Status: June 2026

‍

We want you to feel safe when participating in digital patient monitoring within myon.clinic GmbH (hereinafter referred to as "myon.clinic"). That is why the protection of your personal data is particularly important to us.

We process your personal data in accordance with the applicable legal provisions on the protection of personal data, in particular the EU General Data Protection Regulation ("GDPR") and the country-specific data protection laws that apply to us. In this privacy policy, you will learn why and how your personal data that we collect from you or that you provide to us when you decide to use the myon.clinic services and content are processed. In particular, you will find a description of the personal data that we collect and process, as well as the purpose and legal basis on which we process the personal data and the rights you have in relation to the processing of your personal data by us.

We at myon.clinic and our partners take the protection of your personal data very seriously. All personal data that you transmit to us or make available to us will be treated by us as strictly confidential and processed exclusively for a specific purpose in compliance with the statutory data protection regulations.

Please read the Privacy Policy below carefully to ensure that you understand each provision.

Please note that in order to use the telemonitoring services and digital patient monitoring, you must also conclude a separate contract for the use of the myoncare portal with Oncare GmbH, which manufactures the myoncare portal. With regard to the processing of your personal data in the context of the use of the myoncare portal, we refer to the privacy policy of Oncare GmbH. You can view them under the following link: https://www.myoncare.com/de/privacy-policy/.

As a service provider, you are a controller within the meaning of Art. 4 No. 7 GDPR when using digital patient monitoring for certain processing operations that affect personal data of your patients. This applies in particular if you commission third parties such as device manufacturers, distributors of medical devices or laboratory service providers as part of a treatment order to collectpatient-related data and make it available via the myoncare platform.

In this case, you are obliged to inform your patients about the method of data collection and the transfer of data to the commissioned technical service providers. If there is no treatment relationship, explicit consent of the patients is required in accordance with Art. 6 (1) (a), Art. 9 (2) (a) GDPR.

The involvement of such technical service providers is always based on a data processing agreement in accordance with Art. 28 GDPR between the controller (e.g. MVZ, clinic) and the respective third-party provider.

I.DEFINITIONS

"Personal data" means any information relating to an identified or identifiable natural person. In particular, this includes your name, birthday, address, telephone number, email address and IP address.

"Health data" means personal data relating to the physical ormental health of a natural person, including the provision of healthcareservices, which reveals information about his or her state of health.

"Anonymization/pseudonymization" data is considered "anonymous" if no personal connection to the person/user can be established. In contrast,"pseudonymised" data is data from which a personal reference or personally identifiable information is replaced by one or more identifiers or pseudonyms, but which can generally be re-identified by the identifier key.

"Digital patient monitoring" refers to the digital support of myon.clinic and its partners by querying health-relevant data and reading activity and vital data from connected wearables by means of the myoncare platform of the manufacturer Oncare GmbH (hereinafter referred to as "Oncare"). Oncare is a processor (subcontractor)within the meaning of the General Data Protection Regulation (GDPR) of myon.clinic. The data is automatically categorized and prioritized with the help of stored scores (specific clinical measures for assessing medical issues) or analyzed by you (healthcare professionals). Depending on the result, the user automatically or through you (health professionals) receives needs-basedcontent or measures.

"Provider" means you as a physician, clinic, healthcare facility or other healthcare professional acting alone or on behalf of you, the clinic or healthcare facility.

"Partner" includes all service providers and service providers within the healthcare sector who participate in the monitoring services.

"myoncare Portal" is Oncare's myoncare web portal, which is intended for professional use by portal users and serves as an interface between portal users and app users.

"myoncare PWA" is a website that looks and has the functionality of a mobile app. PWAs are built in such a way that they take advantage of the native functions of mobile devices without the user needing an app store. The goal of PWAs is to combine the difference between apps and the traditional web by bringing the benefits of native mobile apps into the browser. The PWA is based on the technology of "React Native for Web". "React Native for Web" is an open-source software for progressive web app applications. To use the myoncare PWA, patients need a computer or smartphone and an active internet connection. There is no need to download an app.

