For older versions: Archive
---
STATUS MARCH 2026
Welcome to myoncare, the digital health platform for efficient and needs-based patient care of Oncare GmbH (hereinafter “ONCARE” or “we”, “we”, “our”).
For us, the protection of your privacy and all personal data is of great importance and significance.
We are aware of the responsibility arising from the processing of your personal data in the myoncare Careplan Manager (also “myoncare platform” or “platform”). Our technology systems used for the myoncare services are therefore set up to the highest standards, and the lawful processing of data is at the center of our ethical understanding as a company.
Please note that this privacy policy consists of two parts:
• The first part contains data protection provisions for the use of the myoncare Careplan Manager within Europe on the basis of the General Data Protection Regulation (GDPR).
• The second part contains supplementary provisions under the requirements of U.S. data protection law (HIPAA). These apply when health data is processed by a U.S. Covered Entity or when healthcare providers operate within the U.S. healthcare system – regardless of the residence of the data subject.
We process your personal data in accordance with the applicable legal provisions for the protection of personal data, in particular the EU General Data Protection Regulation (“GDPR”) and the country-specific laws applicable to us. In this privacy policy you will learn why and how ONCARE processes your personal data that we collect from you or that you provide to us when you decide to use the myoncare Careplan Manager. In particular, you will find a description of the type of personal data we collect and process, as well as the purpose and basis on which we process the personal data; in addition, you will find the rights to which you are entitled here.
Please read the privacy policy carefully to ensure that you understand each provision. After you have read the privacy policy, you have the option to consent to the processing of your personal data as described in the privacy policy.
“App user” is any user of the myoncare app (your patient).
“Careplan provider” means you or another service provider or third party (e.g., medical device manufacturers, pharmaceutical companies) who makes care plans available to other users of the platform via the myon.clinic Store or other means of data exchange.
“Careplan user” means you or another service provider (platform user) who uses a care plan (“Pathway”) for the treatment of its registered patients.
“Caretasks” are specific tasks or actions within a Pathway that must be carried out by the participating healthcare providers, nursing staff, or the patient themselves.
“Privacy policy for healthcare providers” means this policy made available to you as a user of the myoncare Careplan Manager and describing how we collect, use and store personal data, and informing you about your comprehensive rights. “Privacy policy for patients” means the privacy policy describing the processing of patients’ personal (health) information who use the myoncare app. According to the terms of use, our offer is directed only at persons aged 18 and over. Accordingly, no personal data of children and adolescents under 18 is stored and processed.
“Healthcare provider” means you or another physician, clinic, healthcare facility, healthcare professional, or any other medical or non-medical provider of health, prevention, advisory, or care services acting either independently or on behalf of you or another such provider (intended user).
“Terms of use” means the terms of use for using the myoncare Careplan Manager.
“myoncare app” means the mobile and web app myoncare application for patients who wish to use the services offered by ONCARE via the app.
“myon.clinic Store” is the web shop operated by myon clinic GmbH in which digital care concepts (“Pathways”) can be offered.
“myoncare tools” means the myoncare app and the myoncare Careplan Manager together.
“myoncare PWA” means the browser-based myoncare Progressive Web App application for patients who wish to use the services offered by ONCARE via the PWA and not via the myoncare mobile app.
“myoncare platform” is the myoncare Careplan Manager intended for professional use by platform users and serving as an interface between platform users and app users.
“myoncare services” means the services, functionalities and other offerings that are offered or may be offered to platform users via the platform and/or to app users via the myoncare app.
“ONCARE” means ONCARE GmbH, Germany.
“Pathway” is a standardized treatment plan consisting of several, if applicable, sequential Caretasks that can define the steps for diagnoses and therapies.
“Platform user” means you or another service provider who uses the web-based myoncare platform.
The processing of personal health data takes place exclusively on behalf of the respective healthcare provider within the scope of medical care.
This does not apply to data that has been fully anonymized so that no personal reference exists anymore and re-identification is excluded.
ONCARE is entitled to use such anonymized and aggregated data independently of the respective healthcare provider for research, statistics, quality, regulatory and commercial purposes and to disclose or sell it to third parties.
Oncare GmbH, a company registered with the Local Court of Munich under registration number HRB 219909 and having its registered office at Balanstraße 71a, 81541 Munich, Germany, offers and operates the interactive web portal (for medical professionals), the “myoncare platform”, the myoncare PWA and the mobile application myoncare app (for patients) as access to the myoncare services.
This privacy policy applies to all personal data processed by ONCARE in connection with the use of the myoncare Careplan Manager by the healthcare provider.
Data protection between you, the healthcare provider, and your patient must be regulated by you. A separate privacy policy applies to patients’ use of the myoncare app and PWA: https://www.myoncare.com/privacy-policy
“Personal data” means all information that makes it possible to identify a natural person. This includes, among other things, your first name, your last name, your date of birth, your address, your telephone number, your e-mail address and your IP address.
“Health data” are personal data relating to the physical and mental health of a natural person, including the provision of health services, which reveal information about their health status.
Data are to be regarded as “anonymous” if no personal reference to the person/user can be established.
In contrast, “pseudonymized” data are data from which a personal reference or personally identifiable information is replaced by one or more artificial identifiers or pseudonyms, but which can generally be re-identified by the identifier key. (within the meaning of Art. 4 No. 5 GDPR).
We may process the following categories of data about you when using the myoncare platform:
Operational data: Personal data that you provide to us when registering on our myoncare platform, when contacting us about problems with the platform, or in other interactions with us for the purpose of using the platform.
Treatment data: You collect personal data of your patients, such as first name, last name, age, height, weight, indication, disease symptoms and other information in connection with the treatment of your patients (e.g., in a care plan) on the myoncare platform. Activity data of your connected patients are made available to you in your myoncare platform.
Commercial Store data: Personal data processed in connection with the use of the myon.clinic Store – in particular in connection with authorship, configuration or the acquisition of digital treatment plans (“Pathways”). The Store is operated by myon.clinic GmbH, a subsidiary of Oncare GmbH. Use of the Store requires the processing of your first name, last name, professional contact details as well as, if applicable, payment data (only for paid content).
Activity data: Personal data processed by us when an app user connects the myoncare app with a health application (e.g., AppleHealth, GoogleFit, Withings). The activity data of your connected patients are made available to you in your myoncare platform.
Analysis of anonymized usage data to improve the platform: We process exclusively anonymized, non-personal technical usage data (e.g., aggregated information on frequency of use or system performance) in order to further develop the functionality and user-friendliness of the platform. This data contains no identifying information and does not allow conclusions about individual platform users. Processing of personal data of healthcare providers for research or commercial purposes does not take place.
Data from device manufacturers or laboratories: In addition, within integrated care processes, personal data may be processed by connected medical device manufacturers or laboratory service providers, provided these are commissioned or used by the healthcare provider via the myoncare platform.
Product safety data: Personal data processed to fulfill our legal obligations as the manufacturer of the myoncare platform as a medical device. In addition, your personal data may be processed if you report an incident in order to ensure legal compliance or vigilance of medical device or pharmaceutical companies.
Reimbursement data: Personal data required for the reimbursement process.
If you, as a healthcare provider, are a contact person for the operation of the myoncare platform at your location/practice (e.g., IT administrator, appointed medical professional), you may provide us with certain personal data when contacting us in order to understand or discuss the functions and use of the myoncare platform, or in the event of a service request.
In the event of a service request, the following personal data may also be viewed by authorized ONCARE employees:
Your personal data that you provided to us for registration and/or login on our myoncare platform (e.g., first name, last name, date of birth, profile picture, contact details).
Authorized ONCARE employees who are permitted to access your database for the purpose of processing a service request are contractually obliged to treat all personal data as strictly confidential.
As part of your support through myoncare, we would like to inform you how we handle notifications and important information that we provide to you.
• We send you important information and reminders by e-mail.
• This ensures that you do not miss important notifications and that your support runs smoothly.
Why we do this: Our goal is that you are always informed about your tasks and important updates in order to optimally support your care. E-mails are a reliable way to ensure that important information reaches you even if push notifications are disabled.
• If you do not wish to receive e-mail notifications, you can disable them in the settings of the myoncare platform.
• Please ensure that your e-mail address is correct and up to date to ensure smooth receipt of our messages.
• If you do not wish to receive e-mail reminders, you can disable them in the settings of the myoncare platform.
In the processing of operational data, ONCARE acts as the data controller responsible for the lawful processing of your personal data.
Types of data: Name, e-mail address, date of registration, your IP address, pseudo keys generated by the platform.
The myoncare platform uses the Google Maps API to use geographic information. When using Google Maps, Google also collects, processes and uses data about the use of the map functions. More information about the scope, legal basis and purpose of data processing by Google as well as the storage period can be found in Google’s privacy policy.
Purposes of processing operational data: We use operational data to maintain the functionalities of the myoncare platform and, if necessary or initiated directly by you, to contact you (e.g., in the event of changes to the General Terms and Conditions, necessary support, technical problems, etc.). In addition, personal data (e-mail address) is processed as part of two-factor authentication every time you log in to the myoncare platform.
Justification of processing: The processing of operational data is justified on the basis of Art. 6(1)(b) GDPR for the performance of the contract that you conclude with ONCARE for the purpose of using the myoncare platform.
We use a geolocation application for our services. For this purpose, we use ipapi (provided by apilayer Data Products GmbH,
Elisabethstraße 15/5, 1010 Vienna, Austria) as well as Geoapify (provided by Keptago Ltd., N. Nikolaidi and T. Kolokotroni ONISIFOROU CENTER, 8011 Paphos, Cyprus) to identify the location of patient users selectively during the login process. Geolocation serves exclusively to protect against unauthorized access and to protect medical data by ensuring that only authorized patients receive access to the services.
Only the IP address and coarse location information derived from it (e.g., country or region) are processed. Exact location data (e.g., GPS data), movement profiles or permanent localization do not take place. There is no merging of location data with other personal data and no profiling.
The legal basis for processing is Art. 6(1)(f) GDPR.
The service providers mentioned process the data exclusively on our behalf, on the basis of data processing agreements pursuant to Art. 28 GDPR and without pursuing their own purposes. Processing takes place exclusively within the European Union; transfer to third countries does not take place.
Location data is used exclusively to verify authorization to use and is deleted immediately after completion of this verification. The data is not stored either by us or by the service providers used.
Further information on their privacy policies can be found at https://ipapi.com/privacy/ and Privacy Policy | Geoapify Location Platform.
ONCARE provides you (as healthcare provider) and indirectly your patients with technical applications (mobile app and Progressive Web App) through which patients can be onboarded and cared for digitally.
The privacy notices displayed as part of digital onboarding and the obtaining of required consents are carried out exclusively in the name and under the responsibility of the respective healthcare provider. ONCARE has neither influence on the content of the privacy policies provided by the healthcare provider nor on the decision on the conclusion of a treatment contract or the obtaining of consents.
Within digital onboarding, ONCARE processes personal data exclusively as a technical service provider and processor pursuant to Art. 28 GDPR.
Also within the use of the myoncare platform, special categories of personal data within the meaning of Art. 9(1) GDPR are processed, in particular patients’ health data (e.g., provision of an individual treatment plan, reminder to take medication, etc.). In addition, you and your patients can upload and share documents and files in the myoncare platform with each other (e.g., diagnoses, medical histories, treatment plans, progress data, monitoring data).
The processing of this data takes place exclusively for the performance of the medical treatment and care of patients and, on our part, exclusively on the basis of the instructions of the respective healthcare provider.
During the use of the myoncare platform, you enter personal (health-related) data of your patients into the myoncare platform (e.g., provision of an individual treatment plan, reminder to take medication, etc.). In addition, you and your patients can upload and share documents and files to the myoncare platform with each other. Furthermore, functions of the facility can be generated and implemented:
• Add a location;
• Upload the website logo;
• Add the details of the location;
• Upload a privacy policy;
It is possible to create further consent requirements for the patient, for which the patient must give consent in order to connect to the website. An uploaded privacy policy is displayed to every patient who connects to the website. All consent declarations must be documented in the uploaded privacy policy. Once a privacy policy has been uploaded, it can only be replaced by a new version but not deleted.
The files are stored in a cloud database in Germany. You can allow the sharing of such files with other platform users within your facility for medical purposes. Other platform users have no access to these files.
Furthermore, you may involve a healthcare provider outside your facility (consulting physician) as part of the treatment of your patients if you are of the opinion that another specialist opinion serves the treatment.
Justification of processing: We process this personal data, including the patient’s health data, as part of an agreement with you and in accordance with your instructions. Please process your patients’ data only if you have obtained the required data consent from these patients. ONCARE acts as a processor in accordance with the separate data processing agreement that we have concluded with you on the basis of Art. 28 GDPR.
Applies only if you use the myon.clinic Store as a Careplan user.
The myon.clinic Store is integrated into the myoncare platform and offers the purchase of treatment plans (Careplan). After registering on the myoncare platform, you can connect to the myon.clinic Store with your login credentials. You can use the myon.clinic Store to purchase treatment plans as a user.
The data of the Careplan user: Data of the Careplan user that the myon.clinic Store processes during use is processed for the conclusion of a license agreement with the Careplan provider – in this case ONCARE – and, if a fee is due, for the handling and control of the payment process between the Careplan provider – in this case ONCARE – and the Careplan user. Types of data: First name, last name, contact data, bank details.
Justification of processing: The legal basis for the processing of usage and system data, as well as commercial Store data, is Art. 6(1)(b) GDPR – the processing of the data serves the performance of the contract between Careplan user and Careplan provider – in this case ONCARE.
Only applicable if your connected app users consent to the data transfer and activate it.
ONCARE provides you with the technical possibilities to enable app users via myoncare tools to connect the myoncare app with certain health apps (e.g., AppleHealth, GoogleFit, Withings) (“Health app”), provided that these are used by the app user and the connection is established by the app user.
If the connection is established and the app user has consented to and activated the data transfer, the activity data collected by the health app is made available to you via the myoncare platform. The collection and forwarding of the activity data is the responsibility of your patients.
Types of data: The type and scope of transferred data depend on the decision of the app users. The data includes, among other things, weight, height, steps taken, calories burned, hours of sleep, heart rate and blood pressure.
Purpose of processing activity data: The activity data of the app user is made available to you in order to provide additional contextual information regarding the activity of the app user. Please note that activity data is not validated by the myoncare tools and should not be used for diagnostic purposes or as a basis for medical decisions.
Justification of processing the activity data: The data controller for the activity data of the app user that you receive via the platform is you as the healthcare provider. We process this personal data as part of an agreement with you and in accordance with your instructions. Please process your patients’ data only if you have obtained the required data consent from these patients. ONCARE acts as a processor in accordance with the separate data processing agreement that we have concluded with you on the basis of Art. 28 GDPR.
(Only applicable if you use the medical device variant of the myoncare tools)
The myoncare platform and the myoncare app are classified and marketed as a medical device in accordance with European medical device regulations. As manufacturer of the myoncare tools, we must comply with certain legal obligations (e.g., monitoring the functionality of the tool, evaluating incident reports that could be related to the use of the tool, tracking users, etc.). In addition, the myoncare tools enable you to collect personal data about certain medical devices or medicines used in the treatment of your patients. The manufacturers of such medical devices or medicines also have legal obligations regarding postmarket surveillance (e.g., collection and evaluation of reports of side effects).
ONCARE is the data controller for the processing of product safety data.
Types of data: Case reports, personal data stated in an incident report, and results of the assessment, details about the reporter.
Processing of product safety data: We store and evaluate all personal data in connection with our legal obligations as the manufacturer of a medical device and transmit this personal data (where possible after pseudonymization) to competent authorities, notified bodies, or other data controllers with supervisory obligations. In addition, we store and transmit personal data in connection with medical devices and/or medicines if we receive communications from you as the reporter of such information, from your patient or from third parties (e.g., our distribution partners or importers of the myoncare tools in your country) that must be reported to the manufacturer of the product so that it can meet its legal obligations for product safety.
Justification for the processing of product safety data: The legal basis for the processing of personal data to fulfill legal obligations as a manufacturer of medical devices or medicines is Art. 6(1)(c), Art. 9(2)(i) GDPR in conjunction with the postmarket surveillance obligations under the Medical Devices Act and the Medical Devices Directive (regulated from May 26, 2021 in Chapter VII of the new Medical Device Regulation (EU) 2017/745) and/or the Medicinal Products Act.
Supplement to the disclaimer for side effects: ONCARE does not assume any medical assessment of the transmitted content and is not obliged to forward medicinal-product-law-relevant information such as side effects, application errors or product defects to authorities. This responsibility lies exclusively with the treating healthcare providers or – if affected – with the respective manufacturers of the products used.
If you use medical additional functions via the platform such as integrated diagnostics, vital data collection or laboratory services, personal health data may be collected and processed by external third-party providers (e.g., medical device manufacturers or laboratory service providers). This is done to support medical care and always on the basis of an explicit consent or a treatment relationship.
Processing takes place either within the framework of processing on behalf or – depending on the provider – under the provider’s own responsibility under data protection law. ONCARE provides only the technical connection for this purpose, without controlling content or medically evaluating it. Further information on the respective data processing can be obtained directly from the treating healthcare provider or via the privacy information of the integrated third-party providers.
The myoncare platform offers registered healthcare providers (e.g., physicians) the possibility to offer, configure and assign digital care pathways (“Pathways”) individually to patients via a webshop functionality (e.g., in cooperation with myon.clinic).
Within the use of this functionality, personal data – in particular health data – is processed, for example information on indication, recommended treatment duration or Pathway assignment. This data processing serves the individualization and assignment of medical content and is carried out on the basis of Art. 6(1)(b) as well as Art. 9(2)(h) GDPR.
ONCARE provides the technical infrastructure and processes the data concerned as the controller within the meaning of Art. 4(7) GDPR insofar as the respective processing is necessary for the provision of the platform functions. The content selection and medical design of the Pathways, however, lies exclusively with the respective healthcare provider.
Insofar as billing or data transmission to third parties (e.g., billing entities or platform partners such as myon.clinic) takes place, such processing takes place only on the basis of corresponding agreements or statutory provisions.
