Personal data processed to fulfill our legal obligations as the manufacturer of the myoncare platform as a medical device. In addition, your personal data may be processed if you report an incident in order to ensure legal compliance or vigilance of medical device or pharmaceutical companies.
Reimbursement data: Personal data required for the reimbursement process.
If you, as a healthcare provider, are a contact person for the operation of the myoncare platform at your location/practice (e.g., IT administrator, appointed medical professional), you may provide us with certain personal data when contacting us in order to understand or discuss the functions and use of the myoncare platform, or in the event of a service request.
In the event of a service request, the following personal data may also be viewed by authorized ONCARE employees:
Your personal data that you provided to us for registration and/or login on our myoncare platform (e.g., first name, last name, date of birth, profile picture, contact details).
Authorized ONCARE employees who are permitted to access your database for the purpose of processing a service request are contractually obliged to treat all personal data as strictly confidential.
As part of your support through myoncare, we would like to inform you how we handle notifications and important information that we provide to you.
Why we do this: Our goal is that you are always informed about your tasks and important updates in order to optimally support your care. E-mails are a reliable way to ensure that important information reaches you even if push notifications are disabled.
In the processing of operational data, ONCARE acts as the data controller responsible for the lawful processing of your personal data.
Types of data: Name, e-mail address, date of registration, your IP address, pseudo keys generated by the platform.
The myoncare platform uses the Google Maps API to use geographic information. When using Google Maps, Google also collects, processes and uses data about the use of the map functions. More information about the scope, legal basis and purpose of data processing by Google as well as the storage period can be found in Google’s privacy policy.
Purposes of processing operational data: We use operational data to maintain the functionalities of the myoncare platform and, if necessary or initiated directly by you, to contact you (e.g., in the event of changes to the General Terms and Conditions, necessary support, technical problems, etc.). In addition, personal data (e-mail address) is processed as part of two-factor authentication every time you log in to the myoncare platform.
Justification of processing: The processing of operational data is justified on the basis of Art. 6(1)(b) GDPR for the performance of the contract that you conclude with ONCARE for the purpose of using the myoncare platform.
We use a geolocation application for our services. For this purpose, we use ipapi (provided by apilayer Data Products GmbH,
Elisabethstraße 15/5, 1010 Vienna, Austria) as well as Geoapify (provided by Keptago Ltd., N. Nikolaidi and T. Kolokotroni ONISIFOROU CENTER, 8011 Paphos, Cyprus) to identify the location of patient users selectively during the login process. Geolocation serves exclusively to protect against unauthorized access and to protect medical data by ensuring that only authorized patients receive access to the services.
Only the IP address and coarse location information derived from it (e.g., country or region) are processed. Exact location data (e.g., GPS data), movement profiles or permanent localization do not take place. There is no merging of location data with other personal data and no profiling.
The legal basis for processing is Art. 6(1)(f) GDPR.
The service providers mentioned process the data exclusively on our behalf, on the basis of data processing agreements pursuant to Art. 28 GDPR and without pursuing their own purposes. Processing takes place exclusively within the European Union; transfer to third countries does not take place.
Location data is used exclusively to verify authorization to use and is deleted immediately after completion of this verification. The data is not stored either by us or by the service providers used.
Further information on their privacy policies can be found at https://ipapi.com/privacy/ and Privacy Policy | Geoapify Location Platform.
ONCARE provides you (as healthcare provider) and indirectly your patients with technical applications (mobile app and Progressive Web App) through which patients can be onboarded and cared for digitally.
The privacy notices displayed as part of digital onboarding and the obtaining of required consents are carried out exclusively in the name and under the responsibility of the respective healthcare provider. ONCARE has neither influence on the content of the privacy policies provided by the healthcare provider nor on the decision on the conclusion of a treatment contract or the obtaining of consents.
Within digital onboarding, ONCARE processes personal data exclusively as a technical service provider and processor pursuant to Art. 28 GDPR.
Also within the use of the myoncare platform, special categories of personal data within the meaning of Art. 9(1) GDPR are processed, in particular patients’ health data (e.g., provision of an individual treatment plan, reminder to take medication, etc.). In addition, you and your patients can upload and share documents and files in the myoncare platform with each other (e.g., diagnoses, medical histories, treatment plans, progress data, monitoring data).
The processing of this data takes place exclusively for the performance of the medical treatment and care of patients and, on our part, exclusively on the basis of the instructions of the respective healthcare provider.
During the use of the myoncare platform, you enter personal (health-related) data of your patients into the myoncare platform (e.g., provision of an individual treatment plan, reminder to take medication, etc.). In addition, you and your patients can upload and share documents and files to the myoncare platform with each other. Furthermore, functions of the facility can be generated and implemented:
It is possible to create further consent requirements for the patient, for which the patient must give consent in order to connect to the website. An uploaded privacy policy is displayed to every patient who connects to the website. All consent declarations must be documented in the uploaded privacy policy. Once a privacy policy has been uploaded, it can only be replaced by a new version but not deleted.
The files are stored in a cloud database in Germany. You can allow the sharing of such files with other platform users within your facility for medical purposes. Other platform users have no access to these files.
Furthermore, you may involve a healthcare provider outside your facility (consulting physician) as part of the treatment of your patients if you are of the opinion that another specialist opinion serves the treatment.
Justification of processing: We process this personal data, including the patient’s health data, as part of an agreement with you and in accordance with your instructions. Please process your patients’ data only if you have obtained the required data consent from these patients. ONCARE acts as a processor in accordance with the separate data processing agreement that we have concluded with you on the basis of Art. 28 GDPR.
Applies only if you use the myon.clinic Store as a Careplan user.
The myon.clinic Store is integrated into the myoncare platform and offers the purchase of treatment plans (Careplan). After registering on the myoncare platform, you can connect to the myon.clinic Store with your login credentials. You can use the myon.clinic Store to purchase treatment plans as a user.
The data of the Careplan user: Data of the Careplan user that the myon.clinic Store processes during use is processed for the conclusion of a license agreement with the Careplan provider – in this case ONCARE – and, if a fee is due, for the handling and control of the payment process between the Careplan provider – in this case ONCARE – and the Careplan user. Types of data: First name, last name, contact data, bank details.
