Privacy Policy of MindDoc Health GmbH and Schön Klinik MVZ GmbH for Joint and Individually Responsible Data Processing (valid from 01.02.2021)

On this page we provide information about the responsibilities for processing personal data (Chapter 1), the legal basis, the categories and details of processed data (Chapters 2-4), personal rights (Chapter 5) and other information (Chapters 6-9) related to the following products:

Chapter 1
General information on data controlling online-therapy

1.1 Information on the persons responsible for data controlling and the data protection officer

For the lowest possible threshold and frictionless care of patients and users and for the provision of various services for the detection, monitoring, self-management and guideline-based treatment of mental illnesses, the companies named below (each 100% subsidiaries of Schön Klinik SE) offer different services and products.

For this purpose, the companies have concluded a joint responsibility agreement for the joint controlling of personal data in accordance with Art. 26 GDPR. For the areas in which there is no joint determination of the purposes and means of data controlling, the respective named party is the independent controller within the meaning of Art. 4 No. 7 GDPR.

This privacy policy applies to data processing by the following companies:

MindDoc Health GmbH, Leopoldstraße 159, 80804 Munich (“MindDoc Health”)

Schön Klinik MVZ GmbH, Seestraße 5a, 83209 Prien am Chiemsee, (““Schön Klinik MVZ””)

The following outlines the key joint responsibility agreements in the case of joint responsibility between jointly responsible parties.

Sole responsibility according to Art. 4 No. 7 GDPR MindDoc Health GmbH.

Website and information and services contained.

MindDoc App as an unaccompanied monitoring and self-management offering as described at

and, accessible via the app stores:
Apple Appstore
Google Play

Joint responsibility according to Art. 26 GDPR: MindDoc Health and Schön Klinik MVZ GmbH

MindDoc online psychotherapy services and available at the following URLs:

Concretization of the processing operations at the online psychotherapy MindDoc according to Art. 26 GDPR

Contact point for data subject rights according to Art. 26(1) sentence 3 GDPR

In doing so, the responsible parties have defined a contact point for affected individuals, which facilitates the fulfillment of the data subject rights according to Art. 26 (1) sentence 3 GDPR for the users and the responsible parties. This common point of contact is the aforementioned MindDoc Health GmbH.

Description of data processing

Collection, storage, modification, viewing, deletion, and use of personal data in the context of online psychotherapy and related initiation activities (e.g., initial interview, catamneses)

Purpose of data processing

For Schön Klinik MVZ, the purpose of the processing is the fulfillment and implementation of contractual relationships with (future) patients of online psychotherapy. MindDoc Health GmbH processes personal data

- for the purpose of operating the applications for conducting online psychotherapy of data backup,

- For internal administrative purposes, e.g., to avoid duplication by matching data with existing data, thus taking into account the principle of data economy, and to ensure centralized patient management and optimal care across different treatment intensities.

The data protection officer of Schön Klinik SE (Dr. Klaus-Georg Baier) has been appointed as joint data protection officer by both companies and can be contacted at:
Tel.: 08051/695252

Address: Schön Klinik SE, Dr. Klaus-Georg Baier, Datenschutzbeauftragter, Seestraße 5a, 83209 Prien am Chiemsee

Chapter 2
MindDoc Website online-therapy

2.1 Overview

The website serves to provide information about our offers, which we offer in the context of online psychotherapy as well as the unaccompanied use of the MindDoc app for people with mental health problems. In addition, they guide the user to a suitable treatment offer and enable an initial assessment of possible problem areas by means of a self-test.

2.1.1 Informational use

In the case of merely informational use of the website, i.e. if no registration with one of our services, no contact or other form of registration is made or information is otherwise transmitted, we do not collect any personal data with the exception of the data that a browser transmits to enable a visit to the website. These are:

  • IP address
  • Date and time of the request
  • Time zone difference from Greenwich Mean Time (GMT)
  • Content of the request (concrete page)
  • Access status/HTTP status code
  • Data volume transferred in each case
  • Website from which the request comes
  • Browser
  • Operating system and its interface
  • Language and version of the browser software

Legal basis is the legitimate interest according to Art. 6 para. 1 p. 1 lit. f GDPR

2.1.2 Data collection and services used when communication through MindDoc online therapy

Inquiry to MindDoc Patient Management via contact form

When contacting us by e-mail or via a contact form, the data provided (usually the e-mail address, name, possibly telephone number) will be stored by us in order to answer questions.

To secure our contact forms, we use the captcha service MTCaptcha. This service is compliant with the GDPR and does not store any personal data. IP addresses are anonymized. MTCaptcha uses cookies exclusively to eliminate unauthorized form access by so-called bots.