(Only applicable if you use myoncare tools for reimbursements)
The myoncare platform supports you in initiating your standard procedures for reimbursement of the healthcare services that you provided to your patients via the myoncare app. In order to enable the reimbursement process, the myoncare platform supports the capture of the personal (health-related) data of your patients from the myoncare platform to facilitate the transmission of this data to the patient’s payors within the framework of the standard reimbursement processes (either your Association of Statutory Health Insurance Physicians and/or the patient’s health insurance). You are the data controller for the reimbursement data and responsible for compliance with data protection regulations for processing your patients’ personal data in the reimbursement process. ONCARE acts as a processor on the basis of the data processing agreement with the healthcare provider.
Types of data: Patient’s first and last name, diagnosis, indications, treatment, treatment duration, other data required for the administration of reimbursement.
Processing of reimbursement data: You, as controller, transmit the patient’s treatment data required for reimbursement to the payor (either your health insurer and/or the patient’s health insurer) and the payor processes the reimbursement data in order to reimburse you.
Justification for the processing of reimbursement data: The processing of reimbursement data is carried out on the basis of Sections 295, 301 SGB V. The processing of data by ONCARE for you is also carried out on the basis of Art. 28 GDPR (data processing agreement).
The myoncare platform functions as a web-based tool for which you need a working internet connection and a current version of the internet browser Chrome, Firefox or Safari.
The provision, operation and maintenance of the myoncare platform as well as the myoncare app take place via cloud-based technical infrastructures.
Depending on the customer, contractual setup, regulatory environment and country of use, ONCARE uses different hosting and cloud service providers for this purpose.
All providers used are carefully selected in advance and contractually obligated as processors pursuant to Art. 28 GDPR. Selection is made taking into account recognized technical and organizational security standards (in particular encryption, access control, availability and data backup).
The processing of personal data generally takes place within the European Union or the European Economic Area. Processing in third countries takes place only if appropriate safeguards pursuant to Art. 44 et seq. GDPR exist (e.g., adequacy decision, EU Standard Contractual Clauses).
Information about the hosting or cloud service providers used in the specific individual case will be made available to healthcare providers upon request in an appropriate form.
To ensure the security, availability and performance of the myoncare platform, ONCARE uses the Cloudflare service. Provider is: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany (parent company: Cloudflare Inc., USA)
Cloudflare acts as:
• Content Delivery Network (CDN)
• Protection mechanism against cyberattacks (e.g., DDoS protection)
• Security and performance optimization service
In this context, the following technically required access data may be processed in particular:
• IP address
• Timestamp
• content accessed
• browser and device information
• security-relevant log data
Processing takes place exclusively for:
• ensuring IT security
• defending against unauthorized access
• ensuring system stability
• performance optimization
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in securing sensitive health data and the platform infrastructure). Cloudflare is used as a processor pursuant to Art. 28 GDPR.
Insofar as personal data is transferred to the USA, this takes place on the basis of:
• the EU-U.S. Data Privacy Framework (DPF),
• supplementary EU Standard Contractual Clauses pursuant to Art. 46 GDPR. Further information can be found at: https://www.cloudflare.com/privacypolicy
The use of Cloudflare serves exclusively technical security purposes. No content analysis of medical data is carried out by Cloudflare.
We use Brevo (provided by Sendinblue GmbH, based at Köpenicker Straße 126, 10179 Berlin) and Sendgrid (provided by Twilio Inc., 1801 California Street Suite 500, Denver, CO 80202, USA). These e-mail services may be used to organize the sending of e-mails. Sendgrid is used to send confirmation e-mails, transaction confirmations and e-mails with important information on requests. The data you enter for the purpose of receiving e-mails is stored on Sendgrid’s servers. If we send emails via SendGrid on your behalf, we use an SSL-secured connection.
E-mail communication is used for the following tasks:
• First-time login to the web application;
• Resetting the password for the web application;
• Creating an account for the patient application;
• Resetting the password for the patient application;
• Creation and dispatch of a report;
The data that you provide to us for receiving e-mails is stored by us until you unsubscribe from our services and is deleted after your unsubscription both from our servers and from Sendgrid’s servers.
Brevo by Sendinblue GmbH (privacy policy):
Datenschutzerklärung - Schutz personenbezogener Daten | Brevo
SendGrid by Twilio Inc.
https://sendgrid.com/resource/general-data-protection-regulation-2/
This is an open-source web analytics tool. No data is transmitted to servers that are outside of ONCARE’s control. Matomo is initially disabled when you use our services. Only if you agree will your user behavior be recorded in anonymized form. If this is disabled, a “permanent cookie” is stored, provided your browser settings allow this. This cookie signals to Matomo that you do not want your browser to be recorded.
The usage information collected by the cookie is transmitted to our servers and stored there so that we can analyze user behavior.
The information generated by the cookie about your use is:
- user’s operating system;
- user’s geolocation;
- browser;
- role;
- IP address;
- websites visited via the web / PWA (further information can be found in the section on PWA in this privacy policy);
- buttons that the user clicks on the myoncare platform, in the myoncare app and in the myoncare PWA. The information generated by the cookie is not passed on to third parties.
You can refuse the use of cookies by adjusting the corresponding settings in your browser. Please note, however, that in this case you may not be able to use all functions. Further information can be found at: https://matomo.org/privacy-policy/
Legal basis for processing the users’ personal data is Art. 6(1) sentence 1 lit. a GDPR. The processing of users’ personal data enables us to analyze usage behavior. By evaluating the data obtained, we are able to compile information about the use of the individual components of our services. This helps us to continuously improve our services and their usability.
We process and store personal data only as long as it is necessary to fulfill the intended purpose.
We implement appropriate technical and organizational security measures to optimally protect your personal data stored with us against accidental or intentional manipulation, loss, destruction or against access by unauthorized persons. The security levels are continuously reviewed in cooperation with security experts and adapted to new security standards.
Data exchange to and from the platform as well as to and from the app is encrypted. We offer SSL as the encryption protocol for secure data transmission. Data exchange is also encrypted throughout and takes place with pseudo keys.
Disclosure of your personal data to third parties takes place only within the framework of statutory provisions or on the basis of your consent. In all other cases, information is not passed on to third parties unless we are obliged to do so due to mandatory legal provisions (disclosure to external bodies, including supervisory or law enforcement authorities).
Any transfer of personal data is encrypted during transmission.
The information on how we handle the personal (health) data of your patients who use the myoncare app is summarized in a separate privacy policy for the myoncare patient app. You can find the privacy policy for patients here.
Please also read this privacy policy for patients carefully. For part of the processing of patient data, you are the controller responsible for compliance with data protection.
The ONCARE GmbH privacy policy serves to inform you in accordance with Art. 13 GDPR about the processing of your personal data as a user of the myoncare platform (e.g., contact, account, and usage data).
If your consent is required for individual processing of your own data, this will be obtained separately and expressly. Consent that has been given can be revoked at any time with effect for the future; the legality of the processing carried out up to that point remains unaffected. You can manage your consent after registering in the account settings of the myoncare platform.
If you process your patients' personal data via the myoncare platform, you act as the data controller within the meaning of Art. 4 No. 7 GDPR. ONCARE GmbH processes this data exclusively on your behalf and according to your instructions as a processor in accordance with Art. 28 GDPR. The basis for this is the data processing agreement to be concluded between you and ONCARE GmbH, if applicable.
Within our organization, we ensure that only those persons are authorized to process personal data who are obliged to do so in order to fulfill their contractual and legal obligations.
In certain cases, service providers support our specialist departments in fulfilling their tasks. The required data protection agreements have been concluded with all service providers who are processors for personal data. These service providers are cloud hosting service providers and support service providers.
Our cloud hosting services provide the isolated server domain of the myoncare platform in which both your personal data and that of your patients are stored. The server domain also hosts the myoncare video and file management service, which enables encrypted video conferences and data exchange between you and your patient. Access to your personal data by you and your patient is ensured by sending specific tokens. This personal data is encrypted during transmission and pseudonymized for ONCARE and its service providers during transmission and at rest. ONCARE’s service providers have no access to this personal data at any time.
Furthermore, we use service providers to process service requests (support service providers) regarding the use of the account, e.g., if you forgot your password, want to change your stored e-mail address, etc. The required data processing agreements have been concluded with these service providers; in addition, the employees entrusted with processing service requests have been trained accordingly. After receipt of your service request, a ticket number is assigned to you.
If it is a service request regarding your account use, the relevant information that you provided to us when contacting us is forwarded to one of the authorized employees of the external service. He will then contact you. Otherwise, they remain processed by specifically authorized ONCARE employees, as described under “PROCESSING OF OPERATIONAL DATA”.
Via our support service providers, we use the tool RepairCode, also known as Digital Twin Code. This is a customer experience platform for processing external feedback with the possibility to create support tickets. Here you can find the privacy policy: https://app.repaircode.de/?main=main-client – Rechtliches/privacy.
Finally, we display content from Instagram (provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) (e.g., images, videos or posts). If you click on a linked Instagram post, you will be redirected to Instagram. In doing so, Instagram may set cookies and process usage data.
If you access a page with a linked Instagram post, your browser may automatically establish a connection to Instagram’s servers. Instagram thereby receives the information that you have visited our website, even if you do not have an Instagram account or are not logged in. If you are logged in, Instagram can associate the visit with your user account. Privacy policy: https://privacycenter.instagram.com/policy
To provide our services, we may use service providers that are located outside the European Union. If data is transferred to a third country in which the protection for personal data has been assessed as not adequate, we ensure that appropriate measures are taken in accordance with national and European law and that – if required – corresponding standard contractual clauses have been agreed between the processing parties.
Personal data collected by the myoncare platform or the myoncare app is not stored in the app stores. A transfer of personal data to third countries (outside the European Union or the European Economic Area) takes place only if this is necessary to fulfill the contractual obligation, is required by law, or you have given us your consent.
For analysis purposes, the e-mails sent with Brevo or SendGrid contain a so-called “counting pixel” that connects to the servers of Brevo or Sendgrid when the e-mail is opened. This makes it possible to determine whether an e-mail message has been opened.
Legal basis: Data processing takes place on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.
Please note that your e-mails are transmitted by us to a Brevo server in Germany or to a SendGrid server in the USA and stored there. We have concluded a contract with Sendgrid that contains the EU Standard Contractual Clauses. This ensures that a level of protection exists that is comparable to that of the EU.
We integrate content from Instagram provided by Meta Platforms Ireland Ltd. If you click a linked Instagram post, it is possible that personal data (e.g., IP address, browser information, interactions) is transmitted to Meta Platforms Inc. in the USA or other third countries.
Meta is certified under the EU-U.S. Data Privacy Framework (DPF), whereby an adequate level of data protection is recognized for the transfer to the USA. Nevertheless, data may also be transferred to countries for which there is no adequacy decision of the European Commission. In such cases, additional safeguards may be necessary, the effectiveness of which, however, cannot always be guaranteed.
For the processing of activity data, interfaces to Google Cloud services (in the case of GoogleFit) or to AppleHealth or Withings are used on the mobile device of the app user. The myoncare tools use these interfaces provided by Google, Apple and Withings in order to request activity data from the connected health apps. The request sent by the myoncare tools contains no personal data. Personal data is provided to the myoncare tools via these interfaces.
We store your personal data for as long as it is required for the purpose for which it is processed. Please note that numerous retention periods require further storage of personal data. This applies in particular to retention obligations under commercial or tax law.
Please note that ONCARE is also subject to retention obligations that are contractually agreed with you due to statutory provisions. In addition, due to the classification and, if applicable, your use of the myoncare platform and the myoncare app as a medical device, certain retention periods apply for the platform that arise from the Medical Devices Act. If no other retention obligations exist, personal data is routinely deleted once the purpose has been achieved.
In addition, we may store personal data if you have given us your consent to do so or if there is a legal dispute and we use evidence within the statutory limitation periods, which can be up to 30 years; the regular limitation period is three years.
We do not use purely automated processing to make decisions.
For the establishment, implementation and termination of the contractual relationship and the fulfillment of the associated contractual and legal obligations, various personal data are required. The same applies to the use of our myoncare platform and the various functions that it offers.
In certain cases, personal data must also be collected or made available in accordance with statutory provisions. Please note that without the provision of this personal data it is not possible to process your request or fulfill the underlying contractual obligation.
We would like to inform you about your rights as a data subject. These rights are set out in Articles 15 to 22 GDPR and include:
Right of access (Art. 15 GDPR): You have the right to request information about whether and how your personal data is processed, including information about the purposes of processing, recipients, storage period as well as your rights to rectification, erasure and objection. You also have the right to receive a copy of all personal data that we have stored about you.
Right to erasure / right to be forgotten (Art. 17 GDPR): You may request that your personal data collected and processed by us be deleted without undue delay. In this case, we will ask you to delete the myoncare platform from your computer. Please note, however, that we can delete your personal data only after expiry of the statutory retention periods.
Right to rectification (Art. 16 GDPR): You may request that we update or correct inaccurate personal data concerning you or complete incomplete personal data.
Right to data portability (Art. 20 GDPR): In principle, you may request that we provide you with personal data that you have provided to us and that is processed in an automated manner on the basis of your consent or the performance of a contract with you in machine-readable form so that it can be “ported” to a replacement service provider.
Right to restriction of data processing (Art. 18 GDPR): You have the right to request restriction of the processing of your personal data if the accuracy of the data is disputed, processing is unlawful, the data is required for the assertion of legal claims, or an objection to the processing is being examined.
Right to object to data processing (Art. 21 GDPR): You have the right to object to our use of your personal data and to withdraw your consent at any time if we process your personal data on the basis of your consent. We will continue to provide our services even if they are not dependent on a withdrawn consent.
To exercise these rights, please contact us at: privacy@myoncare.com . Objection and withdrawal of consent must be submitted in text form to privacy@myoncare.com .
We require sufficient proof of your identity to ensure that your rights are protected and that your personal data is disclosed only to you and not to third parties.
Please also contact us at any time at privacy@myoncare.com if you have questions about data processing in our company or if you wish to withdraw your consent. You also have the right to contact the competent data protection supervisory authority.
The myoncare platform can be provided with so-called hyperlinks by Oncare GmbH itself as well as by the respective healthcare provider. Hyperlinks enable users, by clicking, to access external websites or content from third-party providers (e.g., podcasts, videos, information pages).
When clicking such a hyperlink, the user leaves the myoncare platform. The external nature of the link is intended to be made recognizable for the user, for example by notices such as “external link”, “Further content (external provider)” or “Video on an external platform”.
For the contents of the linked external websites as well as for the processing of personal data there, the respective third-party provider is solely responsible under data protection law. Oncare GmbH has no influence on the design, contents or data protection practices of external websites and assumes no responsibility for them.
The processing operations of personal data described in this privacy policy apply exclusively to the use of the myoncare platform. For data processing on linked external websites, the respective privacy notices and terms of use of the third-party providers apply.
Insofar as healthcare providers independently set hyperlinks to external content within the scope of using the platform, this takes place under their own responsibility under data protection law.
For displaying PDF documents within our application, we use an online service of Adobe Inc., 345 Park Avenue, San Jose, CA 95110-2704, USA (“Adobe”).
When calling up a PDF document, a connection is established to Adobe’s servers. In doing so, technical access data (e.g., IP address, device and browser information) may be processed in particular. Processing takes place exclusively for the purpose of technically reliable display of PDF files.
Adobe processes personal data under its own responsibility under data protection law. We have no influence on the type, scope and further use of the data processed by Adobe.
It cannot be ruled out that processing of data takes place in the USA. Adobe is certified under the EU-U.S. Data Privacy Framework and additionally uses appropriate safeguards pursuant to Art. 46 GDPR.
Further information on data processing by Adobe can be found in Adobe’s privacy policy at: https://www.adobe.com/de/privacy/policy.html
Webfonts may be used for the display of fonts and for consistent visual design of the user interface.
Insofar as external services are used to provide fonts (e.g., Google Fonts), this takes place exclusively in compliance with the legal requirements of Art. 44 et seq. GDPR.
Processing is limited to technically necessary access data (e.g., IP address, browser information, device type, URL accessed) and serves exclusively the functional and user-friendly display of the platform.
You can reach our Data Protection Officer for all questions about data protection at privacy@myoncare.com.
We expressly reserve the right to change this privacy policy in the future at our own discretion. Changes or additions may, for example, be necessary to comply with legal requirements, to take technical and economic developments into account, or to meet the interests of app or platform users. Changes are possible at any time and will be communicated to you in an appropriate manner and within a reasonable time frame before they take effect (e.g., by publishing a revised privacy policy at login or by advance notice of material changes).
ONCARE GmbH Postal address: Balanstraße 71a, 81541 Munich, Germany
T | +49 (0) 89 4445 1156 E | privacy@myoncare.com
Contact details of the Data Protection Officer privacy@myoncare.com
If medical content or services are obtained or offered via the integrated myon.clinic Store, the content-related and commercial responsibility lies with myon.clinic GmbH, a subsidiary of Oncare GmbH. In this context, Oncare GmbH provides exclusively the technical platform. privacy@myon.clinic
In case of interpretation questions or disputes, only the German version of the privacy policy is binding and decisive. STATUS March 2026
* * *
The following are supplementary data protection provisions for healthcare providers who operate in the United States of America as a Covered Entity or on behalf of such within the scope of a HIPAA-mandatory activity:
The protection of personal health information (PHI) under HIPAA applies exclusively if this data is processed within the U.S.
healthcare system by a so-called Covered Entity or a Business Associate – regardless of the nationality or residence of the data subject. The decisive factor is solely that the processing falls within the scope of HIPAA.
This privacy policy applies uniformly to all healthcare providers who use the myoncare platform.
Data protection responsibility as well as liability attribution, however, are determined exclusively by the respective country of use of the platform and the underlying contractual relationship.
• For healthcare providers with registered office or activity within the European Union or the European Economic Area, exclusively
is the controller under data protection law within the meaning of the GDPR.
• For healthcare providers with registered office or activity in the United States of America as well as for any HIPAAmandatory use, exclusively myoncare Inc. is the controller under data protection law, liable entity and – where applicable – Business Associate within the meaning of HIPAA.
In these cases, the respective other company is neither controller nor processor nor liable party.
For healthcare providers in the USA or in case of HIPAA-mandatory use, exclusively myoncare Inc. (“MYONCARE INC.”) is responsible and liable.
ONCARE GmbH assumes no data protection or liability responsibility in these cases.