Justification of processing: The legal basis for the processing of usage and system data, as well as commercial Store data, is Art. 6(1)(b) GDPR – the processing of the data serves the performance of the contract between Careplan user and Careplan provider – in this case ONCARE.
Only applicable if your connected app users consent to the data transfer and activate it.
ONCARE provides you with the technical possibilities to enable app users via myoncare tools to connect the myoncare app with certain health apps (e.g., AppleHealth, GoogleFit, Withings) (“Health app”), provided that these are used by the app user and the connection is established by the app user.
If the connection is established and the app user has consented to and activated the data transfer, the activity data collected by the health app is made available to you via the myoncare platform. The collection and forwarding of the activity data is the responsibility of your patients.
Types of data: The type and scope of transferred data depend on the decision of the app users. The data includes, among other things, weight, height, steps taken, calories burned, hours of sleep, heart rate and blood pressure.
Purpose of processing activity data: The activity data of the app user is made available to you in order to provide additional contextual information regarding the activity of the app user. Please note that activity data is not validated by the myoncare tools and should not be used for diagnostic purposes or as a basis for medical decisions.
Justification of processing the activity data: The data controller for the activity data of the app user that you receive via the platform is you as the healthcare provider. We process this personal data as part of an agreement with you and in accordance with your instructions. Please process your patients’ data only if you have obtained the required data consent from these patients. ONCARE acts as a processor in accordance with the separate data processing agreement that we have concluded with you on the basis of Art. 28 GDPR.
(Only applicable if you use the medical device variant of the myoncare tools)
The myoncare platform and the myoncare app are classified and marketed as a medical device in accordance with European medical device regulations. As manufacturer of the myoncare tools, we must comply with certain legal obligations (e.g., monitoring the functionality of the tool, evaluating incident reports that could be related to the use of the tool, tracking users, etc.). In addition, the myoncare tools enable you to collect personal data about certain medical devices or medicines used in the treatment of your patients. The manufacturers of such medical devices or medicines also have legal obligations regarding postmarket surveillance (e.g., collection and evaluation of reports of side effects).
ONCARE is the data controller for the processing of product safety data.
Types of data: Case reports, personal data stated in an incident report, and results of the assessment, details about the reporter.
Processing of product safety data: We store and evaluate all personal data in connection with our legal obligations as the manufacturer of a medical device and transmit this personal data (where possible after pseudonymization) to competent authorities, notified bodies, or other data controllers with supervisory obligations. In addition, we store and transmit personal data in connection with medical devices and/or medicines if we receive communications from you as the reporter of such information, from your patient or from third parties (e.g., our distribution partners or importers of the myoncare tools in your country) that must be reported to the manufacturer of the product so that it can meet its legal obligations for product safety.
Justification for the processing of product safety data: The legal basis for the processing of personal data to fulfill legal obligations as a manufacturer of medical devices or medicines is Art. 6(1)(c), Art. 9(2)(i) GDPR in conjunction with the postmarket surveillance obligations under the Medical Devices Act and the Medical Devices Directive (regulated from May 26, 2021 in Chapter VII of the new Medical Device Regulation (EU) 2017/745) and/or the Medicinal Products Act.
Supplement to the disclaimer for side effects: ONCARE does not assume any medical assessment of the transmitted content and is not obliged to forward medicinal-product-law-relevant information such as side effects, application errors or product defects to authorities. This responsibility lies exclusively with the treating healthcare providers or – if affected – with the respective manufacturers of the products used.
If you use medical additional functions via the platform such as integrated diagnostics, vital data collection or laboratory services, personal health data may be collected and processed by external third-party providers (e.g., medical device manufacturers or laboratory service providers). This is done to support medical care and always on the basis of an explicit consent or a treatment relationship.
Processing takes place either within the framework of processing on behalf or – depending on the provider – under the provider’s own responsibility under data protection law. ONCARE provides only the technical connection for this purpose, without controlling content or medically evaluating it. Further information on the respective data processing can be obtained directly from the treating healthcare provider or via the privacy information of the integrated third-party providers.
The myoncare platform offers registered healthcare providers (e.g., physicians) the possibility to offer, configure and assign digital care pathways (“Pathways”) individually to patients via a webshop functionality (e.g., in cooperation with myon.clinic).
Within the use of this functionality, personal data – in particular health data – is processed, for example information on indication, recommended treatment duration or Pathway assignment. This data processing serves the individualization and assignment of medical content and is carried out on the basis of Art. 6(1)(b) as well as Art. 9(2)(h) GDPR.
ONCARE provides the technical infrastructure and processes the data concerned as the controller within the meaning of Art. 4(7) GDPR insofar as the respective processing is necessary for the provision of the platform functions. The content selection and medical design of the Pathways, however, lies exclusively with the respective healthcare provider.
Insofar as billing or data transmission to third parties (e.g., billing entities or platform partners such as myon.clinic) takes place, such processing takes place only on the basis of corresponding agreements or statutory provisions.
(Only applicable if you use myoncare tools for reimbursements)
The myoncare platform supports you in initiating your standard procedures for reimbursement of the healthcare services that you provided to your patients via the myoncare app. In order to enable the reimbursement process, the myoncare platform supports the capture of the personal (health-related) data of your patients from the myoncare platform to facilitate the transmission of this data to the patient’s payors within the framework of the standard reimbursement processes (either your Association of Statutory Health Insurance Physicians and/or the patient’s health insurance). You are the data controller for the reimbursement data and responsible for compliance with data protection regulations for processing your patients’ personal data in the reimbursement process. ONCARE acts as a processor on the basis of the data processing agreement with the healthcare provider.
Types of data: Patient’s first and last name, diagnosis, indications, treatment, treatment duration, other data required for the administration of reimbursement.
Processing of reimbursement data: You, as controller, transmit the patient’s treatment data required for reimbursement to the payor (either your health insurer and/or the patient’s health insurer) and the payor processes the reimbursement data in order to reimburse you.
Justification for the processing of reimbursement data: The processing of reimbursement data is carried out on the basis of Sections 295, 301 SGB V. The processing of data by ONCARE for you is also carried out on the basis of Art. 28 GDPR (data processing agreement).