More information about the MTCaptcha service:

Legal basis is the legitimate interest according to Art. 6 para. 1 p. 1 lit. f GDPR

Contacting and making an appointment with the personnel team

The website uses Acuity Scheduling for making appointments (for example, for informational interviews with our staff team). The Acuity Scheduling service is used to facilitate the booking of appointments via the website (only on selected pages - the booking of appointments for an initial online therapy consultation is explicitly not affected by this. By using this service, data is transferred to Acuity Scheduling in the USA. This is done on the basis of the EU standard contractual clauses. We would like to point out that we, as the site operator, have no detailed knowledge of the content of the transmitted data and its use by Acuity Scheduling, however, we anonymize the IP in any case. The legal basis for this processing is according to Art. 6 para. 1 p. 1 lit. b GDPR the implementation of pre-contractual measures in the form of the appointment.

Information on Acuity Scheduling's privacy policy:

Detailed information about Acuity Scheduling and the data collected in connection with the service:

Squarespace's Data Processing Supplement in the context of the GDPR: These features are provided by Acuity Scheduling Inc, NY, USA.

Alternatively, we offer a contact option for making an appointment via e-mail (e.g. the contact form).

Legal basis is the implementation of pre-contractual measures according to Art. 6 para. 1 p. 1 lit. b GDPR

Use of the newsletter and use of MailChimp

In some areas of the website we offer registration to a newsletter for interested parties. This is voluntary and is not linked to any incentive program or similar - the website can also be used without restrictions without this service. However, as this service is provided by an external service provider, we ask you to note the following:

The dispatch of the newsletter (advisor) and the processing of personal data (e-mail address) is carried out by means of the dispatch service provider "MailChimp", a newsletter dispatch platform of the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE 5000, Atlanta, GA 30308, USA. Privacy policy of the shipping service provider: The legal basis for the commissioning of the shipping service provider is the consent of the user pursuant to Art. 6 (1) lit. a GDPR.

The dispatch service provider may use the data of the recipients in pseudonymous form, i.e. without assignment to a user, to optimize or improve its own services, e.g. to technically optimize the dispatch and presentation of the newsletters or for statistical purposes. However, the dispatch service provider does not use the data of our newsletter recipients to write to them itself or to pass the data on to third parties.

The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened, or if we use a shipping service provider, from their server. Within the scope of this retrieval, technical information, such as information on the browser and system, as well as your IP address and the time of the retrieval are initially collected.

This information is used for the technical improvement of the services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. Statistical surveys also include determining whether newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our intention nor, if used, that of the dispatch service provider to observe individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

The legal basis is the consent according to Art. 6 para. 1 p. 1 lit. a GDPR.

2.1.3 Technical services for the presentation, display and optimized use of the website

Font Awesome

Our website uses so-called web fonts provided by Fonticons, Inc. for the uniform display of fonts. When a page is called up, the browser loads the required web fonts into the browser cache in order to display texts and fonts correctly. For this purpose, the browser used must establish a connection to the servers of Fonticons, Inc. This enables Fonticons, Inc. to know that our website has been accessed via the IP address used.

The use of web fonts is in the interest of a uniform and appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 (1) p. 1 lit. f GDPR.

If the browser in use does not support web fonts, a default font from the device in use will be used. Privacy policy of Fonticons, Inc.:

Script libraries (Google Web Fonts)

In order to display our content correctly and graphically appealing across browsers, we use script libraries and font libraries such as Google Webfonts ( on our website. Google Web Fonts are transferred to your browser's cache to avoid multiple loading. If the browser does not support Google Web Fonts or prevents access, content is displayed in a standard font. Calling up script libraries or font libraries automatically triggers a connection to the operator of the library. It is theoretically possible - but currently also unclear whether and for what purposes - that operators of such libraries collect data. Privacy policy of the library operator Google: The legal basis for this is our legitimate interest in search engine optimization, improved loading times, low administrative effort and uniform presentation across devices, Art. 6 (1) p. 1 lit. f GDPR.

Google Maps

This website uses Google Maps API to visually display geographic information (e.g., map to locations for initial diagnostic consultations at We use Google Maps (API) from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Maps is a web service for displaying interactive (land) maps in order to visually present geographical information. Already at the time of calling up those sub-pages in which the map of Google Maps is integrated, information about your use of our website (such as your IP address) is transmitted to Google servers and stored there. This may also result in a transmission to the servers of Google LLC. in the USA. This is independent of whether you have a user account or are logged in there. If you are logged in to Google, your data will be directly assigned to your account. You can prevent this by logging out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates them. The collection, storage and evaluation are carried out in accordance with Art. 6 para. 1 p. 1 lit. a GDPR on the basis of your consent. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right. If you do not consent to the future transmission of your data to Google in the context of the use of Google Maps, you also have the option of completely deactivating the Google Maps web service by turning off the JavaScript application in your browser. Google Maps and thus also the map display on this website can then not be used. You can view the terms of use of Google at, the additional terms of use for Google Maps can be found at

Further information about data processing by Google can be found in the Google privacy policy. Personal data protection settings can also be changed there in the data protection center:

Detailed instructions on how to manage your own data in connection with Google products:

2.1.4 Services for tracking user behavior and marketing purposes

In order to analyze user behavior on our website, to measure and attribute marketing activities, and to optimize and ensure a smooth process of booking initial diagnostic consultations, various services are used on the website and the page for booking initial diagnostic consultations which are only active if a user has actively consented to this processing of data.