This annex is not an independent privacy notice and does not establish an independent data protection or liability responsibility of ONCARE GmbH.
It supplements the above privacy policy exclusively for the special case of HIPAA-relevant use and applies only within the framework of an existing contractual relationship with MYONCARE INC.
This HIPAA supplement applies to healthcare providers who process, store or transmit Protected Health Information (PHI) via the myoncare platform, provided and insofar as
• a HIPAA-regulated contractual partner (Covered Entity) is involved and the respective processing falls under a HIPAA-relevant contractual relationship in which MYONCARE INC. acts as
• Business Associate or as Sub-Business Associate.
Application of this annex outside such a HIPAA-relevant contractual relationship is excluded.
Insofar as this annex applies, MYONCARE INC. acts depending on contract and function as
• Business Associate or
• Sub-Business Associate
within the meaning of the HIPAA Privacy Rule (45 CFR § 160.103).
The respective role results exclusively from the specific underlying HIPAA-compliant contractual relationship, in particular from a Business Associate Agreement (BAA).
ONCARE GmbH
• is not a Covered Entity
• not a Business Associate and
• not a Sub-Business Associate within the meaning of HIPAA,
and is not a party to a HIPAA-relevant contractual relationship.
It assumes no duties, responsibilities or liability under U.S. data protection or health law, in particular not under HIPAA.
The respective healthcare provider acts – depending on the contractual integration – either
• as a Workforce Member of the Covered Entity or
• as an external service provider of the Covered Entity or of a Business Associate
within the meaning of 45 CFR § 160.103 et seq.
An independent role as Business Associate is not established by this annex.
Use of the myoncare platform by healthcare providers via MYONCARE INC. takes place exclusively on the basis of existing HIPAA-compliant agreements with the respective Covered Entity.
Processing includes in particular:
• documentation of treatment courses and medical services,
• communication with patients via HIPAA-compliant communication channels (e.g., TLS-secured transmission),
• access to structured patient data for medical care or quality assurance.
Healthcare providers undertake to treat all PHI as confidential and to restrict access to PHI to the required extent in accordance with the Minimum Necessary Standard (45 CFR § 164.502(b)).
Access takes place exclusively role-based and is logged in an auditable manner.
MYONCARE INC. implements technical and organizational measures in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C), in particular:
• encryption of stored data (e.g., AES-256),
• encrypted data transmission (e.g., TLS),
• multi-factor authentication,
• regular risk analyses pursuant to 45 CFR § 164.308(a)(1)(ii)(A),
• documented incident response processes.
Access to or processing of PHI outside the United States (e.g., hosting within the EU) takes place exclusively:
• on the basis of HIPAA-compliant contractual safeguards (e.g., Sub-BAA),
• with documented consent of the Covered Entity,
• in compliance with the HIPAA Security Rule as well as supplementary international standards (e.g., ISO 27001),
• with end-to-end encryption and access control.
Healthcare providers are obliged to inform MYONCARE INC. without undue delay of any incident that could lead to unauthorized access to PHI (Security Incident or Breach pursuant to 45 CFR §§ 164.304, 164.402).
MYONCARE INC. coordinates the legally required notifications to the Covered Entity.
The Covered Entity is entitled, within the framework of an audit, to verify compliance with HIPAA requirements by MYONCARE INC. and involved healthcare providers.
Healthcare providers assure their full cooperation for this purpose.
Disclosure of PHI outside the myoncare platform is permitted only if
• a valid Authorization pursuant to 45 CFR § 164.508 exists or
• disclosure is expressly provided for contractually.
In the event of a contradiction between this HIPAA supplement and other data protection provisions, the stricter provision applies insofar as this is legally permissible.
Healthcare providers support MYONCARE INC. and the Covered Entity in fulfilling data subject rights pursuant to 45 CFR §§ 164.524–528, in particular with:
• Accounting of Disclosures,
• correction of erroneous PHI,
• implementation of restrictions on use.
Coordination takes place via MYONCARE INC.
Healthcare providers conduct at least annually a documented training on HIPAA and – where applicable – GDPR requirements. MYONCARE INC. can provide training materials or e-learning access for this purpose.
Use of PHI for research, analysis or marketing purposes is inadmissible unless
• a valid Authorization pursuant to 45 CFR § 164.508 exists or
• a separate HIPAA-compliant research data use agreement exists.
In case of simultaneous applicability of GDPR and HIPAA, MYONCARE INC. ensures coordination of obligations.
Healthcare providers undertake in particular not to carry out third-country transfers without appropriate safeguards.
In addition to HIPAA, state data protection laws (e.g., CCPA/CPRA, SHIELD Act, BIPA) may apply. MYONCARE INC. provides supplementary notes upon request.
Personal data of platform users is not processed for marketing or research purposes.
MYONCARE INC. uses exclusively fully anonymized (“de-identified” according to 45 CFR §164.514(a)–(c)”technical usage data that does not constitute PHI.
For older versions: Archive
---
for the use of the myoncare mobile app and the myoncare Progressive Web App/PWA Status March 2026
The protection of your personal data, in particular your health data, is our highest priority. In this privacy notice, we transparently inform you about how personal data is processed when using the myoncare mobile app and the myoncare Progressive Web App/PWA (together referred to as myoncare “MOBILE”).
This Privacy Notice explains how personal data are processed when you use the myoncare mobile app or the myoncare PWA as part of your care or services provided by a service provider (e.g., a medical practice, clinic, therapy facility, or other medical or non-medical providers of health, prevention, advisory, or care services). In particular, you will receive information about who is responsible for which processing activities, which data are affected, for what purposes the data are processed, and what rights you have.
With myoncare, two entities are typically involved:
Your healthcare provider (e.g., your medical practice/clinic/medical facility): It decides on the purposes and means of processing your treatment and health data and is therefore the controller under data protection law (Art. 4(7) GDPR).
ONCARE GmbH (“ONCARE”): It provides the technical applications (mobile app/PWA) and, as a rule, processes treatment and health data exclusively on behalf of your healthcare provider as a processor (Art. 28 GDPR).
Important: The privacy notices shown to you during digital onboarding, as well as the collection of any required consents (e.g., for certain additional functions), are carried out exclusively in the name and under the responsibility of your healthcare provider. ONCARE has no influence on the content of your healthcare provider’s privacy notices or on whether and which consents are collected.
ONCARE does not make independent decisions about the purposes and means of processing treatment or health data. There is therefore no joint controllership within the meaning of Art. 26 GDPR in this respect.
In certain cases, ONCARE also processes data under its own responsibility, in particular where this is necessary for the secure technical operation of the app/platform (e.g., IT security, abuse prevention, provision of basic platform functions). In such cases, ONCARE is the controller within the meaning of the GDPR; its contact details are as follows:
The contact details of your healthcare provider (including data protection contact/data protection officer, if any) can be found in the privacy information provided by your healthcare provider (e.g., in the practice, on the website, or within onboarding).
ONCARE GmbH
Postal address: Balanstraße 71a, 81541 Munich, Germany
E-mail: privacy@myoncare.com
Telephone: +49 (0) 89 4445 1156
You can reach ONCARE’s Data Protection Officer at: privacy@myoncare.com
Medical personal data is not used for commercial or advertising purposes.
This does not affect if applicable the use of fully anonymized data where no personal reference exists anymore and reidentification is excluded according to the state of the art.
Such anonymized data is not subject to the GDPR and may if applicable be analyzed, combined, disclosed to third parties, or sold by ONCARE for scientific, statistical, regulatory, quality assurance, and commercial purposes.
Such data does not contain any information that would allow conclusions to be drawn about individual persons.
Depending on how the app/platform is used, the following data may be processed in particular—by category:
Master data and contact data (e.g., name, date of birth, address, health insurer, insurance number, e-mail address, phone number).
Account and usage data (e.g., login information, IP address, language settings, device information, log data). Treatment and health data (special categories of personal data, Art. 9(1) GDPR), e.g., symptoms, photos, medication, questionnaire responses, diagnoses, therapies, treatment plans, progress and monitoring data, as well as completed/planned tasks.
Communication content (e.g., messages/approvals between you and the healthcare provider, insofar as the function is used).
Your healthcare provider uses myoncare to onboard you digitally, to carry out your medical treatment and care, and to communicate with you.
In doing so, your healthcare provider processes your personal data and—where necessary—health data, e.g., information on symptoms, diagnoses, therapies, medications, treatment plans, reminders, document/file exchange, questionnaires, monitoring. ONCARE processes this data on behalf of and under the instructions of the healthcare provider.
The legal bases are the responsibility of your healthcare provider. Typically applicable are:
• Art. 6(1)(b) GDPR (performance of the treatment contract or pre-contractual measures), and
• for health data Art. 9(2)(h) GDPR (healthcare/treatment) in conjunction with the applicable professional and statutory obligations.
Where consent is required for individual functions (e.g., optional additional services), your healthcare provider obtains and manages this consent. You can withdraw consent at any time with effect for the future; details can be found in your healthcare provider’s information.
Where functions to support reimbursement or billing processes are used via the platform, your healthcare provider processes the data required for this under its own responsibility. ONCARE processes this data exclusively as a processor pursuant to Art. 28 GDPR.
ONCARE processes certain data to ensure the secure technical operation of the app/platform, detect disruptions, and prevent unauthorized access.
This includes in particular:
• technical log data (e.g., times of access, device/browser information),
• security and access data (e.g., for authentication/password reset),
• an IP-based coarse geolocation to verify authorization to use and to detect unauthorized access (country/region only; no GPS data, no movement profiles).
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in IT security and protection of particularly sensitive health data). Location data is used only selectively during the login process. Only the IP address and the coarse location information derived from it (e.g., country or region) are processed. No precise location data (e.g., GPS data), movement profiles, or permanent localization takes place. There is no merging of location data with other personal data and no profiling.
For certain functions (e.g., account creation, password reset, important system information, dispatch of reports), e-mails are sent. ONCARE uses e-mail service providers for this purpose. Content relating to your healthcare provider’s medical communication is processed only under its instructions.
To the extent the myoncare app/platform is operated as a medical device within the meaning of applicable European medical device regulations (e.g., Regulation (EU) 2017/745 – MDR), ONCARE is legally obliged to carry out market surveillance, product safety measures and to report serious incidents.
For this purpose, ONCARE may process personal data, including health data, to the extent necessary to fulfil these legal obligations.
The legal basis is
Art. 6(1)(c) GDPR (compliance with a legal obligation) in conjunction with Art. 9(2)(i) GDPR (reasons of public interest in the area of public health).
Within this scope, ONCARE acts independently as the controller.
If you voluntarily establish a connection to an external device or a health platform (e.g., wearable, fitness tracker, blood pressure monitor), activity or vital data may be transmitted to the platform.
This may include in particular:
• step counts
• sleep data
• heart rate
• blood pressure values
• other health parameters provided by the respective system.
Processing is carried out exclusively on the basis of your prior explicit consent pursuant to Art. 6(1)(a) GDPR and Art. 9(2)(a)
GDPR.
Consent is voluntary and can be withdrawn at any time with effect for the future. ONCARE processes this data exclusively on behalf of the respective healthcare provider.
Data is disclosed only if necessary (e.g., for operating the services), permitted by law, or if you/the healthcare provider have consented. Recipients may include in particular:
• Your healthcare provider and its authorized staff.
• ONCARE’s technical service providers (sub-processors) for hosting, maintenance, support, e-mail dispatch—each contractually bound under Art. 28 GDPR.
• Service providers that process data under their own responsibility, e.g., Adobe when opening PDFs via an online service.
Depending on the customer, contractual setup, regulatory environment and country of use, ONCARE uses different hosting and cloud service providers. A logically separated system environment is operated for each healthcare provider. Personal data is stored in isolated server areas so that no commingling with data of other healthcare providers occurs.
Processing generally takes place within the EU/EEA. A transfer of personal data to countries outside the European Union or the European Economic Area takes place only if appropriate safeguards pursuant to Art. 44 et seq. GDPR exist (e.g., Data Privacy Framework (DPF) or EU Standard Contractual Clauses). Where necessary, supplementary safeguards are implemented.
For the secure and high-performance provision of the myoncare mobile app and the Progressive Web App (PWA), ONCARE uses the Cloudflare service.
Provider: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany (parent company: Cloudflare Inc., USA).
Cloudflare is used as a so-called Content Delivery Network (CDN) and to protect against attacks (e.g., DDoS attacks). In doing so, the following technically required data may be processed in particular:
• IP address
• date and time of access
• content accessed
• browser and device information
• log data for attack detection
Processing is carried out exclusively for the purpose of:
• ensuring system security
• defending against cyberattacks
• ensuring availability
• optimizing loading speed and platform stability
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in IT security and protection of particularly sensitive health data).
Cloudflare is used as a processor pursuant to Art. 28 GDPR. A corresponding data processing agreement exists.
Personal data may also be processed in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework (DPF). In addition, appropriate safeguards pursuant to Art. 44 et seq. GDPR (in particular EU Standard Contractual Clauses) have been concluded.
The retention period for technically required log data is limited to the necessary minimum and is generally less than 24 hours unless a security-relevant evaluation is required.
Further information can be found at: https://www.cloudflare.com/privacypolicy.
The use of Cloudflare serves exclusively technical security purposes. Cloudflare does not perform any content analysis of medical data.
For technical synchronization between the myoncare app and your healthcare provider’s platform, the Google Firebase service (Google Ireland Ltd., Dublin, Ireland) is used.
Only the data required for synchronization is processed. Processing is pseudonymized and encrypted. A direct assignment to your person is not possible for ONCARE and the technical service providers used.
Google is used as a processor pursuant to Art. 28 GDPR.
ONCARE uses Brevo (Sendinblue GmbH, Berlin) and SendGrid (Twilio Inc., USA) for the organizational sending of e-mails. Brevo or SendGrid may be used for transactional/confirmation e-mails. Data may be stored on the servers of the respective providers; with SendGrid, processing in the USA is possible. In these cases, appropriate safeguards pursuant to Art. 44 et seq. GDPR are used (e.g., EU Standard Contractual Clauses).
If PDF documents are displayed within the app/platform via an Adobe online service, Adobe processes personal data under its own responsibility under data protection law. It cannot be ruled out that processing in the USA may also take place. Further information can be found in Adobe’s privacy notice.
The app/platform may contain links to external content (e.g., videos, podcasts, social media posts). By clicking on them, you leave the myoncare environment; the respective provider is responsible for data processing on the linked pages. When accessing such content, your browser may establish a direct connection to Instagram servers. Personal data (e.g., IP address, browser information) may be processed and cookies may be set, and transfers to third countries may occur. Individual services:
• Content from the Instagram service (Meta Platforms Ireland Ltd., Dublin, Ireland) may be displayed or linked. This may also occur if you do not have an Instagram account. If you are logged in to Instagram, the visit may be associated with your user account. Further information can be found in Instagram’s privacy policy: https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect
If medical content or services are obtained or offered via the integrated myon.clinic Store, the content-related and commercial responsibility lies with myon.clinic GmbH (subsidiary of ONCARE GmbH). In this context, ONCARE provides only the technical platform. Contact: privacy@myon.clinic.
To handle technical service requests (e.g., password reset, changes to account data), ONCARE uses contractually bound support service providers. Only the account information necessary to process the request is processed.
Data processing agreements pursuant to Art. 28 GDPR exist with all support service providers. Staff are trained accordingly and bound to confidentiality.
For a consistent and user-friendly display of the content of the myoncare mobile app and the Progressive Web App (PWA), fonts (“webfonts”) may be used.
To the extent external services are used to provide fonts (e.g., Google Fonts), it may be technically necessary for your device to establish a connection to the provider’s servers when accessing the platform. Technically necessary access data (e.g., IP address, browser type, device type, URL of the page accessed, date and time of access) may be processed.
Such processing is carried out exclusively for the functional display of the user interface and not for analysis, tracking, or marketing purposes.
To the extent personal data is transferred to countries outside the European Union or the European Economic Area, this takes place exclusively in compliance with the legal requirements of Art. 44 et seq. GDPR (e.g., on the basis of the Data Privacy Framework (DPF) or EU Standard Contractual Clauses).
In order to improve the functionality and user friendliness of the myoncare Mobile App as well as the myoncare Progressive Web App PWA the analytics tool Matomo may be used. Matomo is an open source software used for the statistical evaluation of the use of the platform.
The analysis is carried out exclusively on servers under the control of ONCARE GmbH. No data is transmitted to external analytics providers.
The use of Matomo is disabled by default and will only be activated if the user expressly consents to the anonymized usage analysis.
If Matomo is activated technical usage information may be processed including in particular the operating system used the browser used the device type approximate geolocation such as country or region technical system information as well as interactions within the app or the PWA such as accessed functions or clicked buttons.
The IP address is shortened or anonymized prior to processing so that no direct personal reference can be established.
The processing is carried out exclusively for the purpose of better understanding the use of the platform improving functions and user friendliness and optimizing the technical stability and performance of the myoncare services.
If the user does not consent to the use of Matomo or withdraws such consent the user behavior will not be recorded.
The legal basis for the processing is Art. 6 para. 1 lit. a GDPR consent.
Further information is available at https://matomo.org/privacy-policy.
Within certain caretasks of the myoncare App users may optionally be offered the possibility to upload medical documents for example laboratory reports or findings in order to automatically extract the values contained therein.
This function is based on AI supported document recognition OCR Optical Character Recognition. For the technical processing an AI technology provided by Google LLC in particular Gemini may be used.
The use of this function is entirely voluntary. Users are expressly asked within the respective caretask whether they wish to use the automatic recognition. Alternatively all values can be entered manually at any time.
If a document is uploaded for automated analysis the following data may in particular be processed the uploaded document for example laboratory reports or findings the medical information contained therein for example laboratory values reference values or examination dates as well as technically required metadata for processing the document.
The processing is carried out exclusively for the purpose of automated extraction of the information contained in the document in order to facilitate the entry of medical values. The extracted data is subsequently displayed within the myoncare App and can be reviewed and confirmed by the user.
The AI used serves exclusively for technical text recognition and does not make any medical decisions.
The use of this function takes place exclusively on the basis of explicit consent. The legal basis is Art. 6 para. 1 lit. a GDPR consent as well as Art. 9 para. 2 lit. a GDPR consent to the processing of health data.