"Telemonitoring Services" include all services linked to digital patient monitoring that myon.clinic and its partners offer within the monitoring system in addition to the retrieval of health data.

II.CONTROLLER

myon.clinic GmbH
Balanstraße. 71a
81541 Munich

Data Protection Officer of myon.clinic GmbH

Dr. Sebastian Kraska
E-Mail: privacy@myon.clinic

III.CATEGORIES OF DATA AND PURPOSES AND LEGAL BASES OF PROCESSING

Within the framework of myon.clinic, we process the following categories of personal data from you:

●        E-mail address
●        Date of birth
●        Date of registration,
●        Your IP address,
●        pseudo-keys generated by the portal,
●        Lifelong Physician Number (LANR) and Establishment Number (BSNR)
●        Data required for the management of reimbursement, such as: Your contact details, patient's name, diagnosis, indications, treatment, treatment period.

We process this personal data for the following purposes:

Operational purposes:

If you are a contact person for the operation of the portal at your location/practice (e.g. IT administrator, appointed healthcare professional), you may provide us with certain personal data when you contact us to understand or discuss the features and use of the portal.

In the event of a service request, the following personal data can also be viewed by authorized myon.clinic employees:

Your personal data that you have provided to us for registration and/or login to our portal (e.g. name, date of birth, profile picture, contact details).

Authorized myon.clinic employees who may access your database for the purpose of processing a service request are contractually obligated to treat all personal data in the strictest confidence.

When processing operational data, myon.clinic acts as a data controller responsible for the lawful processing of your personal data.

We use the operational data to maintain the functionalities of the myoncare portal and to contact you directly if necessary or on your initiative (e.g. in the event of changes to terms of use, necessary support, technical problems, etc.). Furthermore, personal data (e-mail address) is processed within the framework of two-factor authentication every time you log in to the myoncare portal.

Justification of processing for operational purposes: The processing of operational data is justified on the basis of Art. 6 (1) (b)GDPR for the performance of the contract that you conclude with myon.clinic for the use of digital patient monitoring.

Purposes of reimbursement:

– Only applicable if you use myoncare tools for reimbursement –

The myoncare portal supports you in initiating your standard procedures for reimbursement of your healthcare services that are used by your patients via the myoncare app. In order to enable the reimbursement process, the myoncare portal supports the collection of your patients' personal(health) data from the myoncare portal in order to facilitate the transmission of this data to the patient's payer as part of the standard reimbursement processes (either your Association of Statutory Health Insurance Physicians and/or the patient's health insurance company).

For the purposes of reimbursement, we process the following types of personal data: patient's name, diagnosis, indications, treatment, treatment period, other data necessary for the management of reimbursement, such as: Your contact details, your lifelong doctor number (LANR) and your permanent establishment number (BSNR).

Processing of reimbursement data: myon.clinic, as the data controller, transmits the treatment data of your patient required for reimbursement to the payer (either your Association of Statutory Health Insurance Physicians and/or the patient's health insurance company), and the payer processes the reimbursement data in order to enable us to reimburse the patient.

Justification of the processing of the cost reimbursement data: The processing of the cost reimbursement data for billing with the cost bearer is carried out on the basis of §§ 295, 301 SGBV.

Creation of the doctor's letter: In addition to patient data, your personal data is also collected and stored in a structured manner on the myoncare platform and compiled in a doctor's letter for the creation of a doctor's letter. This doctor's letter requires a review by the doctor before it can be forwarded to the patient. For the preparation of the doctor's letter, the following personal data described above will be processed:

●        E-mail address
●        Date of birth
●        Date of registration,
●        Your IP address,
●        pseudo-keys generated by the portal,
●        Lifelong Physician Number (LANR) and Establishment Number (BSNR)
●        Data required for the management of reimbursement, such as: Your contact details, patient's name, diagnosis, indications, treatment, treatment period.