Google Ads and Conversion Measurement

We use the online marketing method "Google Ads" to place ads in the Google advertising network (e.g. in search results, in videos, on web pages, etc.) so that they are displayed to users who have a presumed interest in the ads. Furthermore, we measure the conversion of the ads. Google uses cookies. The information generated by the cookie about the use of the online offer by the users is usually transmitted to a Google server in the USA and stored there. Google will use this information on our behalf to evaluate the use of our online offer by users, to compile reports on the activities within this online offer and to provide us with other services related to the use of this online offer and the Internet. In doing so, pseudonymous usage profiles of the users can be created from the processed data and transferred to the USA. However, we only learn the anonymous total number of users who clicked on our ad and were redirected to a page marked with a so-called "conversion tracking tag". However, we ourselves do not receive any information with which users can be identified. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent the collection of the data generated by the cookie and related to their use of the online offer to Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link:
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website:; privacy policy: : Legal basis is the consent according to Art. 6 para. 1 p. 1 lit. a GDPR.

Microsoft Advertising

We use conversion tracking from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft Advertising stores a cookie on your computer if a user has reached our website via a Microsoft Advertising ad. In this way, Microsoft Advertising and we can recognize that someone has clicked on an ad, been redirected to our website and reached a previously determined target page (conversion page). We only learn the total number of users who clicked on a Microsoft Advertising ad and were then redirected to the conversion page. No personal information about the user's identity is shared. If a user does not want Microsoft to use behavioral information as described above, he or she can refuse the required cookie setting - for example, by selecting a browser setting that disables the automatic setting of cookies. Likewise, the collection of the data generated by the cookie and related to the use of the website by the user, as well as the processing of this data by Microsoft can be prevented by declaring objection under the following link:

Further information on data protection and the cookies used at Microsoft and Microsoft Ads:

The legal basis is the consent according to Art. 6 para. 1 p. 1 lit. a GDPR.

Google Tag Manager

Google Tag Manager is a solution with which we can manage so-called website tags via an interface and thus integrate other services into our online offer. The Tag Manager itself (which implements the tags) does not process any personal data of the users. With regard to the processing of users' personal data, please refer to the following information on Google services. Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website:;
privacy policy:
The legal basis is consent pursuant to Art. 6 (1) p. 1 lit. a GDPR.

Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC ("Google"). Google uses cookies. The information generated by the cookie about the use of the online offer by the users is usually transmitted to a Google server in the USA and stored there. Google will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. In doing so, pseudonymous usage profiles of the users can be created from the processed data and transferred to the USA. We only use Google Analytics with IP anonymization activated. This means that the IP address of the user is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. However, we would like to point out that in exceptional cases the full IP address is transmitted to a Google server in the USA and only shortened there. The IP address transmitted by the user's browser is not merged with other data from Google. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent the collection of the data generated by the cookie and related to their use of the online offer to Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link: For more information about Google's use of data, settings and opt-out options, please visit Google's websites: ("Data use by Google when you use our partners' websites or apps"), ("Data use for advertising purposes"), ("Manage information Google uses to serve you ads").

We use Google Analytics to analyze and improve our website. The legal basis for the use of Google Analytics is the consent according to Art. 6 para. 1 sentence 1 lit. a GDPR.

Microsoft Universal Event Tracking (UET)

On our website, Microsoft Ads technologies are used to collect and store data from which usage profiles are created using pseudonyms. This is a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. This service enables us to track the activities of users on our website if they have reached our website via ads from Microsoft Ads. If users arrive at our website via such an ad, a cookie is placed on their computer. A Microsoft Ads UET tag is integrated on our website. This is a code which, in conjunction with the cookie, stores some non-personal data about the use of the website. This includes, among other things, the length of time spent on the website, which areas of the website were accessed and via which ad the users arrived at the website. Identity information is not collected. The information collected is transferred to Microsoft servers in the USA and stored there for a maximum of 180 days. The collection of data generated by the cookie and related to your use of the website as well as the processing of this data can be prevented by users deactivating the setting of cookies. This may, under rare circumstances, restrict the functionality of the website. In addition, Microsoft may be able to track usage behavior across multiple of your electronic devices through so-called cross-device tracking and is thus able to display personalized advertising on or in Microsoft websites and apps. This behavior can be disabled at For more information about Microsoft Ads analytics services:

More information about privacy at Microsoft and Microsoft Ads:

The legal basis is the consent according to Art. 6 para. 1 p. 1 lit. a GDPR.