The myoncare platform functions as a web-based tool for which you need a working internet connection and a current version of the internet browser Chrome, Firefox or Safari.
The provision, operation and maintenance of the myoncare platform as well as the myoncare app take place via cloud-based technical infrastructures.
Depending on the customer, contractual setup, regulatory environment and country of use, ONCARE uses different hosting and cloud service providers for this purpose.
All providers used are carefully selected in advance and contractually obligated as processors pursuant to Art. 28 GDPR. Selection is made taking into account recognized technical and organizational security standards (in particular encryption, access control, availability and data backup).
The processing of personal data generally takes place within the European Union or the European Economic Area. Processing in third countries takes place only if appropriate safeguards pursuant to Art. 44 et seq. GDPR exist (e.g., adequacy decision, EU Standard Contractual Clauses).
Information about the hosting or cloud service providers used in the specific individual case will be made available to healthcare providers upon request in an appropriate form.
To ensure the security, availability and performance of the myoncare platform, ONCARE uses the Cloudflare service. Provider is: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany (parent company: Cloudflare Inc., USA)
Cloudflare acts as:
In this context, the following technically required access data may be processed in particular:
Processing takes place exclusively for:
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in securing sensitive health data and the platform infrastructure). Cloudflare is used as a processor pursuant to Art. 28 GDPR.
Insofar as personal data is transferred to the USA, this takes place on the basis of:
The use of Cloudflare serves exclusively technical security purposes. No content analysis of medical data is carried out by Cloudflare.
We use Brevo (provided by Sendinblue GmbH, based at Köpenicker Straße 126, 10179 Berlin) and Sendgrid (provided by Twilio Inc., 1801 California Street Suite 500, Denver, CO 80202, USA). These e-mail services may be used to organize the sending of e-mails. Sendgrid is used to send confirmation e-mails, transaction confirmations and e-mails with important information on requests. The data you enter for the purpose of receiving e-mails is stored on Sendgrid’s servers. If we send emails via SendGrid on your behalf, we use an SSL-secured connection.
E-mail communication is used for the following tasks:
The data that you provide to us for receiving e-mails is stored by us until you unsubscribe from our services and is deleted after your unsubscription both from our servers and from Sendgrid’s servers.
Brevo by Sendinblue GmbH (privacy policy):
Datenschutzerklärung - Schutz personenbezogener Daten | Brevo
SendGrid by Twilio Inc.
https://sendgrid.com/resource/general-data-protection-regulation-2/
This is an open-source web analytics tool. No data is transmitted to servers that are outside of ONCARE’s control. Matomo is initially disabled when you use our services. Only if you agree will your user behavior be recorded in anonymized form. If this is disabled, a “permanent cookie” is stored, provided your browser settings allow this. This cookie signals to Matomo that you do not want your browser to be recorded.
The usage information collected by the cookie is transmitted to our servers and stored there so that we can analyze user behavior.
The information generated by the cookie about your use is:
You can refuse the use of cookies by adjusting the corresponding settings in your browser. Please note, however, that in this case you may not be able to use all functions. Further information can be found at: https://matomo.org/privacy-policy/
Legal basis for processing the users’ personal data is Art. 6(1) sentence 1 lit. a GDPR. The processing of users’ personal data enables us to analyze usage behavior. By evaluating the data obtained, we are able to compile information about the use of the individual components of our services. This helps us to continuously improve our services and their usability.
We process and store personal data only as long as it is necessary to fulfill the intended purpose.
We implement appropriate technical and organizational security measures to optimally protect your personal data stored with us against accidental or intentional manipulation, loss, destruction or against access by unauthorized persons. The security levels are continuously reviewed in cooperation with security experts and adapted to new security standards.
Data exchange to and from the platform as well as to and from the app is encrypted. We offer SSL as the encryption protocol for secure data transmission. Data exchange is also encrypted throughout and takes place with pseudo keys.
Disclosure of your personal data to third parties takes place only within the framework of statutory provisions or on the basis of your consent. In all other cases, information is not passed on to third parties unless we are obliged to do so due to mandatory legal provisions (disclosure to external bodies, including supervisory or law enforcement authorities).
Any transfer of personal data is encrypted during transmission.
The information on how we handle the personal (health) data of your patients who use the myoncare app is summarized in a separate privacy policy for the myoncare patient app. You can find the privacy policy for patients here.
Please also read this privacy policy for patients carefully. For part of the processing of patient data, you are the controller responsible for compliance with data protection.
The ONCARE GmbH privacy policy serves to inform you in accordance with Art. 13 GDPR about the processing of your personal data as a user of the myoncare platform (e.g., contact, account, and usage data).
If your consent is required for individual processing of your own data, this will be obtained separately and expressly. Consent that has been given can be revoked at any time with effect for the future; the legality of the processing carried out up to that point remains unaffected. You can manage your consent after registering in the account settings of the myoncare platform.
If you process your patients' personal data via the myoncare platform, you act as the data controller within the meaning of Art. 4 No. 7 GDPR. ONCARE GmbH processes this data exclusively on your behalf and according to your instructions as a processor in accordance with Art. 28 GDPR. The basis for this is the data processing agreement to be concluded between you and ONCARE GmbH, if applicable.
Within our organization, we ensure that only those persons are authorized to process personal data who are obliged to do so in order to fulfill their contractual and legal obligations.
In certain cases, service providers support our specialist departments in fulfilling their tasks. The required data protection agreements have been concluded with all service providers who are processors for personal data. These service providers are cloud hosting service providers and support service providers.
Our cloud hosting services provide the isolated server domain of the myoncare platform in which both your personal data and that of your patients are stored. The server domain also hosts the myoncare video and file management service, which enables encrypted video conferences and data exchange between you and your patient. Access to your personal data by you and your patient is ensured by sending specific tokens. This personal data is encrypted during transmission and pseudonymized for ONCARE and its service providers during transmission and at rest. ONCARE’s service providers have no access to this personal data at any time.
Furthermore, we use service providers to process service requests (support service providers) regarding the use of the account, e.g., if you forgot your password, want to change your stored e-mail address, etc. The required data processing agreements have been concluded with these service providers; in addition, the employees entrusted with processing service requests have been trained accordingly. After receipt of your service request, a ticket number is assigned to you.