Justification of data processing for the preparation of the doctor's letter: The data processing for the preparation of the doctor's letter is justified on the basis of Art. 6 (1) (b)GDPR for the performance of the contract that you conclude with myon.clinic for the use of digital patient monitoring.

Commercial Store Data:

Commercial store data: Personal data that is processed in connection with the use of the myoncare store – in particular in connection with the authorship, configuration or purchase of digital treatment plans ("pathways"). The store is operated by myon.clinic GmbH, a subsidiary of Oncare GmbH. The use of the Store requires the processing of your name, professional contact details and, if applicable, payment data (only for paid content). Oncare GmbH processes this data exclusively for the technical provision of the platform functions and not for its own commercial purposes. Depending on the specific processing, the data protection responsibility for the personal data processed in the store lies with either myon.clinic GmbH or Oncare GmbH as joint controllers within the meaning of Art. 26 GDPR. For processing for billing or support purposes, myon.coach may be the data controller or processor in accordance with Art. 28 GDPR. The distribution of roles is regulated in an internal agreement.

Justification of the processing: The processing is carried out in accordance with Art. 6 (1) (b) GDPR for the performance of a contract (e.g. acquisition of digital content) and on the basis of Art. 6 (1)(f) GDPR for the technical provision of the store, whereby the legitimate interest lies in a secure and functional platform.

External data sources (e.g. device manufacturers, distributors of medical devices, laboratories)

To support medical care, external technical service providers such as medical device manufacturers, distributors of medical devices or laboratory service providers can collect patient-related data on behalf of the service provider and transmit it to the myoncare portal via interfaces. The processing of this data is carried out exclusively within the framework of defined medical treatment processes or – if no treatment relationship exists – on the basis of consent. Justification of the processing results from:

● Art. 6 para. 1 lit. b in conjunction with Art. 9 para. 2 lit. h GDPR (contract for medical care)
● or Art. 6 para. 1 lit. a, Art. 9 para. 2 lit. a GDPR (explicit consent of the patient)

IV. PROCESSING METHODS, PLACE OF DATA PROCESSING

Your personal data will also be processed in countries outside the European Union (EU) or the European Economic Area (EEA). This is only done to the extent necessary and in compliance with the legal requirements of the General Data Protection Regulation (GDPR). We transferpersonal data to the following third countries, subject to the consent of the contracting parties: Egypt. The recipient is a technical service provider engaged by us, who, within the framework of data processing on our behalf, provides support and maintenance services for our systems.

Legal basis for the transfer:
The transfer is based on standard contractual clauses concluded with the customer support service provider (in accordance with Art. 46 (2) (c) GDPR and your express consent in accordance with Art. 49 (1) (a) GDPR (if applicable).

In order to ensure compliance with the legal provisions of the GDPR, myon.clinic and its partners have taken appropriate technical and organisational measures. The data processing is carried out by means of computers or IT-based systems, following an organizational procedure and mode strictly aimed at the purposes indicated.

V. PROCESSING BY EQUIPMENT MANUFACTURERS, DISTRIBUTORS OF MEDICAL DEVICES AND LABORATORY SERVICE PROVIDERS

If you use additional medical functions such as integrated diagnostics, vital signs collection or laboratory services via the Platform, personal health data may be collected and processed by external third parties (e.g. medical device manufacturers, distributors of medical devices or laboratory service providers). This is done to support medical care and always on the basis of explicit consent or a treatment relationship.

The processing is carried out either within the framework of order processing or – depending on the provider – under its own responsibility under data protection law. Oncare GmbH only provides the technical connection for this purpose, without checking or medically evaluating content. Further information on the respective data processing can be obtained directly from the treating service provider or via the data protection information of the integrated third-party providers.

VI. COMMERCIAL STORE DATA AND PATHWAYMANAGEMENT

The myoncare portal offers registered service providers (e.g. doctors) the opportunity to offer and configure digital care pathways via a webshop functionality (e.g. in cooperation with myon.clinic) and to assign patients individually.