Storage duration of cookies used

The cookies we use in the context of advertising and tracking purposes (i.e. non-essential cookies) have the following purpose and expiration periods:




Google Tag Manager cookie for the control and integration of cookies. However, these cookies come from Google Analytics and not from Google Tag Manager itself.


1 year




Contains a randomly generated user ID. This ID allows Google Analytics to recognize returning users on this website and merge data from previous visits.


24 hours




This cookie is set when a user clicks on a Google ad to reach the website. It contains information about which ad was clicked, so that successes achieved, such as orders or contact requests, can be assigned to the ad.


90 days




Newsletter plugin


90 days




Contains a randomly generated user ID. This ID allows Google Analytics to recognize returning users on this website and merge data from previous visits.


2 years




Certain data is only sent to Google Analytics a maximum of once per minute. The cookie has a lifetime of one minute. As long as it is set, certain data transfers are prevented.


1 minute

complianz_conent_[status, policyId], viewed_cookie_policy, CookielawInfoConsent, Cookieladinwo_checkbox-nonnecessary



Cookie Consent Form on our Wordpress pages (e.g. Career)


1 year








Chapter 3
Online psychotherapy MindDoc online-therapy

In the context of online psychotherapy, data about the person as well as the medical data necessary for the treatment are collected, recorded, stored, processed, queried, used or transmitted.

In order to implement online psychotherapy, we collect and process both general personal data and data relating to health. Health data are all data that relate to the physical or mental health of a patient. This includes, for example, data that are clearly related to health, as well as data that allow conclusions to be drawn about the state of health or where conclusions have already been drawn about the state of health, regardless of whether they are correct or incorrect. These processed data can represent health data both individually and in an overall view.

Important note: Storage or recording of the video calls does not take place without prior, separate consent.

3.1 Purposes for which personal data are processed

MindDoc may only process patient data if a legal basis requires or permits this or if the patient gives consent to do so:

  • First of all, data is required to create a user account as a patient. In this context, a comparison is made with existing user data from the MindDoc app (MindDoc Health GmbH) in order to meet the objectives of data security and economy and to avoid duplication of accounts. This is done to protect the interests of the users concerned on the basis of legitimate interest pursuant to Article 6 (1) sentence 1 lit. f GDPR and as part of the shared responsibility agreement pursuant to Article 26 GDPR.
  • For treatment (online psychotherapy), processing of patient data is necessary in particular for preventive, diagnostic, therapeutic, curative and also aftercare reasons.
  • In addition, the data is processed with regard to interdisciplinary conferences for the analysis and discussion of diagnostics and therapy, for preliminary, joint and further care with regard to diagnostics, therapy, findings and disease / vital status. All these processes are carried out to ensure the best possible treatment.
  • In addition to this patient-related processing, administrative and support processing is also required. This essentially requires the processing of data for the billing of treatment, for reasons of controlling or auditing, for the assertion, exercise and defense of legal claims, etc.
  • Data processing is also carried out for the purposes of training, continuing education and further training of physicians and of members of other health care professions, as well as for reasons of support and maintenance of IT systems and applications, and in the event of troubleshooting technical errors or questions from individual patients
  • The data can also be used for quality and analysis purposes to improve therapy processes, content, as well as to improve the user experience during online psychotherapy.
  • Patient data may be required as part of measuring the effect size of online therapy for internal quality assurance purposes and to measure the stability of treatment delivery via standardized questionnaires sent to patients 3, 6, and 12 months after completion of regular therapy.

Details of the personal data processed

The following personal data may be collected by MindDoc in the course of online psychotherapy:

Patients and Therapeutic users (psychotherapists, psychiatrists)

- First name(s)
- Last name(s)
- Title (e.g. Dr., Prof.)
- E-mail address
- Date of birth
- Postal address
- Phone number
- Gender
- IP address
- Profile photo

Details of booked appointments for initial diagnostic consultations and (regular) online therapy appointments.

- Time (start, end)
- Notes

Therapeutic users (psychotherapists, psychiatrists) only

- Areas of specialization, focus and introductory texts

For patients only

- Contact data of third parties in the context of a specified emergency contact (e-mail address, first name, last name)

The following data with reference acc. to Art. 9 para. 2 lit. h GDPR, can be collected by MindDoc in the context of online psychotherapy from patients:

  • Reason for treatment (i.e. reason for visit such as depression, eating disorder, burnout, tinnitus, anxiety disorder, obsessive-compulsive disorder).
  • Cost unit/health insurance
  • Insurance number
  • Treatment pathway (i.e. regular online therapy, aftercare, initial interview diagnosis).
  • Qualitative responses and notes entered in writing in therapy sessions, questionnaires, or within electronic chat (e.g., responses about medication use, occupation, family relationships, thoughts and feelings).
  • Quantitative values from therapeutic questionnaires (e.g., PHQ 9 scores) and thus symptom trajectories.
  • Number and type of therapy lessons selected and prescribed, as well as their processing status (e.g., open, in process, feedback pending, completed)
  • Date, time, duration, and type of activities between patient and therapist or patient management (e.g., video therapy, chat message, therapy session assigned)
  • Information on suicidality by the patient
  • Important note and notes from the initial diagnostic interview (e.g., notes on suicidality).