To the extent that personal data is processed by external technical services within the scope of this function a transfer to countries outside the European Union or the European Economic Area may take place. In such case the processing is carried out exclusively in compliance with the requirements of Art. 44 et seq. GDPR in particular on the basis of appropriate safeguards such as EU Standard Contractual Clauses or the EU US Data Privacy Framework.
The use of this function is voluntary and the use of the other functions of the myoncare App is also possible without using this OCR function.
ONCARE stores personal data only as long as necessary for the respective purposes and then deletes it, unless statutory retention periods prevent this. For treatment and health data, your healthcare provider’s storage and retention obligations generally apply; you will receive information on this directly from your healthcare provider. Statutory retention and documentation obligations, in particular under medical device law, commercial law or tax law, remain unaffected.
As a data subject, you have the rights set out in Art. 15 to 22 GDPR. These include in particular:
You have the right to request information on whether personal data concerning you is being processed. If so, you have the right to information about the purposes of processing, categories of personal data, recipients, storage period and your further rights. You also have the right to a copy of the personal data.
You can request the rectification of inaccurate personal data without undue delay or the completion of incomplete personal data.
You can request the erasure of your personal data provided that the legal requirements are met. Please note that statutory retention and documentation obligations—especially in the medical field—may prevent erasure.
Under the statutory conditions, you can request restriction of processing.
Where processing is based on your consent or a contract and is carried out by automated means, you have the right to receive the personal data you provided in a structured, commonly used and machine-readable format or to have it transmitted to another controller.
Where processing is based on Art. 6(1)(f) GDPR, you can object to processing on grounds relating to your particular situation.
Where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.
For the processing of your treatment and health data, your healthcare provider is the controller under data protection law. Please address related requests in principle to your healthcare provider.
ONCARE generally processes this data as a processor and supports the healthcare provider in fulfilling your rights within the framework of the data processing agreement.
Where ONCARE processes personal data under its own responsibility (e.g., for IT security or product safety purposes), you can exercise your rights at privacy@myoncare.com.
If your data is processed in the context of HIPAA-regulated treatment (see section 15), the competent Covered Entity or its Privacy Office is generally the point of contact for exercising your HIPAA rights.
To process your request, appropriate proof of identity may be required to ensure that personal data is not disclosed to unauthorized third parties.
You also have the right to lodge a complaint with a data protection supervisory authority.
Where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing up to the withdrawal remains unaffected. Please note: consents obtained by your healthcare provider (e.g., in onboarding) are generally managed via your healthcare provider.
If you use the myoncare app as part of corporate health management (e.g., your employer), certain data may be shared with the company and, where applicable, commissioned data service providers in aggregated form, without being attributable to you as a person. In this scenario, the company (or a commissioned data provider) is typically the controller; ONCARE processes the data as a processor under their instructions. Details can be found in your company’s BGM-specific information.
For managing support requests, the “RepairCode” tool (Digital Twin Code) may be used. This is a platform for structured processing of external requests. Further information can be found at: https://app.repaircode.de/?main=main-client - Rechtliches/privacy.
Where data is processed via a commissioned data service provider, this takes place exclusively on behalf of the respective controller.
ONCARE implements appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect your data against unauthorized access, loss, alteration, or disclosure. This includes in particular:
• Encrypted data transmission (TLS)
• Encrypted storage of sensitive data
• Role- and authorization-based access concepts
• Logging of security-relevant access
• Hosting in secured data centers within the EU/EEA
• Regular security reviews
• Data storage only on servers with physical access control and ISO 27001 certification
For additional protection, personal identification features are replaced by pseudonymous keys in technical processes. Reidentification is possible only within your healthcare provider’s secured system environment. Access is only possible after successful authentication using secured token procedures.
ONCARE may adapt this privacy notice, e.g., due to legal requirements or technical developments. Material changes will be communicated appropriately before taking effect (e.g., in the app/platform).
There is no solely automated decision-making within the meaning of Art. 22 GDPR. Medical decisions are made exclusively by your healthcare provider.
If your health data is processed as part of treatment that is subject to the U.S. Health Insurance Portability and Accountability Act (HIPAA), the HIPAA requirements apply in addition. HIPAA applies if a “Covered Entity” (e.g., a U.S. hospital/U.S. healthcare provider or a U.S. health insurer) is involved—regardless of the country in which you live.
In such cases, HIPAA information obligations (e.g., “Notice of Privacy Practices”) and HIPAA data subject rights are generally fulfilled by the respective Covered Entity.
Where the myoncare platform is used in a HIPAA context, the responsible U.S. group company myoncare Inc. acts as a “Business Associate” or “Sub-Business Associate” on the basis of a Business Associate Agreement (BAA). In these cases, ONCARE GmbH does not assume any responsibility under HIPAA.
For HIPAA requests (e.g., access in the form of a HIPAA “Access Request”), please contact the data protection office/Privacy Office of the treating Covered Entity; it will coordinate the processing, if necessary, with myoncare Inc.
Where both the GDPR and HIPAA apply, the respective obligations are fulfilled in a coordinated manner; responsibility for medical data processing remains with the treating entity.
***
Welcome to our website and thank you for your interest in our company. We take the protection of your personal data very seriously. We process your data in accordance with the applicable legal provisions for the protection of personal data, in particular the EU General Data Protection Regulation (EU GDPR) and the country-specific laws applicable to us, namely the Egyptian Personal Data Protection Law no. 151/2020 (the “PDPL”). With the help of this privacy notice, we inform you comprehensively about the processing of your personal data by ONCARE GmbH (hereinafter referred to as “Oncare”) when using our website and the rights to which you are entitled.
Personal data is any information that makes it possible to identify a natural person. This includes, in particular, your name, voice, photograph, identification number, date of birth, address, telephone number, email address and IP address, or any data referring to your psychological, medical, economic, cultural or social identity. Data is considered anonymous if no personal reference to the individual/ user can be made.
Responsible body and data protection officer
Postal address: Balanstr. 71a 81541 Munich
E | info@myoncare.com
Contact info of the data protection officer
Last updated on 25 April 2023.
Your rights as a data subject
We would first like to inform you of your rights as a data subject. These rights are set out in Articles 1 – 22 GDPR, and include:
To exercise these rights, please contact: privacy@myoncare.com. The same applies if you have any questions regarding data processing at our company or when you withdraw your consent. You also have the right of appeal to the relevant data protection supervisory authority.
Right to object
Please note the following with respect to your right to object:
When we process your personal data for the purpose of direct marketing, you have the right to object to this data processing at any time without providing the reasons for such objection. This also applies to profiling insofar as it is associated with direct marketing.
If you object to the processing for direct marketing purposes, we will no longer process your personal data for such purposes. The objection is free of charge and can be made in any form, if possible to: privacy@myoncare.com
Should we process your data to protect legitimate interests, you may object to such processing at any time for reasons that arise from your specific situation; this also applies to profiling based on these provisions.
We will then cease to process your personal information unless we can demonstrate compelling legitimate grounds for processing such information that outweigh your interests, rights and freedoms, or the processing is intended to assert, exercise or defend legal claims.
Purposes and legal bases of data processing
The processing of your personal data complies with the provisions of the PDPL and all other applicable data protection regulations. Legal bases for data processing arise in particular from art. 6 PDPL.
We use your data to initiate business, to fulfill contractual and legal obligations, to conduct the contractual relationship, to offer products and services and to consolidate customer relationships, which may include marketing and direct marketing.
Your consent also constitutes permission to data processing under data privacy law. In this respect, we will inform you of the purposes of data processing and your right of objection. If the consent also relates to the processing of special categories of personal data, we will explicitly notify you in the consent process.
Processing of special categories of personal data within the meaning of art. 1 PDPL as well as Art. 12 PDPL may only take place where necessary on the grounds of legal regulations and there is no reason to assume that your legitimate interests should prevail to the exclusion of processing such data or you have given your consent to the processing of these data according to art. 12 PDPL.
Google services may transfer data to countries outside of the Arab Republic of Egypt (third country data transfer), e.g. to the USA, as part of the processing for the aforementioned purposes. Countries outside of the Arab Republic of Egypt may not offer a level of data protection comparable to that in Egypt. Such countries for which the Commission has not explicitly determined that they provide an adequate level of protection with respect to data privacy are referred to as “unsafe third countries.” There is an increased risk that government authorities may access this data. We have no influence on these processing activities.
Data transfers / Disclosure to third parties
We will only transmit your data to third parties within the scope of given statutory provisions or based on consent. In all other cases, information will not be transferred to third parties unless we are obliged to do so owing to mandatory legal regulations (disclosure to external bodies, including the supervisory authorities or law enforcement authorities).
Data recipients / categories of recipients
In our organisation, we ensure that only individuals who are required to process the relevant data to fulfil their contractual and legal obligations are authorised to handle personal data.
In many cases, service providers assist our specialist departments to fulfil their tasks. The necessary data protection contracts have been concluded with all service providers.
Transfers of personal data to third countries
A transfer of data to third countries (outside the Arab Republic of Egypt) shall only take place if required by law or if you have provided your consent for such a transfer.
We transfer your personal data to service providers or group companies outside Arab Republic of Egypt as follows: United States of America.
In such cases, compliance with the required level of data protection is ensured by Egypt standard contractual clauses, the binding corporate data protection regulations of the service provider according to the established data protection contracts.
Period of data storage
We store your data for as long as such is required for the relevant processing purposes. Please note that numerous retention statutory periods require that data must be stored for a specific period of time. This relates in particular to retention obligations for commercial or fiscal purposes (e.g. commercial code, tax code, etc.). The data will be routinely deleted after use unless a further period of retention is required.
We may also retain data if you have given us your permission to do so, or in the event of any legal disputes and we use the evidence within the statutory limitation period, which may be up to 30 years; the standard limitation period is 5 years.
Secure transfer of data
We implement the appropriate technical and organisational security measures to ensure the optimal protection of the data stored by us against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. The security levels are continuously reviewed in collaboration with security experts and adapted to new security standards.
The data exchange to and from our website is encrypted. We provide https as the transmission protocol for our website and always use the latest encryption protocols. When you use the contact form on our website to get in touch with us, the content is sent via https to a secure server of Site Ground, where the data of the form is stored in an encrypted database. Site Ground employees do not have direct access to this data. It is also possible to use alternative communication channels.
Obligation to provide data
A range of personal data is required to establish, implement and terminate the obligation and the fulfilment of the relevant contractual and legal obligations. The same applies to the use of our website and the various functions we provide.
We have summarised the relevant details in the above point. In some cases, legal regulations require data to be collected or made available. Please note that it will not be possible to process your request or execute the underlying contractual obligation without this information.
Data categories, sources and origin of data
The data we process is defined by the relevant context: it depends on whether, for example, you enter a request on our contact form or if you want to send us an application or submit a complaint.
Please note that we may also provide information at specific points for specific processing situations separately where appropriate, e.g. when downloading our flyer or when making a contact request.
We collect and process the following data when you visit our website:
For reasons of technical security (in particular to safeguard against attempts to attack our web server), this data is stored in accordance with Article 6 (1) of the PDPL. Anonymisation takes place immediately by abbreviating the IP address so that no reference is made to the user.
WordPress
Oncare uses the web design platform WordPress (WordPress, Org) to manage our website and the provider Site Ground (SiteGround Spain S.L.) to host the website. For more details on the data processed by WordPress and Site Ground see sections ‘Data categories, sources and origin of data’ and ‘Secure transfer of data’ below and the privacy policy of WordPress and Site Ground.
SendGrid
We use Sendgrid for sending emails. The provider is Sendgrid Inc., 1801 California Street Suite 500, Denver, CO 80202, USA. Sendgrid is a service with which the sending of emails can be organized. Sendgrid is used to send confirmation emails, transaction confirmations and emails with important information regarding existing requests. The data you enter for the purpose of receiving emails is stored on Sendgrid’s servers. When we send email on your behalf through SendGrid, we use an SSL secured connection.
For the purpose of analysis, the e-mails sent with SendGrid contain a so-called “tracking pixel”, which connects to Sendgrid’s servers when the e-mail is opened. By this, it is possible to determine whether an email message has been opened.
Legal basis
The data processing is based on your consent (Art. 6 para. 1 PDPL). You can revoke this consent at any time. The legality of the data processing operations already carried out remains unaffected by the revocation.
Storage period
The data you provide us for the purpose of receiving emails will be stored by us until you unsubscribe from our services and will be deleted from our servers as well as from the servers of Sendgrid after you unsubscribe.
Please note that your data is usually transmitted by us to a SendGrid server in the USA and stored there. We have concluded a contract with Sendgrid incorporating the EU standard contractual clauses. This ensures that a level of protection comparable to that in Egypt exists.
SendGrid (Privacy Policy): https://sendgrid.com/resource/general-data-protection-regulation-2/
Google Fonts
We use Google Fonts provided by Google Inc on our website. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for the European area. We have embedded the Google fonts locally, on our web server – not on Google’s servers. This means that there is no connection to Google servers and therefore no data transfer or storage. This is an interactive directory of over 800 fonts that Google provides free of charge. To prevent any information transfer to Google servers, we have downloaded the fonts to our server. In this way, we act in a privacy compliant manner and do not send any data to Google Fonts.
Cookie Pro
This website uses the cookie consent tool “CookiePro” provided by OneTrust LLC, 1200 Abernathy Rd NE, Sandy Springs, GA 30328, USA (“OneTrust”) to obtain effective user consent for cookies and cookie-based applications. By integrating a corresponding JavaScript code, users are shown a banner when they access the page, in which consent can be given for certain cookies and/or cookie-based applications. The tool blocks the setting of all cookies requiring consent until the respective user gives corresponding consent. This ensures that such cookies are only set on the respective end device of the user if consent has been granted. In order to be able to clearly assign page views to individual users and to individually record, log and store the consent settings made by the user for a session duration, certain user information (including the IP address) is collected by the cookie consent tool when our website is accessed, transmitted to OneTrust servers and stored there.
This data processing is carried out pursuant to Art. 6 (4) PDPL on the basis of our legitimate interest in a legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website. We, as the controller, are subject to the obligation to make the use of technically unnecessary cookies dependent on the respective user consent.
SEOPress
We use SEOPress plugins on our website, a service provided by SEOPress SAS, 26 allée de Cantau, 64600 Anglet, France. The plugin handles the technical optimization of our websites for search engines and also assists with content development. You can prevent the storage of cookies by selecting the appropriate settings on your browser; we would like to point out that in this case you may not be able to use all functions of this website to their full extent. For more information please visit https://www.seopress.org/privacy-policy/. This data processing is carried out pursuant to Art. 6 PDPL (4) on the basis of our legitimate interest.
Polylang Pro
We use Polylang for the multilingualism of our website. Polylang is a product provided by WP SYNTEX, 28, rue Jean Sebastien Bach, 38090 Villefontaine, France. Polylang cookies are set solely to recognize and record the language used or selected by the user. These cookies are stored for one year and after that period deleted. For more information on data privacy compliance, please visit: https://polylang.pro/privacy-policy/.
This data processing is carried out pursuant to Art. 6 (4) PDPL on the basis of our legitimate interest.
We collect and process the following data as part of a contact request:
We process the following data as part of a job application you send us:
We collect and process the following data in the context of job applications:
Thank you for your interest in working for Oncare GmbH. We are aware of the importance of your data and process the personal data you provide us only for the purpose of effective and correct processing and for contacting you as part of the job application process. The data will not be transferred to third parties without your consent.
You will be asked to provide personal information. We observe the principle of data economy and data avoidance by only requiring you to provide us with data that we need to review your job application documents, such as your CV, or that we are legally obligated to collect. To protect the security and confidentiality of your data, we implement appropriate security measures. In addition, we recommend that you send us your application documents in “zipped” form (e.g. 7z or .zip) with password protection by e-mail. Afterwards, please give us the password by telephone. Alternatively, you can also send us your application documents by post mail. We store your data for the above-mentioned purposes until the application process has been completed and related deadlines have expired – at the latest six months after receipt of a decision.
If your job application is unfortunately unsuccessful, your data will be deleted by us within six months of rejection. If your application is successful, your application documents will be included on the HR files and will only be deleted after you have left the company and statutory retention periods have expired.
We are supported by our service provider JOIN Solutions GmbH (hereinafter “Join”) in carrying out the application process. For this purpose, we use a widget of the provider JOIN, Schönhauser Allee 36, 10435 Berlin, Germany. If you apply to a job, your application data will be processed by Join on our behalf as instructed. We have concluded the required data protection agreement with Join for data processing on our behalf, in which Join is obligated to process the data in accordance with the principles of PDPL and in accordance with our instructions.
Join widget: We use a Join widget to display current job offers. Cookies are set by the Join widget. The legal basis for the processing is Art. 6 (1.) PDPL.
Contact form / Contact via email (Article 6 (1) PDPL)
A contact form is available on our website which can be used to contact us electronically. If you write to us using the contact form, we will process the data you submitted in the contact form to respond to your queries and requests.
In so doing, we respect the principle of data minimisation and data avoidance, such that you only have to provide the information we require to contact you, which is your name, salutation, email address and the type of your request. Your IP address will also be processed (and hashed immediately) for technical reasons and for legal protection. All other data is voluntary, and additional fields are optional (e.g. to provide a more detailed response to your questions).
If you contact us by email, we will process the personal information provided in the email solely for the purpose of processing your request.
Automated decisions in individual cases
We do not use purely automated processing to make decisions.
Cookies
Our website uses “cookies” at various locations, which serve to make our offer more user-friendly, effective and secure. Cookies are small text files that are placed on your computer and stored by your browser (locally on your hard disk). Cookies enable us to analyse how users use our websites so we can design the website content in accordance with the visitor’s needs. Cookies also allow us to measure the effectiveness of a particular advertisement and, for example, to place it based on the user’s interests.
When you first visit our website, a pop-up (CookiePro) opens from which you can give your consent to the use of categories of cookies which are described below as well as in the CookiePro pop-up itself.
The following categories of cookies are used on our website:
Most of the cookies we use are “session cookies”, which will be automatically deleted after your visit. Persistent cookies are automatically deleted from your computer when their validity period (maximum 14 months) has expired or you delete them yourself prior to expiry.