As part of the use of this functionality, personal data – in particular health data – is processed, such as information on indication, recommended duration of treatment or pathway assignment. This data processing serves the individualization and assignment of medical content and is carried out on the basis of Art. 6 (1) (b) and Art. 9 (2) (h) GDPR.

Oncare provides the technical infrastructure and processes the data concerned as a data controller within the meaning of Art. 4 No. 7 GDPR, insofar as the processing is necessary for the provision of the platform functions. However, the selection of content and medical design of the pathways is the sole responsibility of the respective service provider.

In so far as billing or data transmission is carried out to third parties (e.g. billing offices or platform partners such as myon.coach), such processing only takes place on the basis of corresponding agreements or legal regulations.

VII. AUTOMATED DECISIONS IN INDIVIDUAL CASES

We do not use purely automated processing to make decisions.

VIII. DISCLOSURE OF DATA

We will only pass on your personal data to third parties within the framework of the legal provisions or on the basis of your consent. In all other cases, the information will not be disclosed to third parties, unless we are obliged to do so due to mandatory legal regulations (disclosure to external bodies, including supervisory or law enforcement authorities).

In certain cases, service providers support myon.clinic in the fulfilment of its tasks. The necessary order processing agreements in accordance with Art. 28 GDPR have been concluded with all service providers who are data processors for personal data.

These service providers are:

● Oncare as the manufacturer of the myoncare technology along with the myoncare app.
● Billing Service Providers.

IX. LEGAL MEASURES

In the event of misuse, the user's personal data may be used for legal purposes in legal proceedings or in the event of complaints.

You are also aware that myon.clinic and its partners may be required by competent authorities to hand over personal data.

X. DELETION OR BLOCKING AND STORAGE OF DATA

myon.clinic and its partners adhere to the principles of data minimization. myon.clinic therefore only stores personal data for as long as is necessary to provide the services and achieve the purposes specified here, or to comply with statutory retention periods (e.g. §257 HGB or § 147 AO), unless further storage is necessary in the individual case for the assertion, exercise or defense of legal claims or another legal basis (e.g. consent) justifies further processing.  

XI. OBLIGATION TO PROVIDE PERSONAL DATA

Various personal data are necessary for the establishment, implementation and termination of the contractual relationship with myon.clinic and the fulfilment of the associated contractual and legal obligations. We have summarized the details for you under the point above. In certain cases, personal data must also be collected or made available in accordance with the legal provisions. Please note that without providing this personal data, it is not possible to process your request or fulfil the underlying contractual obligation.

XII. RIGHTS OF DATA SUBJECTS

We would like to inform you about your rights as a data subject. These rights include, in particular:

● Right of access (Art. 15 GDPR):  You have the right to request information about whether and how your personal data is being processed, including information about the purposes of processing, recipients, storage period and your rights to rectification, erasure and objection. You also have the right to receive a copy of any personal data we hold about you.

● Right to rectification (Art. 16 EU GDPR): You can request that we update or correct inaccurate personal data or complete incomplete personal data.

● Right to erasure / right to be forgotten (Art. 17 GDPR): You can demand that we delete your personal data collected and processed by us without undue delay. Please note, however, that we can only delete your personal data after the expiry of the statutory retention periods.

● Right to restriction of data processing (Art. 18 GDPR): You can ask us to "restrict" the use of your data if the accuracy of the data is contested, the processing is unlawful, the data is needed for legal claims, or an objection to the processing is being examined, so that we can only continue to use your data with restrictions.

● Right to data portability (Art. 20 GDPR): In general, you can request that we provide you with personal data that you have provided to us and that is processed by machine based on your consent or the performance of a contract with you, in amachine-readable form, so that it can be "ported" to a substitute service provider.

● Right to object to data processing (Art. 21 GDPR): You have the right to object at anytime to the processing of personal data concerning you that is carried out on the basis of Article 6 (1) (e) or (f) GDPR. In this case, the controller will no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves to establish, exercise or defend legal claims.