If it is a service request regarding your account use, the relevant information that you provided to us when contacting us is forwarded to one of the authorized employees of the external service. He will then contact you. Otherwise, they remain processed by specifically authorized ONCARE employees, as described under “PROCESSING OF OPERATIONAL DATA”.
Via our support service providers, we use the tool RepairCode, also known as Digital Twin Code. This is a customer experience platform for processing external feedback with the possibility to create support tickets. Here you can find the privacy policy: https://app.repaircode.de/?main=main-client – Rechtliches/privacy.
Finally, we display content from Instagram (provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) (e.g., images, videos or posts). If you click on a linked Instagram post, you will be redirected to Instagram. In doing so, Instagram may set cookies and process usage data.
If you access a page with a linked Instagram post, your browser may automatically establish a connection to Instagram’s servers. Instagram thereby receives the information that you have visited our website, even if you do not have an Instagram account or are not logged in. If you are logged in, Instagram can associate the visit with your user account. Privacy policy: https://privacycenter.instagram.com/policy
To provide our services, we may use service providers that are located outside the European Union. If data is transferred to a third country in which the protection for personal data has been assessed as not adequate, we ensure that appropriate measures are taken in accordance with national and European law and that – if required – corresponding standard contractual clauses have been agreed between the processing parties.
Personal data collected by the myoncare platform or the myoncare app is not stored in the app stores. A transfer of personal data to third countries (outside the European Union or the European Economic Area) takes place only if this is necessary to fulfill the contractual obligation, is required by law, or you have given us your consent.
For analysis purposes, the e-mails sent with Brevo or SendGrid contain a so-called “counting pixel” that connects to the servers of Brevo or Sendgrid when the e-mail is opened. This makes it possible to determine whether an e-mail message has been opened.
Legal basis: Data processing takes place on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.
Please note that your e-mails are transmitted by us to a Brevo server in Germany or to a SendGrid server in the USA and stored there. We have concluded a contract with Sendgrid that contains the EU Standard Contractual Clauses. This ensures that a level of protection exists that is comparable to that of the EU.
We integrate content from Instagram provided by Meta Platforms Ireland Ltd. If you click a linked Instagram post, it is possible that personal data (e.g., IP address, browser information, interactions) is transmitted to Meta Platforms Inc. in the USA or other third countries.
Meta is certified under the EU-U.S. Data Privacy Framework (DPF), whereby an adequate level of data protection is recognized for the transfer to the USA. Nevertheless, data may also be transferred to countries for which there is no adequacy decision of the European Commission. In such cases, additional safeguards may be necessary, the effectiveness of which, however, cannot always be guaranteed.
For the processing of activity data, interfaces to Google Cloud services (in the case of GoogleFit) or to AppleHealth or Withings are used on the mobile device of the app user. The myoncare tools use these interfaces provided by Google, Apple and Withings in order to request activity data from the connected health apps. The request sent by the myoncare tools contains no personal data. Personal data is provided to the myoncare tools via these interfaces.
We store your personal data for as long as it is required for the purpose for which it is processed. Please note that numerous retention periods require further storage of personal data. This applies in particular to retention obligations under commercial or tax law.
Please note that ONCARE is also subject to retention obligations that are contractually agreed with you due to statutory provisions. In addition, due to the classification and, if applicable, your use of the myoncare platform and the myoncare app as a medical device, certain retention periods apply for the platform that arise from the Medical Devices Act. If no other retention obligations exist, personal data is routinely deleted once the purpose has been achieved.
In addition, we may store personal data if you have given us your consent to do so or if there is a legal dispute and we use evidence within the statutory limitation periods, which can be up to 30 years; the regular limitation period is three years.
We do not use purely automated processing to make decisions.
For the establishment, implementation and termination of the contractual relationship and the fulfillment of the associated contractual and legal obligations, various personal data are required. The same applies to the use of our myoncare platform and the various functions that it offers.
In certain cases, personal data must also be collected or made available in accordance with statutory provisions. Please note that without the provision of this personal data it is not possible to process your request or fulfill the underlying contractual obligation.
We would like to inform you about your rights as a data subject. These rights are set out in Articles 15 to 22 GDPR and include:
Right of access (Art. 15 GDPR): You have the right to request information about whether and how your personal data is processed, including information about the purposes of processing, recipients, storage period as well as your rights to rectification, erasure and objection. You also have the right to receive a copy of all personal data that we have stored about you.
Right to erasure / right to be forgotten (Art. 17 GDPR): You may request that your personal data collected and processed by us be deleted without undue delay. In this case, we will ask you to delete the myoncare platform from your computer. Please note, however, that we can delete your personal data only after expiry of the statutory retention periods.
Right to rectification (Art. 16 GDPR): You may request that we update or correct inaccurate personal data concerning you or complete incomplete personal data.
Right to data portability (Art. 20 GDPR): In principle, you may request that we provide you with personal data that you have provided to us and that is processed in an automated manner on the basis of your consent or the performance of a contract with you in machine-readable form so that it can be “ported” to a replacement service provider.
Right to restriction of data processing (Art. 18 GDPR): You have the right to request restriction of the processing of your personal data if the accuracy of the data is disputed, processing is unlawful, the data is required for the assertion of legal claims, or an objection to the processing is being examined.
Right to object to data processing (Art. 21 GDPR): You have the right to object to our use of your personal data and to withdraw your consent at any time if we process your personal data on the basis of your consent. We will continue to provide our services even if they are not dependent on a withdrawn consent.
To exercise these rights, please contact us at: privacy@myoncare.com . Objection and withdrawal of consent must be submitted in text form to privacy@myoncare.com .
We require sufficient proof of your identity to ensure that your rights are protected and that your personal data is disclosed only to you and not to third parties.
Please also contact us at any time at privacy@myoncare.com if you have questions about data processing in our company or if you wish to withdraw your consent. You also have the right to contact the competent data protection supervisory authority.
The myoncare platform can be provided with so-called hyperlinks by Oncare GmbH itself as well as by the respective healthcare provider. Hyperlinks enable users, by clicking, to access external websites or content from third-party providers (e.g., podcasts, videos, information pages).