3.1.2 Legal basis

When using MindDoc online psychotherapy, i.e. upon completion of registration as well as use of the platform, we collect personal data in order to enable the use of MindDoc and a successful course of online psychotherapy. Registration can take place in the following two ways:

The basis for MindDoc being allowed to process data under data protection law arises mainly from the fact that MindDoc is responsible for the treatment of patients. Thus, for proper administrative processing of treatment and related tasks, the recording of personal and health data is indispensable. There are numerous laws and regulations that allow MindDoc to process the data, such as the EU General Data Protection Regulation (GDPR) in Articles 6 and 9 GDPR. In addition, there are principles in German law, such as the German Federal Data Protection Act (BDSG), in particular Section 22 BDSG, and in the German Civil Code (BGB) in Sections 630 et seq. BGB, which requires processing of the above-mentioned data.

The legal basis for the collection and processing of personal data in the course of treatment is Art. 9 (2) (h), (3) GDPR.

The following are examples of the legal bases for individual processing operations:

  • Data processing for the purpose of carrying out as well as documenting the treatment process including the intra-medical and inter-professional exchange within MindDoc about the patient for the treatment (Art. 9 para. 2h, para. 3, para. 4 GDPR in conjunction with §§ 630a ff, 630f BGB),
  • Data transfer to "external parties" in the sense of joint treatment (in a team), consultation of external consultants, e.g. laboratory, telemedicine, as well as consultation of external therapists (Art. 9 (2h), (3), (4) GDPR),
  • Data transfer to the statutory health insurance companies for the purpose of billing (Art. 9 para. 2h, para. 3, para. 4 GDPR),
  • In addition, processing is also permitted in cases where the patient as well as the therapist have given consent, such as storage or recording of video calls.
  • Follow-up survey via online questionnaires. However, this only takes place in the case of consent by the patient, Art. 9 (2) lit a GDPR.

3.1.3 Sources of data within the framework of online psychotherapy MindDoc

MindDoc generally collects the necessary data from the users (i.e. patients, therapists, administrators) themselves. In some cases, however, we may receive personal data from other therapists, hospitals that carried out the initial / preliminary treatment, physicians in private practice, specialists, medical care centers (MVZs), etc. This data is merged with the other data of a patient for the purposes of uniform documentation. MindDoc combines this data with the other data of a patient in the sense of uniform documentation.

3.1.4 Access authorization to online psychotherapy data

The persons involved in the treatment (i.e. esp. therapists, psychiatrists, physicians) have access to patient data. This data is processed by specialist staff or under their responsibility. This specialist personnel is either subject to professional secrecy or a duty of confidentiality.

If required for administrative purposes, an administrative employee (e.g. patient management, technical support) can also access patient data (personal as well as health-related data). The confidential handling of your data is also ensured here by corresponding confidentiality obligations.

3.1.5 Possible recipients of data

All data will be collected within the scope of the intended purpose in compliance with the respective data protection regulations or any existing declarations of consent and, if necessary, transmitted to third parties. Such third parties are in particular:

  • statutory health insurers provided that a patient is covered by statutory health insurance,
  • private health insurances if a patient is privately insured,
  • Medical experts of the Medical Service of the Health Insurance Funds (MDK) for the assessment of services rendered, for the initiation of services for participation or in case of incapacity for work.
  • Medical reviewers from insurance companies to evaluate renewal applications.
  • Accident insurance carrier,
  • Primary care physicians,
  • further, after or with treating physicians and/or therapists,
  • Other health care or treatment facilities,
  • Rehabilitation facilities,
  • Nursing Facilities,
  • external data processors (so-called order processors), taking into account the obligations arising from Art. 28 GDPR: These oblige such service providers to comply with legal standards with regard to data protection and data security. As a result, the processors are bound by our instructions and are regularly monitored by us. Within the following categories, we use such processors in accordance with Art. 28 GDPR, which are necessary for the development and provision of online therapy and related services: Hosting of data and applications, email dispatch, customer support, provision and integration of course content.

The legal basis for the use of these third-party providers on Basis is our legitimate interest in keeping MindDoc permanently maintained and evaluating its performance under Article 6 (1) p. 1 lit. f DSGVO.