In order to revoke your consent to the use of cookies (except for strictly necessary cookies which are always enabled), you can navigate to the footer of the website and deactivate categories of cookies in the CookiePro pop-up via the link ‘Cookies Settings’.
Furthermore, cookies are stored on the user’s computer which then transmits them to us. As a user, you therefore exercise full control over the use of cookies. You can change the settings in your Internet browser to disable or restrict the sending of cookies. In addition, cookies that have already been saved on your computer can be deleted at any time via an Internet browser or other software programs. All this is possible in all the current Internet browsers.
Please note: If you deactivate the placing of cookies on your device, you may not be able to access all our website functions in certain circumstances.
Web tracking (Article 6 (1) PDPL)
Matomo
This is an open source web analysis tool. Matomo (provided by InnoCraft Ltd., New Zealand) does not transfer any data to servers outside the control of ONCARE. Matomo is deactivated when you use our services. Only after you have actively allowed it, your user behaviour will be recorded anonymously. By deactivating, a “permanent cookie” will be stored, if your browser settings allow this. This cookie serves the purpose of signaling Matomo not to capture your browser.
The information on usage collected by the cookie is transferred to our servers and saved there so that we can analyse user behaviour.
The information generated by the cookie on how you use our services will not be passed on to third parties.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality. For more information visit: https://matomo.org/privacy-policy/.
The processing of the users’ personal data enables us to analyse the surfing behaviour of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our services. This helps us to continuously improve our services and its user-friendliness.
We process and store personal data only for as long as this is necessary for the fulfilment of the intended purpose.
Google Analytics
Based on your consent (art. 6 (1) PDPL) we use Google Analytics, a web analysis service of Google LLC (“Google”). Google uses cookies. The information generated by the cookie about the use of the website by the user is usually transferred to a Google server in the USA and stored there.
Google will use this information on our behalf to evaluate the use of our online offer by users, to compile reports on the activities within this online offer and to provide us with further services associated with the use of this online offer and the use of the Internet. The processed data can be used to create pseudonymous user profiles of the users.
We only use Google Analytics with activated IP anonymisation. This means that the IP address of users is shortened by Google within member states of the European Union or in other states that are parties to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
The IP address transmitted by the user’s browser is not merged with other data from Google. Users can prevent the storage of cookies by adjusting their browser software; accordingly, users can also prevent the collection of data generated by the cookie and related to their use of the online offer to Google and the processing of this data by Google as described in section ‘Cookies’ above.
Further information on the use of data by Google, setting and objection options, can be found in the privacy policy of Google and in the settings for the display of advertising by Google.
The personal data of users will be deleted or made anonymous after 12 months.
Google Marketing Platform (Doubleclick before)
On this website we use Google Marketing Platform (hereinafter Doubleclick), a Google service. Doubleclick is a service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). We use Doubleclick to make your stay on our website as pleasant as possible by integrating Google Maps. Doubleclick uses cookies, in particular to provide tailored ads to you.
You can be addressed again by Google with suitable advertising offers on pages of Google Network, as you have visited or used corresponding websites and offers before. The information generated by the cookie may be transferred to a Google server in the USA and stored there. Google may also use the IP address of your browser for the display of ads. No data transmission takes place without your previously declared consent (Art. 6 (1) PDPL) on our cookie banner. You can revoke this at any time by the “Cookie Settings” in the footer of our website. You can also deactivate the use of cookies by Google. Please note that you will not be able to access Google services embedded on our website (Google Maps) without your consent or if you deactivate use of cookies by Google.
Doubleclick is a service of a third company (Google) that is independent from us and we cannot influence its data processing procedures. Further information on how Google handles the data it collects from you, as well as other Google privacy policies, are available at http://www.google.com/intl/de/policies/privacy/.
Google Maps-Plugin
Our website uses Google Maps (Google LLC) plugins. The plugins are deactivated until you specifically activate it by clicking on the plugin or have given your consent via our cookie banner (consent according to Art. 6 (1) PDPL). Google will store your IP address after activation. It is usually transferred to a Google server in the USA and stored there.
You can find more information on the handling of user data in Google’s privacy policy at https://www.google.de/intl/de/policies/privacy. However, you use this platform and its functions on your own responsibility. We would also like to point out that your data may be processed outside the European Union.
YouTube-Plugin
Our website uses YouTube plugins, YouTube is operated by Google. The operator is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. When you visit one of our pages equipped with a YouTube plugin, a connection to YouTube’s servers is established. This informs the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surf behavior directly to your personal profile. You can prevent this by logging out of your YouTube account. For more information on the handling of user data, please see YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy
LinkedIn Insight Tag
Our website uses the conversion tool “LinkedIn Insight Tag” provided by LinkedIn Ireland Unlimited Company. The tool creates a cookie in your web browser that allows the collection of, among other things, the following data: IP address, device and browser properties, and page events (e.g. page views). LinkedIn itself also collects log files (URL, referrer URL, IP address, device and browser properties and time of access). IP addresses are shortened or (if used to reach LinkedIn members across devices) pseudonymized. The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymized data are deleted within 180 days. The data collected by LinkedIn cannot be assigned to specific individuals by us. LinkedIn stores the personal data of the website visitors on its servers in the USA and uses it for its own advertising measures. You can find more detailed information on data protection at LinkedIn in the LinkedIn privacy notices.
The use of LinkedIn Insight is based on Art. 6 (1) PDPL.
Privacy policy / Notes on data protection in social media
Oncare GmbH maintains presences in the social medias, especially on Xing and LinkedIn. In case that we have control over the processing of your data, we will ensure that applicable data protection regulations are applied. Below you find the most important information on data protection laws regarding our social media presences.
Name and address of the controller
The following companies are responsible (as controller) for our social media presences, beside Oncare GmbH, according to the EU General Data Protection Regulation (GDPR) and other data protection provisions (including the PDPL):
However, you use these platforms and their functions on your own responsibility, especially the use of interactive functions (e.g. commenting, sharing, rating). We would also like to point out that your data may be processed outside the European Union.
Purposes and legal basis
We maintain the social media presences in order to communicate with users and to inform them about our products and services. Furthermore, we collect data for statistical purposes in order to develop and optimize our content and to design more attractive products/services. The data required for this purpose (e.g. total number of page views, page activity and data provided by visitors, interactions) is processed by the social networks and made available to us. We have no influence on the generation and presentation.
In addition, your personal data will be processed by the social media providers for market research and advertising purposes. It is possible that, for example, based on your usage behavior and your interests, usage profiles are created. With the consequence that ads are placed inside and outside platforms that match your interests. Cookies are usually stored on your computer for this purpose. Data that is not collected directly on your end devices may also be stored in your usage profiles. Storage and analysis also take place across devices; this applies in particular, but not exclusively, if you are registered as a member and logged in your account.
We do not collect or process any further personal data.
The processing of your personal data by Oncare GmbH is based on our legitimate interests to get appropriate information and reach sufficient communication pursuant to Art. 6 (4) PDPL. If you are asked for consent to data processing, i.e. if you declare your consent by confirming a button or similar (opt-in), the legal basis of the processing is Art. 6 (1) PDPL.
Your rights / objection option
If you are a member of a social network and do not want the network to collect data about you by our presence and link it to your social media membership data with the respective network, you must:
After logging in again, however, you will once more be recognizable to the network as a specific user. For a detailed description of the processing and the possibilities to object (opt-out), we refer to the following information:
LinkedIn
Statement: https://www.linkedin.com/legal/privacy-policy;
Opt-Out: https://www.linkedin.com/legal/cookie-policy and http://www.youronlinechoices.com;
Xing
Privacy Statement: https://privacy.xing.com/de/datenschutzerklaerung;
Opt-Out: http://www.youronlinechoices.com.
You have the following rights regarding the processing of your personal data:
right of access, right to rectification, right to erasure / right to be forgotten, right to restriction of data processing, right to data portability, right to object to data processing and the right to file a complaint about unlawful processing of your personal data with the competent data protection authority. As Oncare does not have full access to your personal data, you should contact the social media provider directly if you wish to assert your claim, because your provider has access to the personal data of the users and can take appropriate measures and provide information. If you still need help, we support you. Please contact privacy@myoncare.com.
Online offers for children
Persons under the age of 16 may not submit personal data to us or give a declaration of consent without the authorisation of their legal guardian. We encourage parents and guardians to actively participate in the online activities and interests of their children.
Links to other providers
Our website also contains clearly identifiable links to the Internet sites of other companies. Although we provide links to websites of other providers, we have no influence on their content, and no guarantee or liability can therefore be assumed for such. The content of these pages is always the responsibility of the respective provider or operator of the pages.
The linked pages were checked at the time of linking for potential legal violations and identifiable infringements. No illegal content was identified at the time of linking. However, a permanent content control of the linked pages is not reasonable without concrete evidence of an infringement and, upon notification of a violation of rights, such links will be promptly removed.
Welcome to myoncare, the digital health portal for efficient and needs-oriented patient care.
For us at Oncare GmbH (hereinafter referred to as “Oncare” or “we”, “us”, “our”), the protection of your privacy and any personal data relating to you while using the myoncare Portal is of major relevance and importance. We are aware of the responsibilities to provide and save your personal data in the myoncare Portal. Therefore, our technology systems used for myoncare Services are set up according to the highest standards and the lawful processing of personal data is core to our business ethics.
We process your personal data in accordance with the applicable legal provisions for the protection of personal data, in particular the Egyptian Personal Data Protection Law no. 151/2020 (the “PDPL”). Furthermore European Data Protection rules apply, for more information please check our Privacy Notice (Europe). This Privacy Notice tells you why and how Oncare processes your personal data which we collect from you or which you provide to us, when you decide to use myoncare Portal. In particular, you will find a description of the personal data, which we collect and process as well as the purpose and on which basis we are processing the personal data and the rights to which you are entitled.
Please read this Privacy Notice carefully to ensure that you understand each provision. After reading the Privacy Notice, you will have the option to consent to the Privacy Notice and the processing of your personal data as described in this Privacy Note. If you give consent, the Privacy Notice will be part of the contract between you and Oncare.
“App User” means any user of the myoncare App (your patient).
“Blockchain” in the myoncare system is an additional database that stores data from all the installations.
“Careplan Provider” means any Health Care Professional or other third-party (e.g., medical device manufacturer, pharmaceutical company) offering Careplans to Portal Users through the myoncare Store or through any other data transfer method (e.g., email).
“Careplan User” means any Health Care Professional (Portal User), using a Careplan for communication with their Registered Patients.
“Health Care Provider” means you or any other doctor, clinic, health care institution or other health care professional acting on its own or on behalf of you or any other doctor, clinic or health care institutions (intended user).
“myoncare App” means the myoncare mobile app intended for the use by patients who want to use the services provided by Oncare.
“myoncare Store” means the platform run by Oncare that provides digital care concepts (Careplans) to be used for your registered patients wellbeing through the myoncare Portal.
“myoncare Portal” means the myoncare web-portal intended for professional use by Portal Users and functioning as interface between such Portal Users and patients as App Users.
“myoncare Tools” means both, myoncare App and myoncare Portal, together.
“myoncare Services” means the services, functionalities and other offerings which are or may be offered to Portal Users via the myoncare Portal and/or to App Users via the myoncare App, as applicable.
“Oncare“ means ONCARE GmbH, Germany.
“Portal User” means you or any other Health Care Provider using the web-based myoncare Portal.
“Patient Privacy Notice” means the privacy statement that describes the collection, use and retention of the personal (health) information of patients using myoncare App.
“Privacy Notice” means this statement made to you as user of the myoncare Portal that describes how we collect, use and retain your personal information, and provides you with information on your comprehensive rights.
“myoncare PWA” means the myoncare Progressive Web App application for patients who wish to use the services offered by Oncare by the PWA and not by the myoncare app.
“Standard Terms” means the Standard Terms and Conditions for using the myoncare Portal.
Oncare GmbH, a company registered with the Munich Local Court with the Register number 219909 with its office located at Balanstraße 71a, 81541 Munich, Germany offers and operates the interactive web portal myoncare Portal (for Health Care Professionals) and the mobile application myoncare App (for patients) giving access to myoncare Services. This Privacy Notice applies to all personal data processing by Oncare related to the use of myoncare Portal. For the use of myoncare App by patients, you can find a separate Patient Privacy Notice here.
A progressive web app (PWA) is a website that looks and behaves as if it is a mobile app. PWAs are built to take advantage of native mobile device features, without requiring the user to visit an app store. The goal of PWAs is to combine the difference between apps and the traditional web by bringing most of the benefits of native mobile apps to the mobile browser. The PWA is based on the technology of “React Native for Web”. “React Native for Web” is an open source software for PWA applications.
Before patients can use the myoncare PWA, they need a computer or smartphone and an active internet connection. An app does not need to be downloaded.
Some of the myoncare app services cannot be used within the myoncare PWA as described below. These are the following services or specifications:
-Chat with a care team;
-Video calls;
-Security PIN codes;
-Activity data tracking (e.g. AppleHealth, GoogleFit, Withings).
The following information regarding the myoncare app also apply to the myoncare PWA, unless otherwise stated in this section.
“Personal data” is all information that makes it possible to identify a natural person. In particular, this includes your name, voice, photograph, identification number, date of birth, address, telephone number, e-mail address and IP address, or any data referring to your psychological, medical, economic, cultural or social identity. “Health data” is personal data that relates to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.
Data is considered “anonymous” if no personal reference to the person/user can be made. In contrast, “pseudonymized” data is data from which personal reference or personal identifiable information is replaced by one or more artificial identifiers, or pseudonyms, but which can, in general, be re-identified by the identifier key.
We may process the following data categories about you while using the myoncare App:
• Operational Data: Personal data provided to us when you register and log in to our myoncare Portal, contact us regarding any problems with the Portal or otherwise interact with us with the purpose of using the Portal (“Operational Data”);
• Treatment Data: You will enter personal data of your patients, such as name, age, height, weight, indication, disease symptoms and further information in connection with the treatment of your patients (e.g. in a Careplan) in myoncare Portal (“Treatment Data”). Treatment Data are personal data of your patients which are collected or processed, when you interact with your patient via myoncare Portal;
• Store Business Data: Personal data which will be processed by us when you are using the myoncare Store either as author of Careplans or as buyer of Careplans. The use of the myoncare Store will require the processing of your name and contact information as well as your payment details (payment details only in case Careplan is subject to a fee) (“Store Business Data”).
• Activity Data: Personal data which will be processed by us when any App User connects myoncare App to a Health App (e.g. AppleHealth, GoogleFit, Withings). Activity Data of your connected patients is available to you within the myoncare Portal.
• Product Safety Data: Personal data which will be processed to fulfill our legal obligations as manufacturer of the myoncare App as medical device. In addition, your personal data as reporter of incidents may be processed to fulfill legal safety or vigilance purposes of medical device or pharmaceutical companies. (“Product Safety Data”).
• Reimbursement Data: Personal Data which are required for the reimbursement process (“Reimbursement Data”).
BLOCKCHAIN TECHNOLOGY
Blockchain technology (“Blockchain“) (European Patent No. 4 002 787), is an optional offered service, it is not mandatory. It is on you, the Health Care Provider, to decide to use the Blockchain solution. The Blockchain is supported by Hyperledger Fabric. Hyperledger Fabric is an open source software for enterprise-grade blockchain deployments. It offers a scalable and secure platform that supports blockchain projects.
Blockchain in the myoncare system is an additional database that stores data from all the installations. All the data is stored in Germany. It is a Private Blockchain (“Private Blockchain“), it allows the entry of only selected verified participants, and it is possible to override, edit, or delete entries as required.
In general, the Blockchain is made up of digitally recorded data in a chain of packages called ‘blocks’ that store records of transactions. The manner in which these blocks are linked is chronological. The first block created is called a genesis block and each block added afterwards will have a cryptographic hash that refers to the previous block, allowing to trace transactions and changes to information going back to the Genesis block. All transactions within the blocks are validated and agreed upon by a consensus mechanism, ensuring that each transaction is true and correct.
Each block contains the list of transactions, its timestamp, its own hash, and the previous block’s hash. A hash is a function used to convert digital data to a fixed-sized alphanumeric string. If an unauthorized person tries to update the data from a single block, the hash of the block would also change and the linking to this block would be lost. At this moment, the copy blockchain will not be in sync with the other copies. When all nodes try to sync their copies they would realize that this one copy is different and then the network marks this node as illegitimate. This process makes it quite difficult for unauthorzed persons to tamper with the records in the blockchain.
Our Blockchain is a Private Blockchain. A Private Blockchain is decentralized. It is a distributed ledger that operates as a closed database. Unlike Public Blockchains, which are “permissionless”, Private Blockchains are “permissioned,” because approval is required to become a user. In contrast to Public Blockchains that are open for everyone, Private Blockchains require some form of authorization. This allows to take advantage of the security and immutability of blockchain technology while also complying with privacy regulations, most notably the Personal Data Protection Law (PDPL). Private Blockchain records can be edited, overridden or deleted; deleted means in this context to erase the reference to the UUID (Universally Unique Identifier) in the customer´s database. The result is that the hash is anonymized in the Blockchain database, with the consequence that this process is compliant with the General Data Protection Regulation and the PDPL, and it guarantees the rights of a data subject (Right to erasure ‘right to be forgotten’ inter alia, Art. 2 PDPL).
Types of data that are stored and processed on the Blockchain:
-Patient UUID
-Site/Institution UUID
-Asset UUID
-Hash of Caretask & Asset Data.
(UUID: Universally Unique Identifier).
The data stored in the Blockchain is pseudo-anonymous.
Our Blockchain intends to provide services that help prove the integrity of the data related to the privacy policy, patient profile, assets, and the assigned caretasks and medications. To communicate with the blockchain, the user needs to enroll a set of public-private keys. The enrollment process generates certificates that are stored in a separate database for Health Care Providers and on the phone for the patients. A backup of the patient’s keys is encrypted and stored in the Health Care Provider database which can be accessed only by the patient.
For the privacy policy consent verification, whenever the Health Care Provider intends to communicate with the patient, the system checks if the patient has valid consent to the privacy policy of the health care institution. The blockchain is used to guarantee the integrity and accountability of the record that stores that the patient has accepted the privacy policy.