If you have given your consent to the processing of your personal data, you can revoke it at any time with effect for the future. The lawfulness of the data processing operations that have already taken place remains unaffected by the revocation.

● Right to lodge a complaint (Art. 77 GDPR): In addition, you have the option of contacting a data protection supervisory authority with a complaint.

To exercise these rights, please contact us at: privacy@myon.clinic. Objection and revocation of consent must be declared intext form to privacy@myon.clinic. We will require you to provide sufficient proof of your identity to ensure that your rights are protected and that your personal data will only be disclosed to you and not to third parties.  

XIII. SUPPLEMENT FOR US USERS – HIPAA COMPLIANCE

For providers and healthcare professionals located in the United States or delivering services within the US healthcare system, the processing of patient data through the myoncare platform is also governed by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). In this context, myon.clinic may act as your “Business Associate” when processing Protected Health Information (“PHI”) on your behalf.

As a Business Associate, myon.clinic is contractually and legally obligated to:

• Use and disclose PHI only as permitted by our Business Associate Agreement (BAA) and as required by law;
• Implement appropriate administrative, physical, and technical safeguards to protect PHI from unauthorized access, use, or disclosure;
• Ensure that any subcontractors, including Oncare GmbH as the technology provider of the myoncare platform, agree in writing to safeguard PHI in compliance with HIPAA;
• Report to you any security incident or unauthorized disclosure of PHI of which we become aware;
• Make PHI available to you to enable you to meet your obligations towards patients under HIPAA (e.g., requests for access, amendment, or accounting of disclosures);
• Cooperate with you in the event of an audit or investigation by the U.S. Department of Health and Human Services (HHS).

These HIPAA obligations apply in addition to our commitments under the GDPR and other applicable data protection laws. Providers using myon.clinic in the US remain the Covered Entity under HIPAA, and myon.clinic supports you in fulfilling your HIPAA responsibilities.

XIV. CHANGES TO THE PRIVACY POLICY

We expressly reserve the right to change this Privacy Policy in the future at our sole discretion. Changes or additions maybe necessary, for example, to meet legal requirements, to comply with technical and economic developments, or to meet the interests of myon.clinic service users.

Status: June 2026

‍

MYON.CLINIC – DATA PRIVACY POLICY FOR PATIENTS / USERS

I. THE BEST POSSIBLE PROTECTION OF YOUR DATA AT myon.clinic

We want you to feel secure when using the services and content of myon.clinic GmbH. The protection of your personal data is of particular importance to us.

We process your personal data in accordance with the applicable statutory provisions, in particular the EU General Data Protection Regulation (“GDPR”) and the country-specific data protection laws applicable to us. We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR).

In this Privacy Notice, you will learn why and how we process personal data — including health data — when you use myon.clinic Services. In particular, you will find information on:

• data categories,
• purposes of processing,
• legal bases,
• recipients,
• storage duration,
• your rights as a data subject.

All personal data that you transmit to us or make accessible to us will be treated confidentially by us and processed exclusively for specified purposes in compliance with the statutory requirements. Please read this Privacy Notice carefully.

Important notice regarding platform technology (myoncare App / PWA / platform): ONCARE GmbH processes personal data as a processor pursuant to Art. 28 GDPR for the technical provision of the platform and, where applicable, as an independent controller for IT security and platform operations. An overview of the processing activities can be found in Section X. In addition, the Privacy Notice of ONCARE GmbH applies to data processing by ONCARE in the context of the use of this technical platform. You can find it here: https://www.myoncare.com/de/privacy-policy/

II. CONTACT DETAILS OF THE CONTROLLER

myon clinic GmbH
Balanstr. 71a, 81541 Munich
Tel.: +49 89 444 51156
Email: info@myon.clinic

Data Protection Officer:
Dr. Sebastian Kraska
Email: privacy@myon.clinic

The competent data protection supervisory authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

III. DEFINITIONS

“Digital Patient Monitoring” means digital support within myon.clinic Services by means of the collection of health-related data and — if activated by the user — the retrieval of activity data, vital data, and measurement data from wearables, medical devices, or connected laboratories via the myoncare platform. The use of myon.clinic Services may take place both in the context of medical treatment and independently thereof (e.g., for self-observation or information purposes)

“Service Provider” means physicians, clinics, medical care centers (MVZs), or other medical institutions or members of the healthcare professions, as well as — where applicable — providers of health, prevention, counseling, or care services that provide or offer services via the platform.