When clicking such a hyperlink, the user leaves the myoncare platform. The external nature of the link is intended to be made recognizable for the user, for example by notices such as “external link”, “Further content (external provider)” or “Video on an external platform”.
For the contents of the linked external websites as well as for the processing of personal data there, the respective third-party provider is solely responsible under data protection law. Oncare GmbH has no influence on the design, contents or data protection practices of external websites and assumes no responsibility for them.
The processing operations of personal data described in this privacy policy apply exclusively to the use of the myoncare platform. For data processing on linked external websites, the respective privacy notices and terms of use of the third-party providers apply.
Insofar as healthcare providers independently set hyperlinks to external content within the scope of using the platform, this takes place under their own responsibility under data protection law.
For displaying PDF documents within our application, we use an online service of Adobe Inc., 345 Park Avenue, San Jose, CA 95110-2704, USA (“Adobe”).
When calling up a PDF document, a connection is established to Adobe’s servers. In doing so, technical access data (e.g., IP address, device and browser information) may be processed in particular. Processing takes place exclusively for the purpose of technically reliable display of PDF files.
Adobe processes personal data under its own responsibility under data protection law. We have no influence on the type, scope and further use of the data processed by Adobe.
It cannot be ruled out that processing of data takes place in the USA. Adobe is certified under the EU-U.S. Data Privacy Framework and additionally uses appropriate safeguards pursuant to Art. 46 GDPR.
Further information on data processing by Adobe can be found in Adobe’s privacy policy at: https://www.adobe.com/de/privacy/policy.html
Webfonts may be used for the display of fonts and for consistent visual design of the user interface.
Insofar as external services are used to provide fonts (e.g., Google Fonts), this takes place exclusively in compliance with the legal requirements of Art. 44 et seq. GDPR.
Processing is limited to technically necessary access data (e.g., IP address, browser information, device type, URL accessed) and serves exclusively the functional and user-friendly display of the platform.
You can reach our Data Protection Officer for all questions about data protection at privacy@myoncare.com.
We expressly reserve the right to change this privacy policy in the future at our own discretion. Changes or additions may, for example, be necessary to comply with legal requirements, to take technical and economic developments into account, or to meet the interests of app or platform users. Changes are possible at any time and will be communicated to you in an appropriate manner and within a reasonable time frame before they take effect (e.g., by publishing a revised privacy policy at login or by advance notice of material changes).
ONCARE GmbH Postal address: Balanstraße 71a, 81541 Munich, Germany
T | +49 (0) 89 4445 1156 E | privacy@myoncare.com
Contact details of the Data Protection Officer privacy@myoncare.com
If medical content or services are obtained or offered via the integrated myon.clinic Store, the content-related and commercial responsibility lies with myon.clinic GmbH, a subsidiary of Oncare GmbH. In this context, Oncare GmbH provides exclusively the technical platform. privacy@myon.clinic
In case of interpretation questions or disputes, only the German version of the privacy policy is binding and decisive. STATUS March 2026
The following are supplementary data protection provisions for healthcare providers who operate in the United States of America as a Covered Entity or on behalf of such within the scope of a HIPAA-mandatory activity:
The protection of personal health information (PHI) under HIPAA applies exclusively if this data is processed within the U.S.
healthcare system by a so-called Covered Entity or a Business Associate – regardless of the nationality or residence of the data subject. The decisive factor is solely that the processing falls within the scope of HIPAA.
This privacy policy applies uniformly to all healthcare providers who use the myoncare platform.
Data protection responsibility as well as liability attribution, however, are determined exclusively by the respective country of use of the platform and the underlying contractual relationship.
is the controller under data protection law within the meaning of the GDPR.
In these cases, the respective other company is neither controller nor processor nor liable party.
For healthcare providers in the USA or in case of HIPAA-mandatory use, exclusively myoncare Inc. (“MYONCARE INC.”) is responsible and liable.
ONCARE GmbH assumes no data protection or liability responsibility in these cases.
This annex is not an independent privacy notice and does not establish an independent data protection or liability responsibility of ONCARE GmbH.
It supplements the above privacy policy exclusively for the special case of HIPAA-relevant use and applies only within the framework of an existing contractual relationship with MYONCARE INC.
This HIPAA supplement applies to healthcare providers who process, store or transmit Protected Health Information (PHI) via the myoncare platform, provided and insofar as
Application of this annex outside such a HIPAA-relevant contractual relationship is excluded.
Insofar as this annex applies, MYONCARE INC. acts depending on contract and function as
within the meaning of the HIPAA Privacy Rule (45 CFR § 160.103).
The respective role results exclusively from the specific underlying HIPAA-compliant contractual relationship, in particular from a Business Associate Agreement (BAA).
ONCARE GmbH
and is not a party to a HIPAA-relevant contractual relationship.
It assumes no duties, responsibilities or liability under U.S. data protection or health law, in particular not under HIPAA.
The respective healthcare provider acts – depending on the contractual integration – either
within the meaning of 45 CFR § 160.103 et seq.
An independent role as Business Associate is not established by this annex.
Use of the myoncare platform by healthcare providers via MYONCARE INC. takes place exclusively on the basis of existing HIPAA-compliant agreements with the respective Covered Entity.
Processing includes in particular:
Healthcare providers undertake to treat all PHI as confidential and to restrict access to PHI to the required extent in accordance with the Minimum Necessary Standard (45 CFR § 164.502(b)).
Access takes place exclusively role-based and is logged in an auditable manner.
MYONCARE INC. implements technical and organizational measures in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C), in particular:
Access to or processing of PHI outside the United States (e.g., hosting within the EU) takes place exclusively:
Healthcare providers are obliged to inform MYONCARE INC. without undue delay of any incident that could lead to unauthorized access to PHI (Security Incident or Breach pursuant to 45 CFR §§ 164.304, 164.402).
MYONCARE INC. coordinates the legally required notifications to the Covered Entity.
The Covered Entity is entitled, within the framework of an audit, to verify compliance with HIPAA requirements by MYONCARE INC. and involved healthcare providers.
Healthcare providers assure their full cooperation for this purpose.