When the Health Care Provider uploads the new version of the privacy policy, the hash of the file is stored in the blockchain, and after the patient consents to the privacy policy, this interaction is stored on the blockchain. For each communication with the patient, the blockchain returns a flag if the patient’s consent is still valid for the recent privacy policy by comparing the hash.
Similarly, for the patient sync feature, the integrity of the patient profile is assured by the blockchain. The Health Care Provider knows if the patient profile is out of sync with the profile on the phone by comparing the hash of the patient profile on the blockchain. This enables the Health Care Provider to have the most recent patient profile information.
myoncare Portal:
If the Health Care Provider decides to use the Blockchain solution, ONCARE will add an extra service called adapter service that will be used to communicate with the Blockchain. The Blockchain instance is hosted by ONCARE.
myoncare App:
The patients can connect to the same Blockchain instance, and it is done with the help of the phone manager service. This service is also hosted by ONCARE.
Justification of Processing: The processing of data by Oncare for the Health Care Provider is based on Art. 6 PDPL (data processor’s obligations).
PROCESSING OF OPERATIONAL DATA
In case you are a contact person to run the Portal at your site/practice (e.g. IT administrator, appointed Health Care Professional), you might provide us with certain personal data in case you are contacting us to understand or discuss the functions and usage of the Portal or in case of a service request.
In the event of a service request, the following personal data may also be viewed by authorized Oncare employees:
• The personal data that you have provided to register and/or log in to our Portal (e.g. name, date of birth, profile picture, contact details)
Authorized Oncare employees who have access to your database for the purpose of processing a service request are contractually required to keep all personal information strictly confidential.
For the processing of Operational Data, Oncare acts as data controller responsible for the legitimate processing of your personal data.
Types of Data: E-mail-address, date of birth, registration date, your IP address, pseudo keys generated by the Portal .
The app uses Google Maps API to use geographical information. When using Google Maps, Google also collects, processes and uses data about the use of the map functions. For more information about the scope, legal basis and purpose of data processing by Google as well as the storage period, please refer to Google’s privacy policy.
Purposes of processing of Operational Data: We use the Operational Data to maintain the functionalities of myoncare Portal and to get in direct contact with you if required or initiated by you (e.g. in case of change of Standard Terms, necessary support, technical problems etc.). In addition, personal data (e-mail-address) is needed and processed for the 2-factor-identification in each case of your log-in to myoncare Portal.
Justification of Processing: The processing of Operational Data is justified based on Article 6 Paragraph 2 PDPL to fulfill the contract you conclude with Oncare for the purpose of the use of myoncare Portal.
PROCESSING OF TREATMENT DATA
During the use of myoncare Portal, you will enter personal (health) data of your patients to myoncare Portal (e.g. provision of individual Careplan, reminder for intake of medicines etc.). In addition, you and your patients will be able to upload patient related documents and files to myoncare Portal and share the files with each other. Additionally, location functions can be generated and implemented.
An uploaded privacy policy is displayed to any patient who connects to the site. All consent statements must be defined in the uploaded privacy policy. Once a privacy policy has been uploaded, it can only be replaced with a new version, but not deleted.
The files will be stored in a cloud database hosted in Egypt. You can allow sharing such files with other Portal Users of your own institution for medical reasons. Other Portal Users will not be able to access these files.
You (not Oncare) will be responsible for a legitimate processing of the personal data.
We process such personal data, including the patients’ health data, under an agreement with you and in accordance with your instructions. For the purposes of using myoncare Services with patients’ health data, you will, therefore, be the responsible data controller. Please process your patients’ data only if you have obtained the required data consent of such patients. Oncare will act as data processor in compliance with the separate data processing contract we have concluded with you based on Art. 6 PDPL.
PROCESSING OF STORE BUSINESS DATA
– Only applicable if you are using myoncare Store either as Careplan Provider or as Careplan User –
myoncare Store is integrated in myoncare Portal and offers the exchange of Careplans and after registering to the myoncare Portal, you will be able to connect to myoncare Store with your log-in information of myoncare Portal. You will be able to use myoncare Store for own Careplans as Careplan Provider or for purchasing a Careplan as Careplan User.
Data of Careplan Provider:
Types of Data: Name, contact details, bank account information
Processing of Store Business Data: If you want to offer an own Careplan to other Portal Users, you will have to provide your name and contact details with the Careplan. These details will be visible to other Careplan Providers and Careplan Users using myoncare Store, in case you decide to “publish”. If you decide for “internal use”, your personal data related to your Careplan will only be visible to Careplan Providers and Careplan Users of your own institution.
In case of a purchase of your Careplan by a Careplan User, your personal data (name and contact details) will be processed to agree on a Careplan licence agreement between you and the Careplan User. If your Careplan is offered for a fee, you will also need to provide your bank account details, as the Careplan Users will have to be able to pay the fee for your Careplan. In addition, we as Oncare will process the information on the use of the Careplan, the fee schedule and your personal data related to the Careplan to track the commission fee.
In the case of the tracking of commission fee, Oncare will act as data controller. For all other cases (data exchange between Careplan Provider and Careplan User, licence agreement, payment etc.), Oncare acts as data processor for the Careplan Provider in compliance with the separate data processing contract we have concluded with you based on Art. 6 PDPL.
Justification of processing of Store Business Data: Legal basis for the processing of personal data of Careplan Provider by Oncare as data controller is Article 6 PDPL.
Data of Careplan User:
The Careplan User data processed by using the myoncare Store will be used for entering into a license agreement with the Careplan Provider and, if Careplan offered for a fee, for processing and control of the payment process between the Careplan Provider and the Careplan User.
Types of Data: Name, contact details, bank account information.
Processing of Store Business Data: When purchasing a Careplan in myoncare Store (either for free or based on a purchase price offered by the Careplan Provider), the Careplan User will have to enter his/her personal data and contact details with the aim to conclude a licence agreement with the Careplan Provider. In addition, payment details will be processed (if there is a usage fee) to the Careplan Provider.
Justification of processing of Store Business Data: Legal basis for the processing of personal data is the separate data processing contract we have concluded with the Careplan Provider based on Art. 6 PDPL.
PROCESSING OF ACTIVITY DATA
– Only applicable if your connected App Users agree to and activate the data transfer –
myoncare Tools offer the possibility to App Users to connect the myoncare App to certain health apps (e.g. AppleHealth, GoogleFit, Withings) (“Health App”), if those are used by the App User and if the connection is desired by the App User. If the connection is established, Activity Data collected by the Health App is transferred to you with the purpose of providing additional, contextual information about the App Users activity to you. Please note that Activity Data are not validated by myoncare Tools and shall not be used for diagnostic purposes or as basis for medical decision making.
The processing of Activity Data to you falls within the own data responsibility of your patients.
Types of data: The type and extent of data transferred depend on the decision of the App User. Data can include, inter alia, weight, height, taken steps, burned calories, hours of sleep, heart rate and blood pressure.
Purposes of processing of Activity Data: Activity Data of the App User is transferred to you with the purpose of providing additional, contextual information about the App Users’ activity to you. Please note that Activity Data are not validated by myoncare Tools and shall not be used for diagnostic purposes or as basis for medical decision making.
Justification of Processing of Activity Data: Data Controller is the patient him-/herself who grants you access to his/her Activity Data just for review of the shared information. Therefore, no further justification is needed.
PROCESSING OF PRODUCT SAFETY DATA
As manufacturer of the myoncare Tools, we have to fulfill certain legal obligations (e.g. surveillance of functionality of the Tools, evaluation of incident reports which might be connected to the use of the Tools, tracking of users etc.). In addition, you might collect personal data in myoncare Tools regarding specific medical devices or pharmaceuticals used in the treatment of your patients. The manufacturers of such medical devices or pharmaceuticals also have legal obligations regarding the surveillance of the market (e.g. collection and assessment of side effect reports).
Oncare is data controller for Product Safety Data.
Types of Data: Case reports, personal data provided in an incident report and results of evaluation, reporter details.
Processing of Product Safety Data: We will store and assess any personal data related to our legal obligations and transfer such personal data (if possible after pseudonymization) to competent authorities, notified bodies or other data controllers with supervisory responsibilities. In addition, we will store and transfer personal data related to medical devices and/or pharmaceuticals, if we receive any notices by you as reporter of such information, by your patient or any third person (e.g. our distributors or importers of the myoncare Tools in your country) that has to be reported to the manufacturer of the product to enable the manufacturer to fulfill its legal product safety obligations.
Justification of processing of Product Safety Data: Legal basis for the processing of personal data to fulfill legal obligations is Art. 6 and 12 PDPL.
PROCESSING OF REIMBURSEMENT DATA
– Only applicable if you are using myoncare Tools for reimbursement –
myoncare Portal will assist you to start your standard reimbursement processes for the health services provided to your patients via myoncare App. To enable the reimbursement process, myoncare Portal will support the collection of your patient’s personal (health) data from myoncare Portal to facilitate the standard reimbursement processes you might want to transfer to the patient’s cost payer (either your Association of Statutory Health Insurances and/or the patient’s health insurer). You will be the data controller for Reimbursement Data and responsible for the compliance with data protection regulations for your patients’ data processed in the reimbursement process. Oncare is acting as data processor based on the data processing agreement with you.
Types of Data: Patient’s name, diagnosis, indications, treatment, period of treatment, other data required for reimbursement administration.
Processing of Reimbursement Data: You as responsible data controller will transfer the patient’s Treatment Data required to receive reimbursement to the cost payer (either your Association of Statutory Health Insurances and/or the patient’s health insurer) and the cost payer will process the Reimbursement Data to provide reimbursement to you.
WHAT TECHNOLOGY IS USED BY MYONCARE PORTAL AND MYONCARE APP?
myoncare Portal works as a web based tool for which you need a working internet connection and any current version of the internet browser Chrome, Firefox or Safari.
SECURE TRANSFER OF PERSONAL DATA
We implement the appropriate technical and organizational security measures to ensure the optimal protection of the personal data stored by us against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. The security levels are continuously reviewed in collaboration with security experts and adapted to new security standards.
The data exchange to and from the Portal and App is encrypted. We use TLS and SSL as encryption protocols for secure data transmission. In addition, data exchange is end-to-end encrypted and takes place using pseudo-keys.
DATA TRANSFERS / DISCLOSURE TO THIRD PARTIES
We will only transmit your personal data to third parties within the scope of given statutory provisions or based on your consent. In all other cases, information will not be transferred to third parties unless we are obliged to do so owing to mandatory legal regulations (disclosure to external bodies, including the supervisory authorities or law enforcement authorities).
All transfer of personal data is encrypted during transfer.
The information on how we handle the personal (health) data of your patients acting with myoncare App is summarized in a separate Privacy Notice for the myoncare Patient App. You can find this Patient Privacy Notice here. Please also read this Patient Privacy Notice carefully. For some processing of patient data, you will be the data controller and responsible for the compliance with data protection (e.g. transfer of treatment data to the patient).
SendGrid
We use Sendgrid for sending emails. The provider is Sendgrid Inc., 1801 California Street Suite 500, Denver, CO 80202, USA. Sendgrid is a service with which the sending of emails can be organized. Sendgrid is used to send confirmation emails, transaction confirmations and emails with important information regarding existing requests. The data you enter for the purpose of receiving emails is stored on Sendgrid’s servers. When we send email on your behalf through SendGrid, we use an SSL secured connection.
The emails are related to the following tasks:
-First login to the Web Application;
-Password reset workflow for the Web Application;
-Account creation for the Patient Application;
-Password reset for the Patient Application;
-Replacing push notifications by emails for PWA (Progressive Web App) in the following cases:
(i) When a Caretask is set to expire in one day;
(ii) When a Caretask is set to expire in one hour;
(iii) Medication has been assigned;
(iv) When the privacy policy has been updated.
For the purpose of analysis, the e-mails sent with SendGrid contain a so-called “tracking pixel”, which connects to Sendgrid’s servers when the e-mail is opened. By this, it is possible to determine whether an email message has been opened.
Legal basis
The data processing is based on your consent (Art. 6 para. 1 PDPL). You can revoke this consent at any time. The legality of the data processing operations already carried out remains unaffected by the revocation.
Storage period
The data you provide us for the purpose of receiving emails will be stored by us until you unsubscribe from our services and will be deleted from our servers as well as from the servers of Sendgrid after you unsubscribe.
Please note that your data is usually transmitted by us to a SendGrid server in the USA and stored there. We have concluded a contract with Sendgrid incorporating the EU standard contractual clauses. This ensures that a level of protection comparable to that in the EU exists.
SendGrid (Privacy Policy): https://sendgrid.com/resource/general-data-protection-regulation-2/
Matomo
This is an open source web analysis tool. Matomo (provided by InnoCraft Ltd., New Zealand) does not transfer any data to servers outside the control of ONCARE. Matomo is deactivated when you use our services. Only after you have actively allowed it, your user behaviour will be recorded anonymously. By deactivating, a “permanent cookie” will be stored, if your browser settings allow this. This cookie serves the purpose of signaling Matomo not to capture your browser.
The information on usage collected by the cookie is transferred to our servers and saved there so that we can analyse user behaviour.
The information generated by the cookie about your use is:
-User role
-User geolocation
-User browser
-User OS
-IP Address
-Pages/screens visited in Web and PWA (see section about PWA in this Privacy Statement)
-Buttons the user clicks in Web and PWA
-Time user spent.
The information generated by the cookie on how you use our services will not be passed on to third parties.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality. For more information visit: https://matomo.org/privacy-policy/.
The legal basis for the processing of the users’ personal data is Art. 6 para. 1 of the PDPL. The processing of the users’ personal data enables us to analyse the surfing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our services. This helps us to continuously improve our services and its user-friendliness.
We process and store personal data only for as long as this is necessary for the fulfilment of the intended purpose.
GENERAL INFORMATION ON CONSENT TO DATA PROCESSING
Your consent also constitutes permission to data processing under data privacy law. Before granting your consent, we will inform you about the purpose of the data processing and your right of objection.
If the consent also relates to the processing of special categories of personal data (i.e. sensitive data under the PDPL), myoncare Portal will explicitly notify you in the consent process. Processing of sensitive data according to Art. 9, 12 & 13 PDPL may only take place where necessary on the grounds of legal regulations and there is no reason to assume that your legitimate interests should prevail to the exclusion of processing such personal data or you have given consent to the processing of this personal data according to Art. 12 Paragraph 2 PDPL.
For the data processing for which your consent is required (as explained in this Privacy Notice), the consent will be requested during registration process. After successful registration, the consents can be managed in the account settings of myoncare Portal. In addition, Oncare will ask you to agree on a data processing agreement for the data processed by Oncare under your responsibility as data controller.
DATA RECIPIENTS / CATEGORIES OF RECIPIENTS
In our organization, we ensure that the only persons entitled to process personal data are the ones who are required to do so in order to fulfil their contractual and statutory duties.
In certain cases, service providers support our specialist departments in fulfilling their tasks. The necessary data protection contracts have been concluded with all service providers which are data processors for the personal data. These service providers are Hetzner Online and Google (Google Firebase). Google Firebase is a “NoSQL database” that enables synchronization between the myoncare Portal and the myoncare App used by your patients. NoSQL defines a mechanism of storing data which is modeled in means other than just tabular relations by allowing for easier “horizontal” scaling compared to tabular/ relational database management systems in a cluster of machines.
For this purpose, a pseudo key of the myoncare Portal and the myoncare App is stored in Google Firebase along with the corresponding Careplan. The data transfer is pseudonymized to Oncare and its service providers which means that Oncare and its service providers cannot relate to you or your patient as a data subject. This is achieved by encryption of the data during transfer and the use of pseudo-keys instead of personal identifiers such as names or e-mail addresses to track these transfers. Re-identification happens once the personal data has reached the patient account in myoncare App or your account in myoncare Portal after verification via specific tokens.
Hetzner Online provides cloud storage in which the Firebase Manager, which manages the Firebase URLs for the myoncare Portal, is stored. In addition, Hetzner Online provides the isolated server domain of myoncare Portal in which your and your patients’ personal data are stored. Hetzner Online also hosts myoncare’s video and file management services, which enable encrypted video conferencing and exchange of files between you and your patient, respectively. Access to all personal data by you and your patient is ensured by sending specific tokens. This personal data is encrypted during transfer and pseudonymized during transfer and at rest to Oncare and its service providers. Service providers of Oncare do not have access to this personal data at any time.
TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES
No personal data collected by myoncare Portal or myoncare App will be stored in the app stores. Personal Data will only be transferred to third countries (outside of Egypt) if this is necessary for the performance of the contractual obligation, is required by law or you have given us your consent.
Synchronization of myoncare Portal with myoncare App takes place via Google Firebase. The Google Firebase servers are hosted in the EU. However, according to the Google Firebase Terms of Service, transient data transfers in countries where Google and its’ service providers have establishments are possible. In the case of certain Google Firebase services, data is only transferred to the USA if no processing takes place in the European Union or the European Economic Area. Unauthorized access to your data is prevented by end-to-end encryption and secure access tokens. Hetzner Online is hosted in Nuremberg, Germany. In order to process Activity Data, interfaces to Google cloud services (in case of GoogleFit) or to AppleHealth or Withings within the mobile device of the App User are used. Myoncare Tools use these interfaces which are provided by Google, Apple and Withings, to request Activity Data from connected Health Apps. The request sent by myoncare Tools does not contain personal data but personal data is provided to myoncare Tools via these interfaces.
PERIOD OF PERSONAL DATA STORAGE
We store your personal data as long as they are needed for the respective processing purpose. Please note that numerous retention periods dictate that personal data must continue to be stored. This applies in particular to commercial law or tax law storage obligations (e.g. Commercial Code, Tax Code, etc.).
Please note that Oncare is also subject to storage obligations which are contractually agreed with you on the basis of legal provisions. If there are no further storage obligations, the personal data is routinely deleted once the purpose has been achieved.
In addition, we can store personal data if you have given us your permission to do so or if legal disputes arise and we use evidence within the framework of statutory limitation periods, which can be up to thirty years; the regular limitation period is five years.
OBLIGATION TO PROVIDE PERSONAL DATA
Various personal data are necessary for the establishment, performance and termination of the contractual relationship and the fulfillment of the associated contractual and legal obligations. The same applies to the use of our myoncare Portal and the various functions it provides.