“Partner” includes medical Service Providers as well as technical service providers (e.g., device manufacturers, distributors of medical devices, laboratories), insofar as these provide supporting services on behalf of a Service Provider or on behalf of myon.clinic.

“myoncare App” is the mobile application of ONCARE GmbH for use by users (e.g., patients or participants in prevention or Self-Care programs). Insofar as the term “patient” is used in this Privacy Notice, it shall always mean the user of the myoncare App or PWA.

“myoncare PWA” is a web-based application (Progressive Web App) with app-like functionality.

“Mobile” is the product name for the myoncare App and the PWA.

“myoncare platform” is the web portal for professional use by Service Providers as an interface between the Service Provider and the user.

“Telemonitoring Services” are supportive services linked to Digital Patient Monitoring (e.g., reminders, structured queries, educational content, status reports) that do not constitute independent medical treatment and do not replace diagnostic or therapeutic decisions.

“Caretask” means a task (e.g., questionnaire, request for measurement, information/education in text/image/video/audio form).

“Pathway” means a chronological sequence of Caretasks. Pathways may be structured on the basis of medical guidelines, but within myon.clinic — unless expressly used by a Service Provider as part of a treatment — they serve, in particular, structured support, information, and self-observation and do not replace a medical diagnosis or treatment decision.

“Case Report/Report” means a document generated by myon.clinic (e.g., a PDF report) on the basis of the entries and measured values available in the system. Reports do not constitute a medical evaluation, diagnosis, or treatment recommendation. They serve exclusively for the structured presentation of the data entered or measured by the user.

“myon.prevent” is a site within myon.clinic that may optionally be joined and that can make suggestions for preventive health measures on the basis of voluntarily provided health data. It is an optional Self-Care offering without medical treatment that serves exclusively prevention, information, structuring, and self-observation.

IV. ROLES AND RESPONSIBILITIES

Data protection responsibility depends on the usage constellation in which you use myon.clinic Services and on the function assumed by the respective parties involved.

1) Self-initiated use (“Self-Care”) – voluntary enrollment in myon.prevent

myon.prevent is a personalized Self-Care Service by myon.clinic for the provision of preventive offerings, structured programs, reminders, self-observation, and personalized prevention and health recommendations on the basis of the information you voluntarily provide.

Legal basis:
Art. 6(1)(b) GDPR (contract for the use of the Services, insofar as necessary for the provision of myon.prevent)

For health data: Insofar as health data are processed, this takes place exclusively on the basis of your explicit consent pursuant to Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR, unless a statutory legal basis under Art. 9(2)(h) GDPR applies.

For the use of myon.prevent, it is necessary that you expressly consent to the processing of the health data voluntarily provided by you for the purpose of creating and providing personalized preventive offerings, programs, and recommendations. Without this consent, myon.prevent cannot be offered by myon.clinic.

This concerns exclusively the health data voluntarily provided by you, in particular data from the Medical Profile (medical history data), laboratory data, and wearable data. There is no obligation to provide such data. However, if you decide to use myon.prevent, the provision of such data as well as your consent to their processing are prerequisites for the use of the Service.

The use of myon.prevent does not constitute medical treatment and does not replace a medical diagnosis or therapy.

You may withdraw your consent at any time with effect for the future. The withdrawal shall not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal. In the event of withdrawal, myon.prevent can no longer be used from the time of receipt of the withdrawal onward. Unless statutory retention obligations preclude deletion, the health data processed for myon.prevent will be deleted after termination of the Service.

In this constellation, myon.clinic is an independent controller within the meaning of Art. 4 No. 7 GDPR. Health data are processed only on the basis of the respectively applicable data protection legal bases.