Disclosure of PHI outside the myoncare platform is permitted only if
In the event of a contradiction between this HIPAA supplement and other data protection provisions, the stricter provision applies insofar as this is legally permissible.
Healthcare providers support MYONCARE INC. and the Covered Entity in fulfilling data subject rights pursuant to 45 CFR §§ 164.524–528, in particular with:
Coordination takes place via MYONCARE INC.
Healthcare providers conduct at least annually a documented training on HIPAA and – where applicable – GDPR requirements. MYONCARE INC. can provide training materials or e-learning access for this purpose.
Use of PHI for research, analysis or marketing purposes is inadmissible unless
In case of simultaneous applicability of GDPR and HIPAA, MYONCARE INC. ensures coordination of obligations.
Healthcare providers undertake in particular not to carry out third-country transfers without appropriate safeguards.
In addition to HIPAA, state data protection laws (e.g., CCPA/CPRA, SHIELD Act, BIPA) may apply. MYONCARE INC. provides supplementary notes upon request.
Personal data of platform users is not processed for marketing or research purposes.
MYONCARE INC. uses exclusively fully anonymized (“de-identified” according to 45 CFR §164.514(a)–(c)”technical usage data that does not constitute PHI.
If you have questions about these terms, please get in touch.
For older versions: Archive
for the use of the myoncare mobile app and the myoncare Progressive Web App/PWA Status March 2026
The protection of your personal data, in particular your health data, is our highest priority. In this privacy notice, we transparently inform you about how personal data is processed when using the myoncare mobile app and the myoncare Progressive Web App/PWA (together referred to as myoncare “MOBILE”).
This Privacy Notice explains how personal data are processed when you use the myoncare mobile app or the myoncare PWA as part of your care or services provided by a service provider (e.g., a medical practice, clinic, therapy facility, or other medical or non-medical providers of health, prevention, advisory, or care services). In particular, you will receive information about who is responsible for which processing activities, which data are affected, for what purposes the data are processed, and what rights you have.
With myoncare, two entities are typically involved:
Your healthcare provider (e.g., your medical practice/clinic/medical facility): It decides on the purposes and means of processing your treatment and health data and is therefore the controller under data protection law (Art. 4(7) GDPR).
ONCARE GmbH (“ONCARE”): It provides the technical applications (mobile app/PWA) and, as a rule, processes treatment and health data exclusively on behalf of your healthcare provider as a processor (Art. 28 GDPR).
Important: The privacy notices shown to you during digital onboarding, as well as the collection of any required consents (e.g., for certain additional functions), are carried out exclusively in the name and under the responsibility of your healthcare provider. ONCARE has no influence on the content of your healthcare provider’s privacy notices or on whether and which consents are collected.
ONCARE does not make independent decisions about the purposes and means of processing treatment or health data. There is therefore no joint controllership within the meaning of Art. 26 GDPR in this respect.
In certain cases, ONCARE also processes data under its own responsibility, in particular where this is necessary for the secure technical operation of the app/platform (e.g., IT security, abuse prevention, provision of basic platform functions). In such cases, ONCARE is the controller within the meaning of the GDPR; its contact details are as follows:
The contact details of your healthcare provider (including data protection contact/data protection officer, if any) can be found in the privacy information provided by your healthcare provider (e.g., in the practice, on the website, or within onboarding).
ONCARE GmbH
Postal address: Balanstraße 71a, 81541 Munich, Germany
E-mail: privacy@myoncare.com
Telephone: +49 (0) 89 4445 1156
You can reach ONCARE’s Data Protection Officer at: privacy@myoncare.com
Medical personal data is not used for commercial or advertising purposes.
This does not affect if applicable the use of fully anonymized data where no personal reference exists anymore and reidentification is excluded according to the state of the art.
Such anonymized data is not subject to the GDPR and may if applicable be analyzed, combined, disclosed to third parties, or sold by ONCARE for scientific, statistical, regulatory, quality assurance, and commercial purposes.
Such data does not contain any information that would allow conclusions to be drawn about individual persons.
Depending on how the app/platform is used, the following data may be processed in particular—by category:
Master data and contact data (e.g., name, date of birth, address, health insurer, insurance number, e-mail address, phone number).
Account and usage data (e.g., login information, IP address, language settings, device information, log data). Treatment and health data (special categories of personal data, Art. 9(1) GDPR), e.g., symptoms, photos, medication, questionnaire responses, diagnoses, therapies, treatment plans, progress and monitoring data, as well as completed/planned tasks.
Communication content (e.g., messages/approvals between you and the healthcare provider, insofar as the function is used).
Your healthcare provider uses myoncare to onboard you digitally, to carry out your medical treatment and care, and to communicate with you.
In doing so, your healthcare provider processes your personal data and—where necessary—health data, e.g., information on symptoms, diagnoses, therapies, medications, treatment plans, reminders, document/file exchange, questionnaires, monitoring. ONCARE processes this data on behalf of and under the instructions of the healthcare provider.
The legal bases are the responsibility of your healthcare provider. Typically applicable are:
Where consent is required for individual functions (e.g., optional additional services), your healthcare provider obtains and manages this consent. You can withdraw consent at any time with effect for the future; details can be found in your healthcare provider’s information.
Where functions to support reimbursement or billing processes are used via the platform, your healthcare provider processes the data required for this under its own responsibility. ONCARE processes this data exclusively as a processor pursuant to Art. 28 GDPR.
ONCARE processes certain data to ensure the secure technical operation of the app/platform, detect disruptions, and prevent unauthorized access.
This includes in particular:
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in IT security and protection of particularly sensitive health data). Location data is used only selectively during the login process. Only the IP address and the coarse location information derived from it (e.g., country or region) are processed. No precise location data (e.g., GPS data), movement profiles, or permanent localization takes place. There is no merging of location data with other personal data and no profiling.
For certain functions (e.g., account creation, password reset, important system information, dispatch of reports), e-mails are sent. ONCARE uses e-mail service providers for this purpose. Content relating to your healthcare provider’s medical communication is processed only under its instructions.
To the extent the myoncare app/platform is operated as a medical device within the meaning of applicable European medical device regulations (e.g., Regulation (EU) 2017/745 – MDR), ONCARE is legally obliged to carry out market surveillance, product safety measures and to report serious incidents.