3.1.6 Special notes on the storage period of the online psychotherapy data

In accordance with § 630f BGB (German Civil Code), Schön Klinik MVZ GmbH is obliged to keep documentation on your treatment. This patient file must be kept by us for at least 10 years and may be kept for up to 30 years in individual cases for reasons of preservation of evidence.

Chapter 4
MindDoc Monitoring and Self-Management App online-therapy

As part of the unaccompanied use of the MindDoc app for monitoring and self-management of mental disorders, personal data is collected to the extent:

  • this is necessary for the provision of the requested services,
  • A user has consented to the processing, or
  • we are otherwise authorized to do so on the basis of another legal basis.

For the processing of health data according to Art. 9 para. 2 lit. h GDPR, we always obtain consent separately. Each user must actively consent (e.g. by clicking) to the processing of this data. This consent is logged by us. The data specified below is collected in order to provide the services specified in Section 2 of our General Terms and Conditions (GTC). In principle, it is possible to use the MindDoc app as an unaccompanied tool for monitoring and self-management without collecting data that allows direct attribution to a person. However, the use of personal data is required for the use of our app in the context of online psychotherapy (only in Germany and with the consent to further terms and conditions and data protection provisions, see the associated chapter of this document) or for the creation of a personal account, e.g. in order to access old data again when changing the smartphone.

4.1 Details of the personal data processed and related legal bases

4.1.1 Personal data for the creation of a personal account

To create a personal account, with which one can easily access the history even when changing the smartphone, we collect and process the following personal data, in the way that the user gives it to us:

  • Name
  • First name
  • Profile photo (optional)
  • email address

The legal basis for the data processing is the fulfillment of the usage contract according to Art. 6 para. 1 p. 1 lit. b GDPR.

4.1.2 Extended personal data for simultaneous use of MindDoc online psychotherapy services in Germany

  • Postal address
  • Insurance provider
  • Insured person number
  • Phone number

The legal basis for the data processing is Art. 9 para. 2 lit. h GDPR.

4.1.3 Health data

Within the app, the user can go through 14-day monitoring to get an assessment of their mental state. Various questions are answered as part of this monitoring. In addition, further services, e.g. payment offers, can be used, which are described in more detail in section 2 of our GTC. We collect, process and use the following health data in order to be able to provide these services in accordance with section 2 of our GTC:

Data from the MindDoc survey (monitoring and screening):

  • Questions about the general mental condition
  • Questions about other complaints and symptoms
  • Questions about living conditions, leisure activities and biography
  • Evaluations of the above data regarding the severity and type of symptoms reported, as well as psychological correlations of the responses.
  • Information on a scale of smileys, with which moods are regularly documented
  • User-created text-based note input
  • If explicit consent is given within the app, we store data from Apple Health (iOS) or Google Fit (Android). This is primarily the number of steps per day and other indications of physical activity or sleep. We use this data to deliver our services within MindDoc, in particular to feed back correlations between psychological factors and physical activity. MindDoc does not send data to Apple Health or Google Fit

The legal basis for the data processing is Art. 9 para. 2 lit. h GDPR.

Data from the psychological exercises

  • Text-based input in the exercises
  • The photos uploaded by the user in the course of the exercises

The legal basis for the data processing is Art. 9 para. 2 lit. h GDPR.

4.1.4 Technical data

This is data that tells us what hardware and software is being used to access our app:

  • Data about the mobile platform (iOS/Android) and version
  • Apple Identifier for Vendor (IDVA) or Android ID
  • App version
  • Device model
  • Verification of payment receipt at Apple and Google (receipts do not contain names or addresses).

The legal basis for data processing is the legitimate interest according to Art. 6 para. 1 p. 1 lit. f GDPR.

4.1.5 App usage data

This is data that tells us how and how often the app is used:

  • How many times was the app opened?
  • Which areas were clicked on in the app?
  • App settings used (language settings, notifications)
  • Feedback data (incl. e-mail service).

The legal basis for the data processing is the legitimate interest according to Art. 6 para. 1 p. 1 lit. f GDPR or the consent according to Art. 6 para. 1 p. 1 lit. a GDPR for the feedback data.

4.2 Possible recipients of data

We generally do not share your data with third parties unless we are legally entitled or obligated to do so, or you have given us consent to do so. In the event that we process personal data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or have it processed (see also the third-party tools described), this is done in compliance with the respective legal specifics. In these cases, we will always take appropriate measures to adequately secure your data (e.g., encryption with our own key management).

4.3 Third party tools

MindDoc sometimes commissions third-party service providers to provide services for the analysis and evaluation of user behavior (e.g., crash reporting, analytics) or to provide important basic technical services (e.g., push notifications, hosting, e-mailing) as part of the mobile app. If these service providers process personal data, we conclude a commissioned processing agreement with them in accordance with Article 28 GDPR, which obligates these service providers to comply with legal standards with regard to data protection and data security. As a result, the processors are bound by our instructions and are regularly monitored by us.
In detail, we use the following tools and providers (beyond others for infrastructure purposes like hosting, transactional e-Mailing).