2) Use upon recommendation or referral by a Service Provider

A Service Provider may recommend the use of myon.clinic Services to you or invite you to participate in digital support offerings. Data protection responsibility as well as the nature of the services depend on the form in which the use takes place.

a) Use upon recommendation of a Service Provider (without integration into that Service Provider’s treatment)

If you use the Services upon recommendation of a Service Provider, without such Services constituting part of the medical treatment by that Service Provider, the use is initiated by you on your own initiative. In this case, there is no joint controllership and no processor relationship between myon.clinic and the recommending Service Provider.

The services serve exclusively information, structured support, prevention, and self-observation and do not constitute medical treatment.

In this constellation, myon.clinic is an independent controller within the meaning of Art. 4 No. 7 GDPR. Health data are processed only on the basis of your explicit consent pursuant to Art. 6(1)(a) and Art. 9(2)(a) GDPR.

Information, documentation, or reports are transmitted to the recommending Service Provider only if you expressly request this or have consented thereto. Without such consent, no data will be transmitted to the recommending Service Provider.

b) Use in the context of medical treatment by a Service Provider

Insofar as the use of myon.clinic Services forms part of medical treatment by a Service Provider, data processing is carried out, depending on the contractual arrangement, either

• by myon.clinic as a processor pursuant to Art. 28 GDPR on behalf of the Service Provider; or
• by myon.clinic as an independent controller for its own supportive Services.

In all cases, medical responsibility remains with the treating Service Provider.

Status information, documentation, or reports are transmitted only to Service Providers specifically selected by you or connected by your active action, and exclusively for the respective care requested by you.

c) Digital support by cooperating or contractually bound Service Providers
Insofar as services are provided by qualified Service Providers cooperating with myon.clinic or contractually bound to myon.clinic, an independent care relationship is established between you and the respective Service Provider.

In this case, the processing of health data takes place for the provision of healthcare pursuant to Art. 9(2)(h) GDPR as well as the respectively applicable professional law and social law provisions by the respective service provider as the data controller within the meaning of Art. 4 No. 7 GDPR. Medical responsibility lies exclusively with the respective Service Provider.

3) Technical platform provision by ONCARE GmbH

ONCARE GmbH provides the technical platform (myoncare App/ /PWA Plattform) and processes data, depending on the constellation, as a processor pursuant to Art. 28 GDPR for the respective controller or, insofar as ONCARE decides on certain processing activities for its own purposes, as an independent controller, in particular for platform and operational data such as IT security, system stability, technical administration, and abuse prevention. ONCARE processes health data or content data for its own purposes only insofar as this is legally permissible, legally required, or expressly agreed.

No joint controllership:
Unless expressly described otherwise in this Privacy Notice or contractually agreed otherwise, there is no joint controllership pursuant to Art. 26 GDPR between myon.clinic and ONCARE or between myon.clinic and Service Providers.

The specific data protection responsibility depends in each case on the specific usage situation and the underlying contractual relationships between the parties involved. The specific allocation of roles is determined by the respective underlying contractual arrangements between the parties involved (e.g., data processing agreement pursuant to Art. 28 GDPR or independent controllership). Users will be informed thereof within the respective usage situation.

V. WHAT ARE PERSONAL DATA AND HEALTH DATA?

Personal data means any information relating to an identified or identifiable person (e.g., name, contact details, IP address).
Health data means personal data relating to the physical or mental health status of a person, or from which information about that person’s health status can be derived (Art. 9 GDPR).

VI. WHAT DATA DO WE PROCESS?

1) Basic / Account Data (depending on the type of use)

• Name
• Address
• Date of birth
• Gender
• Telephone number
• Insurance type and insurance number
• Email address
• IP address
• Registration / usage timestamps
• User ID / technical identifier (pseudonymized)

Pseudonymized identifiers may be attributed to a person where additional information is available.