For this purpose, ONCARE may process personal data, including health data, to the extent necessary to fulfil these legal obligations.
The legal basis is
Art. 6(1)(c) GDPR (compliance with a legal obligation) in conjunction with Art. 9(2)(i) GDPR (reasons of public interest in the area of public health).
Within this scope, ONCARE acts independently as the controller.
If you voluntarily establish a connection to an external device or a health platform (e.g., wearable, fitness tracker, blood pressure monitor), activity or vital data may be transmitted to the platform.
This may include in particular:
Processing is carried out exclusively on the basis of your prior explicit consent pursuant to Art. 6(1)(a) GDPR and Art. 9(2)(a)
GDPR.
Consent is voluntary and can be withdrawn at any time with effect for the future. ONCARE processes this data exclusively on behalf of the respective healthcare provider.
Data is disclosed only if necessary (e.g., for operating the services), permitted by law, or if you/the healthcare provider have consented. Recipients may include in particular:
Depending on the customer, contractual setup, regulatory environment and country of use, ONCARE uses different hosting and cloud service providers. A logically separated system environment is operated for each healthcare provider. Personal data is stored in isolated server areas so that no commingling with data of other healthcare providers occurs.
Processing generally takes place within the EU/EEA. A transfer of personal data to countries outside the European Union or the European Economic Area takes place only if appropriate safeguards pursuant to Art. 44 et seq. GDPR exist (e.g., Data Privacy Framework (DPF) or EU Standard Contractual Clauses). Where necessary, supplementary safeguards are implemented.
For the secure and high-performance provision of the myoncare mobile app and the Progressive Web App (PWA), ONCARE uses the Cloudflare service.
Provider: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany (parent company: Cloudflare Inc., USA).
Cloudflare is used as a so-called Content Delivery Network (CDN) and to protect against attacks (e.g., DDoS attacks). In doing so, the following technically required data may be processed in particular:
Processing is carried out exclusively for the purpose of:
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in IT security and protection of particularly sensitive health data).
Cloudflare is used as a processor pursuant to Art. 28 GDPR. A corresponding data processing agreement exists.
Personal data may also be processed in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework (DPF). In addition, appropriate safeguards pursuant to Art. 44 et seq. GDPR (in particular EU Standard Contractual Clauses) have been concluded.
The retention period for technically required log data is limited to the necessary minimum and is generally less than 24 hours unless a security-relevant evaluation is required.
Further information can be found at: https://www.cloudflare.com/privacypolicy.
The use of Cloudflare serves exclusively technical security purposes. Cloudflare does not perform any content analysis of medical data.
For technical synchronization between the myoncare app and your healthcare provider’s platform, the Google Firebase service (Google Ireland Ltd., Dublin, Ireland) is used.
Only the data required for synchronization is processed. Processing is pseudonymized and encrypted. A direct assignment to your person is not possible for ONCARE and the technical service providers used.
Google is used as a processor pursuant to Art. 28 GDPR.
ONCARE uses Brevo (Sendinblue GmbH, Berlin) and SendGrid (Twilio Inc., USA) for the organizational sending of e-mails. Brevo or SendGrid may be used for transactional/confirmation e-mails. Data may be stored on the servers of the respective providers; with SendGrid, processing in the USA is possible. In these cases, appropriate safeguards pursuant to Art. 44 et seq. GDPR are used (e.g., EU Standard Contractual Clauses).
If PDF documents are displayed within the app/platform via an Adobe online service, Adobe processes personal data under its own responsibility under data protection law. It cannot be ruled out that processing in the USA may also take place. Further information can be found in Adobe’s privacy notice.
The app/platform may contain links to external content (e.g., videos, podcasts, social media posts). By clicking on them, you leave the myoncare environment; the respective provider is responsible for data processing on the linked pages. When accessing such content, your browser may establish a direct connection to Instagram servers. Personal data (e.g., IP address, browser information) may be processed and cookies may be set, and transfers to third countries may occur. Individual services:
If medical content or services are obtained or offered via the integrated myon.clinic Store, the content-related and commercial responsibility lies with myon.clinic GmbH (subsidiary of ONCARE GmbH). In this context, ONCARE provides only the technical platform. Contact: privacy@myon.clinic.
To handle technical service requests (e.g., password reset, changes to account data), ONCARE uses contractually bound support service providers. Only the account information necessary to process the request is processed.
Data processing agreements pursuant to Art. 28 GDPR exist with all support service providers. Staff are trained accordingly and bound to confidentiality.
For a consistent and user-friendly display of the content of the myoncare mobile app and the Progressive Web App (PWA), fonts (“webfonts”) may be used.
To the extent external services are used to provide fonts (e.g., Google Fonts), it may be technically necessary for your device to establish a connection to the provider’s servers when accessing the platform. Technically necessary access data (e.g., IP address, browser type, device type, URL of the page accessed, date and time of access) may be processed.
Such processing is carried out exclusively for the functional display of the user interface and not for analysis, tracking, or marketing purposes.
To the extent personal data is transferred to countries outside the European Union or the European Economic Area, this takes place exclusively in compliance with the legal requirements of Art. 44 et seq. GDPR (e.g., on the basis of the Data Privacy Framework (DPF) or EU Standard Contractual Clauses).
In order to improve the functionality and user friendliness of the myoncare Mobile App as well as the myoncare Progressive Web App PWA the analytics tool Matomo may be used. Matomo is an open source software used for the statistical evaluation of the use of the platform.
The analysis is carried out exclusively on servers under the control of ONCARE GmbH. No data is transmitted to external analytics providers.
The use of Matomo is disabled by default and will only be activated if the user expressly consents to the anonymized usage analysis.
If Matomo is activated technical usage information may be processed including in particular the operating system used the browser used the device type approximate geolocation such as country or region technical system information as well as interactions within the app or the PWA such as accessed functions or clicked buttons.
The IP address is shortened or anonymized prior to processing so that no direct personal reference can be established.
The processing is carried out exclusively for the purpose of better understanding the use of the platform improving functions and user friendliness and optimizing the technical stability and performance of the myoncare services.