4.3.1 Google Firebase

We use Firebase (, a framework from the Google subsidiary Firebase based in San Francisco, CA, USA, through which we track and manage the following real-time features. We use all possibilities to deactivate the collection of personal data such as the advertising or vendor ID or to anonymize it in advance (IP address), so that no personal data is processed by FireBase except for a temporary FireBase instance ID (FireBase token), which is stored in encrypted form:

  • We use Firebase Crashlytics to track app crashes as they occur and to prevent future ones. To do this, we ask for separate consent from you in the event of a crash, which you can also revoke
  • We use Firebase Remote Config to allow us to change the app on the devices it is installed on without having to completely reinstall the app through the respective app store.
  • We use FireBase Cloud Messaging as a service to securely and reliably send mobile notifications (so-called push notifications), which inform the user about a new event (e.g. a new question block, a new insight). The push messages do not contain any personal data or information about your health condition.
  • We use FireBase Analytics to collect general, aggregated data about app usage (e.g., adoption of new versions, active devices in different countries).

Firebase's privacy policy is available at and information about the specific data used in the aforementioned services can be found here:

The legal basis for the use of Firebase is our legitimate interest in keeping the MindDoc app permanently maintained and evaluating its performance according to Article 6 (1) p. 1 lit. f DSGVO.

4.3.2 Other categories of recipients of personal data

In addition to the providers mentioned above, we use third-party service and infrastructure providers within the following areas on the basis of commissioned processing pursuant to Article 28 GDPR, which are necessary for the development and provision of the mobile app and related services. All of them are processing the data within the European Union:

  • Hosting of the data and applications
  • Email dispatch
  • Customer support

The legal basis for the use of these third-party providers on basis is our legitimate interest in maintaining the MindDoc app permanently and evaluating its performance under Article 6 (1) p. 1 lit. f DSGVO.

4.4 Duration of data storage

The processing of data is necessary for the conclusion or fulfillment of the contract entered into with us for the use of the MindDoc app and in the case of the creation of the optional account. In addition, this is required when using the optional offer of the MindDoc online psychotherapy service (, which is independent of this. If you do not provide us with this data, we will not be able to provide the service. Likewise, there is no obligation to provide personal data. Likewise, the use of our app and related services is voluntary. However, if the required data is not provided, we may not be able to provide the services mentioned in section 2 of the GTC.

The data provided above will be stored by us for as long as is necessary for the use of our app and related services in the context of unaccompanied monitoring and self-management.

4.5 Data deletion

Regardless of the right to data deletion pursuant to Art. 17 GDPR (see also the rights of data subjects), the data can be deleted directly in the app in the "Settings → Data & Security" at any time. Before this, they can be transferred or backed up using an automatic export function. Alternatively, any user can write this request by e-mail from the address registered with us to or by naming the personal identification number (this is located in the profile area at the very bottom). We will then check this immediately and contact you.

Chapter 5
Rights of data subjects online-therapy

All subjects under this privacy policy are entitled to so-called data subject rights, i.e. rights which the persons concerned can exercise in individual cases. These rights can be asserted against the persons responsible. The rights are derived from the GDPR:

Right of access, Art. 15 GDPR

Right of access to personal data processed by us.

Right to rectification, Art. 16 GDPR

Immediate correction of incorrect personal data concerning the user;

Right to object to unreasonable data processing, Art. 21 GDPR

If we process data on the basis of a legitimate interest, you can object to this data processing at any time; this would also apply to profiling based on these provisions. We will then no longer process data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of our users, or the processing serves to assert, exercise or defend legal claims. The processing of user data for the purpose of direct advertising can be objected to at any time without giving reasons.

Right to erasure ('right to be forgotten'), Art. 17 GDPR

The deletion of personal data under the conditions specified in the article; This is the case in particular if they are no longer necessary for the purpose for which they were originally collected or processed.

Right to restriction of processing, Art. 18 GDPR

The restriction of the processing of personal data if certain reasons are given. This means that, although the data is not deleted, it is marked to restrict its further processing or use of the data.

Right to portability, Art. 20 GDPR

Users of the Services have, in principle, the right to receive the personal data concerning them that they have provided in a structured, commonly used and machine-readable format and to transmit this data to another controller without hindrance from us; likewise, the User has the right to demand that we transmit the personal data directly to another controller, insofar as this is technically feasible; insofar as the processing is based on consent or is based on a contract with us and the processing is carried out with the aid of automated processes.

Chapter 6
Other rights online-therapy

In addition to the above rights, all our users have other rights:

6.1. Refusal and revocation of consent

If the processing of data is based on consent given to us, then every user has the right to revoke this consent at any time. This declaration can be made informally, e.g. in writing, by e-mail or fax to the persons responsible. A statement of reasons is not required for this. However, the revocation is only valid from the time at which it is expressed. It has no retroactive effect. The processing of data up to this point remains lawful.