We have summarized the details for you in the above point. In certain cases, personal data must also be collected or made available in accordance with statutory provisions. Please note that it is not possible to process your inquiry or to execute the underlying contractual obligation without providing this personal data.
AUTOMATED DECISIONS IN INDIVIDUAL CASES
We do not use purely automated processing to make decisions.
YOUR RIGHTS AS A DATA SUBJECT
We would like to inform you of your rights as a data subject. These rights are set out in article 1 PDPL and include:
• Right of access (Art. 1, (1.) PDPL): You have the right to access and be provided with a copy of any personal data that we hold about you;
• Right to rectification (Art. 1, (3.) PDPL): You can require us to correct or amend, or erase or complete your personal data;
• Right to restriction of data processing (Art. 1, (4.) PDPL): You can require us to “restrict” our use of your information, so that we can continue the use your information only subject to restrictions;
• Right to be informed of any personal data breach (Art. 1 (5.) PDPL): You have the right to be informed of any personal data breach in relation to your personal data;
• Right to object and/or revoke consent to data processing (Art. 1 (2) and (6) PDPL): You have the right to revoke your consent at any time, if we process your personal data based on your consent. You, further, have the right to object to our use of your personal data whenever it contradicts with your fundamental rights. We will continue to provide our services if they do not depend on the consent that has been revoked and/or objected.
To exercise these rights, please contact us at: privacy@myoncare.com. We will require you to provide satisfactory proof of your identity to ensure that your rights are protected and that your personal data is disclosed only to you and not to any third person.
Please also contact us at any time on privacy@myoncare.com, if you have questions about data processing in our company or if you wish to revoke your consent. You also have the right to contact the relevant data protection supervisory authority.
DATA PROTECTION OFFICER
You can contact our data protection officer to answer all data protection questions at privacy@myoncare.com.
CHANGES TO PRIVACY NOTICE
We explicitly reserve our right to modify this Privacy Notice in future at our own discretion. Modifications or additions may, for instance, be necessary to meet statutory requirements, correspond with technical and economic developments or to meet the interests of the App or Portal Users.
Any modifications are possible at any time and will be published in an appropriate manner and in an appropriate time frame for you before they take effect (e.g. by posting revised Privacy Notice at login or by providing advance notice to you of material changes).
ONCARE GmbH
Postal address
Balanstraße 71a
81541 Munich, Germany
Contact info of the data protection officer:
Last Updated on 21 August 2023.
* * * *
Welcome to myoncare, the digital health portal and mobile app (“App”) for efficient and needs-oriented patient care and support for corporate health management programs.
For us at Oncare GmbH (hereinafter referred to as “Oncare” or “we”, “us”, “our”), the protection of your privacy and any personal data relating to you while using the myoncare App is of major relevance and importance. We are aware of the responsibilities arising from your trust to provide and save your personal (health) data in the myoncare App. Therefore, our technology systems used for myoncare Services are set up according to the highest standards and the lawful processing of personal data is core to our business ethics.
We process your personal data in accordance with the applicable legal provisions for the protection of personal data, in particular the Egyptian Personal Data Protection Law (the “PDPL”). Furthermore European Data Protection rules apply, for more information please check our Privacx Notice (Europe). This Privacy Notice tells you why and how Oncare processes your personal (health) data which we collect from you or which you provide to us, when you decide to use myoncare App. In particular, you will find a description of the personal data, which we collect and process as well as the purpose and on which basis we are processing the personal data and the rights to which you are entitled.
Please read this Privacy Notice carefully to ensure that you understand each provision. After reading the Privacy Notice, you will have the option to consent to the Privacy Notice and the processing of your personal (health) data as described in this Privacy Note. If you give consent, the Privacy Notice will be part of the contract between you and Oncare.
“App User” means any user of the myoncare App (Patient and/or employee).
“Blockchain” in the myoncare system is an additional database that stores data from all the installations.
“Company” means your employer, if you and your employer are using myoncare Tools for the employer’s corporate health management program.
“Data Service Provider” means any agent engaged and instructed by Company for collection, screening and interpretation of pseudonymized or anonymized employee data in corporate health management programs based on a separate service agreement with the Company (e.g. data analyst, general health prevention services, data evaluation services etc.) and as identified by a separate information sheet to the employees.
“Health Care Provider” means your doctor, clinic, health care institutions or other health care professional acting on its own or on behalf of your doctor, clinic or health care institutions.
“myoncare App” means the myoncare mobile app intended for the use by patients or employees who want to use the services provided by Oncare.
“myoncare Portal” means the myoncare web-portal intended for professional use by Portal Users and functioning as interface between such Portal Users and App Users.
“myoncare Services” means the services, functionalities and other offerings which are or may be offered to Portal Users via the myoncare Portal and/or to App users via the myoncare App, as applicable.
“myoncare Tools” means both, myoncare App and myoncare Portal, together.
“Oncare” means ONCARE GmbH, Germany.
“Portal User” means any Health Care Provider, Company or Data Service Provider using the web-based myoncare Portal.
“Privacy Notice” means this statement made to you as patient or employee and user of the myoncare App that describes how we collect, use and retain your personal information, and provides you with information on your comprehensive rights.
“myoncare PWA” means the myoncare Progressive Web App application for patients who wish to use the services offered by Oncare by the PWA and not by the myoncare app.
“Standard Terms” means the Standard Terms and Conditions for using the myoncare App.
Oncare , a company registered with the Munich Local Court with the Register number 219909 with its office located Balanstraße 71a, 81541 Munich, Germany, offers and operates the mobile application myoncare App giving access to myoncare Services. This Privacy Notice applies to all personal data processing by Oncare related to the use of myoncare App.
A progressive web app (PWA) is a website that looks and behaves as if it is a mobile app. PWAs are built to take advantage of native mobile device features, without requiring the user to visit an app store. The goal of PWAs is to combine the difference between apps and the traditional web by bringing most of the benefits of native mobile apps to the mobile browser. The PWA is based on the technology of “React Native for Web”. “React Native for Web” is an open source software for PWA applications.
Before patients can use the myoncare PWA, they need a computer or smartphone and an active internet connection. An app does not need to be downloaded.
Some of the myoncare app services cannot be used within the myoncare PWA as described below. These are the following services or specifications:
-Chat with a care team;
-Video calls;
-Security PIN codes;
-Activity data tracking (e.g. AppleHealth, GoogleFit, Withings).
The following information regarding the myoncare app also apply to the myoncare PWA, unless otherwise stated in this section.
WHAT IS PERSONAL DATA
“Personal data” is all information that makes it possible to identify a natural person. In particular, this includes your name, voice, photograph, identification number, date of birth, address, telephone number, e-mail address and IP address, or any data referring to your psychological, medical, economic, cultural or social identity. “Health data” is personal data that relates to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.
Data is considered “anonymous” if no personal reference to the person/user can be made. In contrast, “pseudonymized” data is data from which personal reference or personal identifiable information is replaced by one or more artificial identifiers, or pseudonyms, but which can, in general, be re-identified by the identifier key.
WHICH PERSONAL DATA WILL BE PROCESSED WHILE USING MYONCARE APP
We may process the following data categories about you while using the myoncare App:
• Operational Data: Personal data provided to us when you register to our myoncare App, contact us regarding any problems with the App or otherwise interact with us with the purpose of using the App (“Operational Data”);
• Treatment Data: You or your Health Care Provider will enter personal data, such as name, age, height, weight, indication, disease symptoms and further information in connection with your treatment (e.g. in a care plan) with the support of myoncare App (“Treatment Data”). Treatment Data are, therefore, personal data which are collected or processed, when you interact with your Health Care Provider via myoncare App;
• Activity Data: Personal data which will be processed by us when you connect myoncare App to a Health App (e.g. AppleHealth, GoogleFit, Withings). Your Activity Data is transferred to your connected Health Care Provider as Portal User.
• Product Safety Data: Personal data which will be processed to fulfill our legal obligations as manufacturer of the myoncare App as medical device. In addition, your personal data may be processed to fulfill legal safety or vigilance purposes of medical device or pharmaceutical companies. (“Product Safety Data”).
• Reimbursement Data: Personal data which are required for the reimbursement process between your Health Care Provider and your heath insurer (“Reimbursement Data”).
• Corporate Health Management Data: Personal or aggregated data which will be collected in concrete projects and questionnaires as asked by your employer (either directly or by Data Service Provider engaged by your Company). The data may relate to certain health information, your opinion regarding your personal well-being, your opinion as employee to a specific internal or external situation or data regarding the care or health situation in general (“Corporate Health Management Data”).
BLOCKCHAIN TECHNOLOGY
Blockchain technology (“Blockchain“) (European Patent No. 4 002 787), is an optional offered service, it is not mandatory. It is your Health Care Provider who decides to use the Blockchain solution. The Blockchain is supported by Hyperledger Fabric. Hyperledger Fabric is an open source software for enterprise-grade blockchain deployments. It offers a scalable and secure platform that supports blockchain projects.
Blockchain in the myoncare system is an additional database that stores data from all the installations. All the data is stored in Germany. It is a Private Blockchain (“Private Blockchain“), it allows the entry of only selected verified participants, and it is possible to override, edit, or delete entries as required.
In general, the Blockchain is made up of digitally recorded data in a chain of packages called ‘blocks’ that store records of transactions. The manner in which these blocks are linked is chronological. The first block created is called a genesis block and each block added afterwards will have a cryptographic hash that refers to the previous block, allowing to trace transactions and changes to information going back to the Genesis block. All transactions within the blocks are validated and agreed upon by a consensus mechanism, ensuring that each transaction is true and correct.
Each block contains the list of transactions, its timestamp, its own hash, and the previous block’s hash. A hash is a function used to convert digital data to a fixed-sized alphanumeric string. If an unauthorized person tries to update the data from a single block, the hash of the block would also change and the linking to this block would be lost. At this moment, the copy blockchain won’t be in sync with the other copies. When all nodes try to sync their copies they would realize that this one copy is different and then the network marks this node as illegitimate. This process makes it quite difficult for unauthorized persons to tamper with the records in the blockchain.
Our Blockchain is a Private Blockchain. A Private Blockchain is decentralized. It is a distributed ledger that operates as a closed database. Unlike Public Blockchains, which are “permissionless,” Private Blockchains are “permissioned,” because approval is required to become a user. In contrast to Public Blockchains that are open for everyone, Private Blockchains require some form of authorization. This allows to take advantage of the security and immutability of blockchain technology while also complying with privacy regulations, most notably the Personal Data Protection Law (PDPL). Private Blockchain records can be edited, orverrirden or deleted; deleted means in this context to erase the reference to the UUID (Universally Unique Identifier) in the customer´s database. The result is that the hash is anonymized in the Blockchain database, with the consequence that this process is compliant with the Personal Data Protection Law and it guarantees the rights of a data subject as stipulated in Art. 2 PDPL.
Types of data that are stored and processed on the Blockchain:
-Patient UUID
-Site/Institution UUID
-Asset UUID
-Hash of Caretask & Asset Data.
(UUID: Universally Unique Identifier).
The data stored in the Blockchain is pseudo-anonymous.
Our Blockchain intends to provide services that help prove the integrity of the data related to the privacy policy, patient profile, assets, and the assigned caretasks and medications. To communicate with the blockchain, the user needs to enroll a set of public-private keys. The enrollment process generates certificates that are stored in a separate database for Health Care Providers and on the phone for the patients. A backup of the patient’s keys is encrypted and stored in the Health Care Provider database which can be accessed only by the patient.
For the privacy policy consent verification, whenever the Health Care Provider intends to communicate with the patient, the system checks if the patient has valid consent to the privacy policy of the health care institution. The blockchain is used to guarantee the integrity and accountability of the record that stores that the patient has accepted the privacy policy.
When the Health Care Provider uploads the new version of the privacy policy, the hash of the file is stored in the blockchain, and after the patient consents to the privacy policy, this interaction is stored on the blockchain. For each communication with the patient, the blockchain returns a flag if the patient’s consent is still valid for the recent privacy policy by comparing the hash.
Similarly, for the patient sync feature, the integrity of the patient profile is assured by the blockchain. The Health Care Provider knows if the patient profile is out of sync with the profile on the phone by comparing the hash of the patient profile on the blockchain. This enables the Health Care Provider to have the most recent patient profile information.
myoncare Portal:
If the Health Care Provider decides to use the Blockchain solution, ONCARE will add an extra service called adapter service that will be used to communicate with the Blockchain. The Blockchain instance is hosted by ONCARE.
myoncare App:
The patients can connect to the same Blockchain instance, and it is done with the help of the phone manager service. This service is also hosted by ONCARE.
Justification of Processing: The processing of data by Oncare for the Health Care Provider is based on Art. 6 PDPL (data processor’s obligations).
PROCESSING OF OPERATIONAL DATA
– Applicable to all App Users –
You might provide us with certain personal data in case you are contacting us to understand or discuss the functions and usage of the App or in case of a service request.
In the event of a service request, the following personal data may also be viewed by authorized Oncare employees:
• The personal data that you have provided to your Health Care Provider through our App (e.g. name, date of birth, profile picture, contact details)
• The health data you have provided to your Health Care Provider, the Data Service Provider or Company through our myoncare App (e.g., information about medications taken, responses to questionnaires including disease-related or condition-related information, diagnoses and therapies provided by health care professionals, planned and completed tasks)
Authorized Oncare employees who have access to your Health Care Provider’s, Data Service Provider’s or Company’s database for the purpose of processing a service request are contractually required to keep all personal information strictly confidential.
When myoncare App is downloaded, the necessary information is transferred to the app store provider. We have no influence on this data collection and are not responsible for it. We process the personal data provided to us by the provider of the app store within the framework of our contractual relationship for the purpose of further developing our myoncare Apps and Services.
For the processing of Operational Data, Oncare acts as data controller responsible for the legitimate processing of your personal data.
Types of Data: Your name, e-mail-address, date of birth, registration date, pseudo keys generated by the app; device token to identify your device, your pseudo identification number, your IP address, type and version of the operating system used by your device.
The app uses Google Maps API to use geographical information. When using Google Maps, Google also collects, processes and uses data about the use of the map functions. For more information about the scope, legal basis and purpose of data processing by Google as well as the storage period, please refer to Google’s privacy policy.
Purposes of processing of Operational Data: We use the Operational Data to maintain the functionalities of myoncare App and to get in direct contact with you if required or initiated by you (e.g. in case of change of Standard Terms, necessary support, technical problems etc.).
Justification of Processing: The processing of Operational Data is justified based on Article 6 Paragraph 2 PDPL to fulfill the contract you conclude with Oncare for the purpose of the use of myoncare App.
IP GEOLOCATION
IP geolocation: We use a geolocation application for our services. We use ipapi (provided by apilayer Data Products GmbH, Elisabethstrasse 15/5, 1010 Vienna, Austria) to identify the location of the patient users. We use ipapi for the security of our applications and for the purpose to check the location of the patient user to ensure that the use of our services is legally compliant. We do not combine the information we collect with any other information about you that could identify you. Data processed by apilayer includes patient IP address and location details. Legal basis for the use of ipapi is Art. 6 PDPL. The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. More information on the apilayer Privacy Policy can be found at https://ipapi.com/privacy/.
PROCESSING OF TREATMENT DATA
– Applicable to App Users using the App with their Health Care Provider –
During the use of myoncare App, your doctor, a clinic or other health care provider treating you (“Health Care Provider”) will enter your personal data to myoncare Portal to start myoncare Services (e.g. provision of individual Careplan, reminder for intake of medicines etc.). In addition, you and your Health Care Provider will be able to upload documents and files related to you to myoncare App and myoncare Portal and can share the files with the other. Your Health Care Provider can upload a privacy policy for your information and define other consent requirements for you as a patient, for which your consent must be given. The files will be stored in a cloud database hosted in Germany. Your Health Care Professional can allow sharing such files with other Portal Users of his institution for medical reasons, but other Portal Users will not be able to access the files.
Your Health Care Provider will be responsible for a legitimate processing of the personal data.
We process such personal data, including your health data, under an agreement with and in accordance with the instructions of your Health Care Provider. For the purposes of this agreement, the Health Care Provider is responsible of processing your personal data and health data within the meaning of applicable data protection laws as data controller, and Oncare is the processor of such personal (health) data. This means that Oncare processes the Personal Data only according to the instructions of the Health Care Provider. If you have any questions or concerns regarding the processing of your personal data or health data, you should primarily contact your Health Care Provider.
Types of Data: Name, date of birth, profile information, contact details and also health data, such as symptoms, photos, information about medications taken, responses to questionnaires including disease-related or condition-related information, diagnoses and therapies provided by health care professionals, planned and completed tasks.
Purposes of Treatment Data processing: We process your Treatment Data to be able to provide our myoncare Services to your Health Care Provider and to you. Your health data, which you enter in our myoncare App, will be used by your Health Care Provider for consultation and support to you. We process this personal data as part of an agreement with and in accordance with the instructions of your Health Care Provider. The transmission of this Treatment Data is pseudonymized and encrypted. To exercise your rights as a data subject, please contact your Health Care Provider.
Justification of processing of Treatment Data: Your personal data will be processed by your Health Care Provider in accordance with the provisions of the PDPL and all other applicable data protection regulations. Legal basis for data processing in particular arise from Art. 12 PDPL for health data as sensitive data as well as your consent according to Art. 6 paragraph 2 PDPL. The processing of data by Oncare for your Health Care Provider is, in addition, based on Art. 6 PDPL.
Your doctor as data controller will be responsible to obtain your consent. Even if you can use myoncare App without such consent, most of the functions will not work anymore (e.g. sharing of data with your Health Care Provider). Therefore, denial or revocation of consent to process Treatment Data will lead to a heavy limitation of functionality of the App services and your doctor will not be able to support you via myoncare App anymore.
PROCESSING OF ACTIVITY DATA
– Only applicable if you agree to share Activity Data via myoncare Tools –
myoncare Tools offer you the possibility to connect the myoncare App to certain health apps (e.g. AppleHealth, GoogleFit, Withings), that you are using (“Health App”). To enable processing of Activity Data, we are asking you to consent to the processing beforehand. If the connection is established after you granted your consent, Activity Data collected by the Health App is transferred to your connected Portal Users with the purpose of providing additional, contextual information about your activity to them. Please note that Activity Data is not validated by myoncare Tools and shall not be used by your connected Portal Users for diagnostic purposes or the basis for medical decision making. Please also note, that your connected Portal Users are not required to monitor your Activity Data or provide any feedback to you regarding your Activity Data.