If the user does not consent to the use of Matomo or withdraws such consent the user behavior will not be recorded.
The legal basis for the processing is Art. 6 para. 1 lit. a GDPR consent.
Further information is available at https://matomo.org/privacy-policy.
Within certain caretasks of the myoncare App users may optionally be offered the possibility to upload medical documents for example laboratory reports or findings in order to automatically extract the values contained therein.
This function is based on AI supported document recognition OCR Optical Character Recognition. For the technical processing an AI technology provided by Google LLC in particular Gemini may be used.
The use of this function is entirely voluntary. Users are expressly asked within the respective caretask whether they wish to use the automatic recognition. Alternatively all values can be entered manually at any time.
If a document is uploaded for automated analysis the following data may in particular be processed the uploaded document for example laboratory reports or findings the medical information contained therein for example laboratory values reference values or examination dates as well as technically required metadata for processing the document.
The processing is carried out exclusively for the purpose of automated extraction of the information contained in the document in order to facilitate the entry of medical values. The extracted data is subsequently displayed within the myoncare App and can be reviewed and confirmed by the user.
The AI used serves exclusively for technical text recognition and does not make any medical decisions.
The use of this function takes place exclusively on the basis of explicit consent. The legal basis is Art. 6 para. 1 lit. a GDPR consent as well as Art. 9 para. 2 lit. a GDPR consent to the processing of health data.
To the extent that personal data is processed by external technical services within the scope of this function a transfer to countries outside the European Union or the European Economic Area may take place. In such case the processing is carried out exclusively in compliance with the requirements of Art. 44 et seq. GDPR in particular on the basis of appropriate safeguards such as EU Standard Contractual Clauses or the EU US Data Privacy Framework.
The use of this function is voluntary and the use of the other functions of the myoncare App is also possible without using this OCR function.
ONCARE stores personal data only as long as necessary for the respective purposes and then deletes it, unless statutory retention periods prevent this. For treatment and health data, your healthcare provider’s storage and retention obligations generally apply; you will receive information on this directly from your healthcare provider. Statutory retention and documentation obligations, in particular under medical device law, commercial law or tax law, remain unaffected.
As a data subject, you have the rights set out in Art. 15 to 22 GDPR. These include in particular:
You have the right to request information on whether personal data concerning you is being processed. If so, you have the right to information about the purposes of processing, categories of personal data, recipients, storage period and your further rights. You also have the right to a copy of the personal data.
You can request the rectification of inaccurate personal data without undue delay or the completion of incomplete personal data.
You can request the erasure of your personal data provided that the legal requirements are met. Please note that statutory retention and documentation obligations—especially in the medical field—may prevent erasure.
Under the statutory conditions, you can request restriction of processing.
Where processing is based on your consent or a contract and is carried out by automated means, you have the right to receive the personal data you provided in a structured, commonly used and machine-readable format or to have it transmitted to another controller.
Where processing is based on Art. 6(1)(f) GDPR, you can object to processing on grounds relating to your particular situation.
Where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.
For the processing of your treatment and health data, your healthcare provider is the controller under data protection law. Please address related requests in principle to your healthcare provider.
ONCARE generally processes this data as a processor and supports the healthcare provider in fulfilling your rights within the framework of the data processing agreement.
Where ONCARE processes personal data under its own responsibility (e.g., for IT security or product safety purposes), you can exercise your rights at privacy@myoncare.com.
If your data is processed in the context of HIPAA-regulated treatment (see section 15), the competent Covered Entity or its Privacy Office is generally the point of contact for exercising your HIPAA rights.
To process your request, appropriate proof of identity may be required to ensure that personal data is not disclosed to unauthorized third parties.
You also have the right to lodge a complaint with a data protection supervisory authority.
Where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing up to the withdrawal remains unaffected. Please note: consents obtained by your healthcare provider (e.g., in onboarding) are generally managed via your healthcare provider.
If you use the myoncare app as part of corporate health management (e.g., your employer), certain data may be shared with the company and, where applicable, commissioned data service providers in aggregated form, without being attributable to you as a person. In this scenario, the company (or a commissioned data provider) is typically the controller; ONCARE processes the data as a processor under their instructions. Details can be found in your company’s BGM-specific information.
For managing support requests, the “RepairCode” tool (Digital Twin Code) may be used. This is a platform for structured processing of external requests. Further information can be found at: https://app.repaircode.de/?main=main-client - Rechtliches/privacy.
Where data is processed via a commissioned data service provider, this takes place exclusively on behalf of the respective controller.
ONCARE implements appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect your data against unauthorized access, loss, alteration, or disclosure. This includes in particular:
For additional protection, personal identification features are replaced by pseudonymous keys in technical processes. Reidentification is possible only within your healthcare provider’s secured system environment. Access is only possible after successful authentication using secured token procedures.
ONCARE may adapt this privacy notice, e.g., due to legal requirements or technical developments. Material changes will be communicated appropriately before taking effect (e.g., in the app/platform).
There is no solely automated decision-making within the meaning of Art. 22 GDPR. Medical decisions are made exclusively by your healthcare provider.
If your health data is processed as part of treatment that is subject to the U.S. Health Insurance Portability and Accountability Act (HIPAA), the HIPAA requirements apply in addition. HIPAA applies if a “Covered Entity” (e.g., a U.S. hospital/U.S. healthcare provider or a U.S. health insurer) is involved—regardless of the country in which you live.
In such cases, HIPAA information obligations (e.g., “Notice of Privacy Practices”) and HIPAA data subject rights are generally fulfilled by the respective Covered Entity.
Where the myoncare platform is used in a HIPAA context, the responsible U.S. group company myoncare Inc. acts as a “Business Associate” or “Sub-Business Associate” on the basis of a Business Associate Agreement (BAA). In these cases, ONCARE GmbH does not assume any responsibility under HIPAA.
For HIPAA requests (e.g., access in the form of a HIPAA “Access Request”), please contact the data protection office/Privacy Office of the treating Covered Entity; it will coordinate the processing, if necessary, with myoncare Inc.
Where both the GDPR and HIPAA apply, the respective obligations are fulfilled in a coordinated manner; responsibility for medical data processing remains with the treating entity.
If you have questions about these terms, please get in touch.