6.2. Right of appeal

Irrespective of the fact that our users are also free to seek judicial assistance, they have the right to lodge a complaint with a supervisory authority if they believe that the processing of their data is not permissible under data protection law. This results from Art. 77 GDPR. The complaint to the supervisory authority can be made informally.

Chapter 7
Safeguarding the legitimate interests of the responsible parties online-therapy

If one of the responsible parties is forced to seek legal or judicial assistance in order to enforce its own claims against a user itself or its health insurance company because an invoice that has been issued is not paid, the responsible parties must disclose (for the purposes of pursuing rights) the personal and treatment data necessary for this purpose.

Chapter 8
General notes on data security online-therapy

8.1. Technical safety precautions

We do not store any data on the end device of our users (neither mobile app nor web app) to ensure the greatest possible security and to enable smooth functioning. We store the personal data of our users processed in the web and mobile app as part of online psychotherapy or unaccompanied use of the app on servers of our IT service providers within the European Union, who process this data on our behalf and on the legal basis of Art. 28 GDPR and are obliged to comply with the legal provisions on data protection and data security. The data center we use is an ISO 27001, ISO 27017 and ISO 27018 certified hosting provider. The European ISO 27001 certification is consistent with the requirements of the German Federal Office for Information Security (BSI). The European ISO 27017 certification is an international standard for securing cloud services (cloud security), which is supplemented by ISO 27018, particularly with regard to the protection of personal data (cloud privacy). All communication between the user and the technical platform takes place exclusively on the basis of the latest encryption technology. Encryption is automatic and does not require any intervention by the user. One or more encryption mechanisms are used in the process. For example, all new data stored on non-volatile storage is encrypted in accordance with the AES-256 standard, with each encryption key in turn being encrypted with a set of master keys that are changed regularly. Access to the individual user profile and the data stored therein by the user is exclusively by means of an individual username-password combination known only to the user. Users determine their passwords themselves. Certain compulsory requirements are placed on the selected password, so that every password must achieve a minimum level of security. An algorithm checks how secure the password is when it is created and informs the user of this in real time. Forgotten passwords cannot be recovered, as they are stored exclusively in encrypted form on the server. Instead, a link is sent to the user by e-mail, with which he can assign himself a new password. We also take a variety of precautions to protect personal data and prevent misuse. All of our applications communicate with our servers over encrypted connections using TLS (Transport Layer Security) or HTTPS, which prevents third parties from unauthorized reading of data while it is being sent (i.e., "in transit"). Both servers and databases are located behind firewalls to prevent access to data during storage (i.e. "at-rest") and during processing (i.e. "in process"), respectively. In order to independently check system security, test attacks (penetration tests) are carried out at least once a year by an external IT security company on the servers provided and attempts are made to gain unauthorized access to them on a test basis.

8.2. Other notes and recommendations on data security

Even with the exhaustion of as many technical and organizational security precautions as possible, 100% security cannot be guaranteed, even by us - that is why we recommend that you as a user pay close attention to the following tips and implement them as far as possible:

Basic protection:

Check the settings of your device (smartphone, laptop, tablet) to see which security features are available and activate them (e.g., access restriction via fingerprint/face recognition, device discovery, two-factor authentication).

Keep your focus:

Use your smartphone only when you can fully concentrate on it and do not perform any parallel activities that require your attention (e.g. driving a car, crossing a street).

Control the view on your display:

Make sure that you only enter/read/change confidential content on your smartphone (e.g. entering personal data or information about your (mental) health) if you are sure that no one is watching you who is not supposed to.

Be careful with public and company networks:

Do not use insecure networks or public Wi-Fi hotspots without a password, or use apps that create a virtual private network (VPN). In internal company networks, access to certain content may be restricted or blocked, or activities may be recorded.

Secure access:

Make sure you enable an access restriction (e.g. passcode, fingerprint, facial recognition, password) for unlocking your device and for apps with sensitive content. Locking the screen with a pattern is usually easy to circumvent and therefore not secure.

Stay up to date:

Regularly install the latest updates for your operating system and apps, as the manufacturers often introduce new features and close security gaps.

Chapter 9
Changes to the privacy policy online-therapy

We reserve the right to change this privacy policy in compliance with data protection law. The current version can be found at this point or at another easily accessible point of our offers (e.g. web application of online psychotherapy, within mobile app). If users have any questions, suggestions or comments, they are welcome to contact the companies responsible for this data protection declaration or the data protection officer directly.

  • 01.07.2021: chapter 1: update name privacy officer
  • 25.02.2021: chapter 1: Name of privacy officer was added, chapter 4:Clearer and more concret description of legal basis
  • 01.02.2021: General revision and introduction of shared controller set-up and responsibilities for certain apps