Activity Data is shared with your connected Portal Users each time you start myoncare App. At any time you can revoke your consent to share your Activity Data from within the settings in myoncare App. Please note that your Activity Data is not shared anymore from this time point onwards. Already shared Activity Data will not be deleted from the myoncare Portal of your connected Portal Users until its minimum legal retention period outlined in the PDPL has elapsed.
The processing of Activity Data by you falls within your own data responsibility.
Types of data: The type and extent of data transferred depends on your decision and the data available in your connected Health App. Data can include, inter alia, weight, height, taken steps, burned calories, hours of sleep, heart rate and blood pressure.
Purposes of processing of Activity Data: Your Activity Data is transferred to your connected Portal Users with the purpose of providing additional, contextual information about your activity to them.
Justification of Processing: The processing of the Activity Data is done under your own responsibility.
PROCESSING OF PRODUCT SAFETY DATA
As manufacturer of the App, we have to fulfill certain legal obligations (e.g. surveillance of functionality of the App, evaluation of incident reports which might be connected to the use of the App, tracking of users etc.). In addition, your Health Care Provider and you might communicate and collect personal data in myoncare App regarding specific medical devices or pharmaceuticals used in your treatment. The manufacturers of such medical devices or pharmaceuticals also have legal obligations regarding the surveillance of the market (e.g. collection and assessment of side effect reports).
Oncare is data controller for Product Safety Data.
Types of Data: Case reports, personal data provided in an incident report and results of evaluation.
Processing of Product Safety Data: We will store and assess any personal data related to our legal obligations and transfer such personal data (if possible after pseudonymization) to competent authorities, notified bodies or other data controllers with supervisory responsibilities. In addition, we will store and transfer personal data related to medical devices and/or pharmaceuticals, if we receive any notices by your Health Care Provider, by you as patient or any third person (e.g. our distributors or importers of the myoncare Tools in your country) that has to be reported to the manufacturer of the product to enable the manufacturer to fulfill its legal product safety obligations.
Justification of processing of Product Safety Data: Legal basis for the processing of personal data to fulfill legal obligations is Art. 6 and 12 PDPL.
PROCESSING OF REIMBURSEMENT DATA
– Applicable to App Users using the App with their Health Care Provider for reimbursement purposes –
myoncare App will support your Health Care Provider to start standard reimbursement processes for the health services provided to you via myoncare App. To enable the reimbursement process, myoncare App will support the collection of your personal (health) data by your Healh Care Provider for transfer of such data to your cost payer (either his/her Association of Statutory Health Insurances and/or your health insurer). This data processing is just an initial data transfer for the Health Care Provider to receive reimbursement by your health insurer. The kind and amount of personal data processed does not differ to other reimbursement routines of the Health Care Provider. Your Health Care Provider is data controller for Reimbursement Data. Oncare is acting as data processor based on the data processing agreement with your Health Care Provider.
Types of Data: Name, diagnosis, indications, treatment, period of treatment, other data required for reimbursement administration.
Processing of Reimbursement Data: Your Health Care Provider will transfer your Treatment Data required to receive reimbursement to the cost payer (either his/her Association of Statutory Health Insurances and/or your health insurer) and the cost payer will process the Reimbursement Data to provide reimbursement to your Health Care Provider.
PROCESSING OF CORPORATE HEALTH MANAGEMENT DATA
– Applicable to App Users using the App with the corporate health management program of their Company –
During the use of myoncare App in the corporate health management program of your Company, certain personal (health) data will be shared in an aggregated form as Corporate Health Management Data with your Company and any Data Service Providers (e.g. data analyst or research companies) engaged by your Company. Neither your Company nor any Data Service Provider will be able to allocate such data to your identity. Oncare recommends not to share personal information when using the myoncare Services in the context of corporate health management.
We process such Corporate Health Management Data, including your health data, under an agreement with and in accordance with the instructions of your Company and/or any Data Service Providers. For the purposes of this agreement, the Company is responsible for processing your Corporate Health Management Data as data controller, and Oncare as well as any Data Service Provider engaged by your Company, if any, are the processor of such data. This means that Oncare and any Data Service Provider process the Corporate Health Management Data only according to the instructions of the Company. If you have any questions or concerns regarding the processing of your Corporate Health Management Data , you should primarily contact your Company.
Purposes of Corporate Health Management Data processing: We process your Corporate Health Management Data to be able to provide our myoncare Services to your Company and to you. Your Corporate Health Management Data, which you enter in our myoncare App, will be used by your Company (either directly or via a Data Service Provider) in its corporate health management program. We process this Corporate Health Management Data as part of an agreement with and in accordance with the instructions of your Company and/or any Data Service Provider for its corporate health management program. The transmission of this Corporate Health Management Data is pseudonymized and encrypted. To exercise your rights as a data subject, please contact your Company.
Justification of processing of Corporate Health Management Data: Your Corporate Health Management Data will be processed by your Company in accordance with the provisions of the PDPL and all other applicable data protection regulations. Legal basis for data processing in particular arise from your consent according to Art. 6 Paragraph 1 of the PDPL or any other legal justification valid for your Company. The processing of data by Oncare to Company (either directly or via any service provider engaged by your Company) is, in addition, based on Art. 6 paragraph 2 PDPL.
Your Company as data controller will be responsible to obtain your consent if required due to data protection regulations and process the Corporate Health Management Data according to applicable data protection legislation.
SECURE TRANSFER OF PERSONAL DATA
We implement the appropriate technical and organizational security measures to ensure the optimal protection of the personal data stored by us against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. The security levels are continuously reviewed in collaboration with security experts and adapted to new security standards.
The data exchange to and from the App is encrypted. We use TLS and SSL as encryption protocols for secure data transmission. In addition, data exchange is end-to-end encrypted and takes place using pseudo-keys.
DATA TRANSFERS / DISCLOSURE TO THIRD PARTIES
We will only transmit your personal data to third parties within the scope of given statutory provisions or based on your consent. In all other cases, information will not be transferred to third parties unless we are obliged to do so owing to mandatory legal regulations (disclosure to external bodies, including the supervisory authorities or law enforcement authorities).
All transfer of personal data is encrypted during transfer.
SendGrid
We use Sendgrid for sending emails. The provider is Sendgrid Inc., 1801 California Street Suite 500, Denver, CO 80202, USA. Sendgrid is a service with which the sending of emails can be organized. Sendgrid is used to send confirmation emails, transaction confirmations and emails with important information regarding existing requests. The data you enter for the purpose of receiving emails is stored on Sendgrid’s servers. When we send email on your behalf through SendGrid, we use an SSL secured connection.
The emails are related to the following tasks:
-First login to the Web Application;
-Password reset workflow for the Web Application;
-Account creation for the Patient Application;
-Password reset for the Patient Application;
-Replacing push notifications by emails for PWA (Progressive Web App) in the following cases:
(i) When a Caretask is set to expire in one day;
(ii) When a Caretask is set to expire in one hour;
(iii) Medication has been assigned;
(iv) When the privacy policy has been updated.
For the purpose of analysis, the e-mails sent with SendGrid contain a so-called “tracking pixel”, which connects to Sendgrid’s servers when the e-mail is opened. By this, it is possible to determine whether an email message has been opened.
Legal basis
The data processing is based on your consent (Art. 6 PDPL para. 1). You can revoke this consent at any time. The legality of the data processing operations already carried out remains unaffected by the revocation.
Storage period
The data you provide us for the purpose of receiving emails will be stored by us until you unsubscribe from our services and will be deleted from our servers as well as from the servers of Sendgrid after you unsubscribe.
Please note that your data is usually transmitted by us to a SendGrid server in the USA and stored there. We have concluded a contract with Sendgrid incorporating the EU standard contractual clauses. This ensures that a level of protection comparable to that in the EU exists.
SendGrid (Privacy Policy): https://sendgrid.com/resource/general-data-protection-regulation-2/
Matomo
This is an open source web analysis tool. Matomo (provided by InnoCraft Ltd., New Zealand) does not transfer any data to servers outside the control of ONCARE. Matomo is deactivated when you use our services. Only after you have actively allowed it, your user behaviour will be recorded anonymously. By deactivating, a “permanent cookie” will be stored, if your browser settings allow this. This cookie serves the purpose of signaling Matomo not to capture your browser.
The information on usage collected by the cookie is transferred to our servers and saved there so that we can analyse user behaviour.
The information generated by the cookie about your use is:
-User role
-User geolocation
-User browser
-User OS
-IP Address
-Pages/screens visited in Web and PWA (see section about PWA in this Privacy Statement)
-Buttons the user clicks in Web and PWA
-Time user spent.
The information generated by the cookie on how you use our services will not be passed on to third parties.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality. For more information visit: https://matomo.org/privacy-policy/.
The legal basis for the processing of the users’ personal data is Art. 6 para. 1 of the PDPL. The processing of the users’ personal data enables us to analyse the surfing behavior of our users. By evaluating the data obtained, we are able to compile information about the use of the individual components of our services. This helps us to continuously improve our services and its user-friendliness.
We process and store personal data only for as long as this is necessary for the fulfilment of the intended purpose.
GENERAL INFORMATION ON CONSENT TO DATA PROCESSING
Your consent also constitutes permission to data processing under data privacy law. Before granting your consent, we will inform you about the purpose of the data processing and your right of objection.
If the consent also relates to the processing of special categories of personal data (i.e. sensitive data under the PDPL), myoncare App will explicitly notify you in the consent process. Processing of sensitive data according to Art. 9, 12 and 13 PDPL may only take place where necessary on the grounds of legal regulations and there is no reason to assume that your legitimate interests should prevail to the exclusion of processing such personal data or you have given consent to the processing of this personal data according to Art. 12 Paragraph 2 PDPL.
For the data processing for which your consent is required (as explained in this Privacy Notice), the consent will be requested during registration process. After successful registration, the consents can be managed in the account settings of myoncare App.
DATA RECIPIENTS / CATEGORIES OF RECIPIENTS
In our organization, we ensure that the only persons are entitled to process personal data are the ones who are required to do so in order to fulfill their contractual and statutory duties. Your personal data and health data that you enter in our myoncare App will be made available to your Health Care Provider and/or Company either directly or via a Data Service Provider (depending on the type of use of myoncare Tools).
In certain cases, service providers support our specialist departments in fulfilling their tasks. The necessary data protection contracts have been concluded with all service providers which are data processor for the personal data. These service providers are Hetzner Online and Google (Google Firebase). Google Firebase is a “NoSQL database” that enables synchronization between the myoncare Portal of your Health Care Provider and the myoncare App. NoSQL defines a mechanism of storing data which is modeled in means other than just tabular relations by allowing for easier “horizontal” scaling compared to tabular/ relational database management systems in a cluster of machines.
For this purpose, a pseudo key of the myoncare App is stored in Google Firebase along with the corresponding Careplan. The data transfer is pseudonymized to Oncare and its service providers which means that Oncare and its service providers cannot relate to you as a data subject. This is achieved by encryption of the data during transfer between you and your Health Care Provider or Company (either directly or to any Data Service Provider) and the use of pseudo-keys instead of personal identifiers such as names or e-mail addresses to track these transfers. Re-identification happens once the personal data has reached the account of your Health Care Provider or Company in myoncare Portal or your account in myoncare App after verification via specific tokens.
Hetzner Online provides cloud storage in which the Firebase Manager, which manages the Firebase URLs for the myoncare Portal, is stored. In addition, Hetzner Online provides the isolated server domain of myoncare Portal in which your personal data is stored. Hetzner Online also hosts myoncare’s video and file management services, which enable encrypted video conferencing and exchange of files between you and your Health Care Provider, respectively. Access to your personal data by you and your Health Care Provider is ensured by sending specific tokens. This personal data is encrypted during transfer and pseudonymized during transfer and at rest to Oncare and its service providers. Service providers of Oncare do not have access to this personal data at any time.
TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES
No personal data collected by this myoncare App will be stored in the app stores. Personal Data will only be transferred to third countries (outside of Egypt) if this is necessary for the performance of the contractual obligation, is required by law or you have given us your consent.
Synchronization of myoncare App with myoncare Portal takes place via Google Firebase. The Google Firebase servers are hosted in the EU. However, according to the Google Firebase Terms of Service, transient data transfers in countries where Google and its service providers have establishments are possible. In the case of certain Google Firebase services, data is only transmitted to the USA, insofar as no processing takes place in Egypt. Unauthorized access to your data is prevented by end-to-end encryption and secure access tokens. Hetzner Online is hosted in Nuremberg, Germany.
In order to process Activity Data, interfaces to Google cloud services (in case of GoogleFit) or to AppleHealth or Withings within the mobile device of the App User are used. Myoncare Tools use these interfaces which are provided by Google, Apple and Withings, to request Activity Data from connected Health Apps. The request sent by myoncare Tools does not contain personal data but personal data is provided to myoncare Tools via these interfaces.
PERIOD OF PERSONAL DATA STORAGE
We store your personal data as long as they are needed for the respective processing purpose. Please note that numerous retention periods dictate that personal data must continue to be stored. This applies in particular to commercial law or tax law storage obligations (e.g. Commercial Code, Tax Code, etc.). In addition, your Health Care Provider also has to ensure storage of your medical files (varies between 1 and 30 years, depending on the nature of documents).
Please note that Oncare is also subject to storage obligations which are contractually agreed with your Health Care Provider on the basis of legal provisions. If there are no further storage obligations, the personal data is routinely deleted once the purpose has been achieved.
In addition, we can store personal data if you have given us your permission to do so or if legal disputes arise and we use evidence within the framework of statutory limitation periods, which can be up to thirty years; the regular limitation period is five years.
OBLIGATION TO PROVIDE PERSONAL DATA
Various personal data are necessary for the establishment, performance and termination of the contractual relationship and the fulfillment of the associated contractual and legal obligations. The same applies to the use of our myoncare App and the various functions it provides.
We have summarized the details for you in the above point. In certain cases, personal data must also be collected or made available in accordance with statutory provisions. Please note that it is not possible to process your enquiry or to execute the underlying contractual obligation without providing this personal data.
GRANTED ACCESS RIGHTS
In order for the myoncare App to work on your device, it is necessary for the App to be granted various permissions to access certain functions of the device. For all devices, independent from the operating system used, it is necessary to grant the App certain permissions, which we call “basic permissions”. Depending on the operating system of the device you are using, it may have additional features that require additional permissions to make the app work. If applicable, we will list them in order of operating system (Android or iOS) after the “basic conditions”.
The basic permissions (Android and iOS) are:
• Retrieve WLAN connections
Required to ensure the functionality of the document download in connection with WLAN connections.
• Retrieve Network Connections
Required to ensure document download functionality in connection with network connections that are not WLAN connections.
• Disable screen lock (prevent stand-by mode)
Required so that the videos that are among the provided documents can be played directly in the app without being interrupted by screen lock.
• Access all networks
Access to all networks is required to download documents.
• Disable sleep mode
This is necessary so that the videos that are among the provided documents can be played directly in the app, without the playback being interrupted by the occurrence of sleep mode.
• Mobile data / access to mobile data
If the user wishes to download documents exclusively via WLAN, he can make the appropriate setting in the menu of the app and deactivate the use of mobile data. Access to mobile data is necessary to ensure the functionality of deactivating document downloads via mobile data.
• Camera access
Camera access is required for scanning of QR codes and for video consultations.
• Microphone access
This is required for video consultations.
• Access to files and photos
This is necessary for the exchange of files between you and your connected Portal Users.
• Access to web browsers
This is necessary to view received files from your connected Portal Users.
We use push notifications, which are messages sent to your mobile device as a service of the myoncare App via services such as Apple Push Notification Service or Google Cloud Messaging Service. These services are standard features of mobile devices. The service provider’s privacy policy governs the access, use, and disclosure of personal information as a result of your use of these services.
AUTOMATED DECISIONS IN INDIVIDUAL CASES
We do not use purely automated processing to make decisions.
YOUR RIGHTS AS DATA SUBJECT
We would like to inform you of your rights as a data subject. These rights are set out in article 1 PDPL and include:
• Right of access (Art. 1 (1.) PDPL): You have the right to access and be provided with a copy of any personal data that we hold about you;
• Right to rectification (Art. 1 (3.) PDPL): You can require us to correct or amend or erase or complete your personal data;
• Right to restriction of data processing (Art. 1 (4.) PDPL): You can require us to “restrict” our use of your information, so that we can continue the use of your information only subject to restrictions;
• Right to be informed of any personal data breach (Art. 1 (5.) PDPL): You have the right to be informed of any personal data breach in relation to your personal data;
• Right to object and/or revoke consent to data processing (Art. 1 (2) and (6) PDPL): You have the right to revoke your consent at any time, if we process your personal data based on your consent. You, further, have the right to object to our use of your personal data whenever it contradicts with your fundamental rights. We will continue to provide our services if they do not depend on the consent that has been revoked and/or objected.
To exercise these rights, please primarily contact your Health Care Provider or your Company or us at privacy@myoncare.com. We will require you to provide satisfactory proof of your identity to ensure that your rights are protected and that your personal data is disclosed only to you and not to any third party.
Please also contact us at any time at privacy@myoncare.com, if you have questions about data processing in our company or if you wish to revoke your consent. You also have the right to contact the relevant data protection supervisory authority.
DATA PROTECTION OFFICER
You can contact our data protection officer to answer all data protection questions at privacy@myoncare.com.
AGE RESTRICTION OF THE APPLICATION
A minimum age of 18 years is required to use myoncare App
CHANGES TO PRIVACY NOTICE
We explicitly reserve our right to modify this Privacy Notice in future at our own discretion. Modifications or additions may, for instance, be necessary to meet statutory requirements, correspond with technical and economic developments or to meet the interests of the App or Portal Users.
Any modifications are possible at any time and will be published in an appropriate manner and in an appropriate time frame to you before they take effect (e.g. by posting revised Privacy Notice at login or by providing advance notice to you of material changes).
ONCARE GmbH
Postal address
Balanstraße 71a
81541 Munich, Germany
Contact info of the data protection officer:
Last updated 21 August 2023.
* * *