2) Data that you voluntarily provide (in particular health data)

• Symptoms, information regarding health status
• Shared files (if uploaded, such as photos or documents)
• Information on medications
• Responses to questionnaires / scales
• Further health-related content that you enter yourself

Documents and image files:

‍Users may upload documents or images via the platform (e.g., laboratory reports, physicians’ letters, or medical findings). To the extent technically required, such documents may be automatically analyzed or structurally extracted (e.g., by means of OCR technologies) in order to display content more easily within the platform or to make such content usable for Caretasks, Reports, or Pathways.

3) Activity / Vital Data (only upon activation / consent)

• e.g., weight, height, steps, sleep, pulse, blood pressure
• Data from connected services (e.g., Apple Health, Google Fit) or devices

4) Billing / Reimbursement Data (only where relevant)

• e.g., payer information, where applicable data required for reimbursement under social law requirements (only where applicable)

5) Store / Contract and Payment Data (in the event of purchase)

• Contract data (purchased content, terms, invoices)
• Payment data (e.g., payment status, transaction data)

6) Communication and Support Data

• Content of support requests, technical log data
• where applicable documentation of consents (consent logs)
• Device information (e.g., operating system version) and app error logs, to the extent required for
• support / security
• Device / app metadata

Access to personal data takes place exclusively by authorized persons and only to the extent necessary for the performance of the respective tasks.

VII. PURPOSES AND LEGAL BASES OF THE PROCESSING

We process personal data only where a legal basis exists. For health data, Art. 9 GDPR additionally applies.

1) Operational of the Service, registration, support, security (Processed by ONCARE)

Purpose:
Account creation, login, user administration, technical provision of the Services, support, abuse prevention, IT security, and ensuring system stability.

Legal basis:

Art. 6(1)(b) GDPR (contract / pre-contractual measures)

Art. 6(1)(f) GDPR (legitimate interest in secure operation). Our legitimate interest lies in particular in ensuring IT security, abuse prevention, and the stability of the platform. Your interests are safeguarded by appropriate protective measures (e.g., pseudonymization and access restrictions).

To the extent health data are concerned, processing by ONCARE takes place only where an appropriate legal basis under Art. 9(2) GDPR applies, in particular:

• your explicit consent (Art. 9(2)(a) GDPR), or
• in the medical context, processing for the provision of health care (Art. 9(2)(h) GDPR).

2) Self-initiated use (Self-Care) – voluntary provision of health data

Purposes of the processing
Within the optional Self-Care offering myon.prevent, myon.clinic processes personal data and health data voluntarily provided by you for the purpose of providing the Service, conducting structured preventive offerings and programs, providing reminders and content for self-observation, and creating personalized preventive and health recommendations.

Legal bases of the processing
The processing of personal data takes place, to the extent necessary for the provision of myon.prevent, on the basis of Art. 6(1)(b) GDPR.
The processing of health data takes place on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Art. 9(2)(a) GDPR.

3) Purchase and use of Pathways in the myon.clinic Store

Purpose:
Performance of the contract, provision of digital content, billing, customer service, abuse prevention.

Legal basis:
Art. 6(1)(b) GDPR (performance of a contract)

To the extent health data are processed in the context of use, such processing takes place exclusively on the basis of your explicit consent pursuant to Art. 6(1)(a) and Art. 9(2)(a) GDPR.

4) Use upon recommendation / referral by a Service Provider (digital support / monitoring)

Purpose:
Support of a treatment or care process through digital support, monitoring, structured queries, reminders, and the creation of status information or Reports.

Legal basis (depending on the constellation):

a) In the context of medical treatment

myon.clinic acts as a processor pursuant to Art. 28 GDPR on behalf of the Service Provider.

The legal basis for the processing of health data lies with the respective Service Provider, in particular:

Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(h) GDPR.

b) Outside a care relationship

If the use does not form part of medical treatment, processing takes place on the basis of your explicit consent:

Art. 6(1)(a) and Art. 9(2)(a) GDPR.

5) Transmission of status information / Reports to your Service Provider

Purpose:
Support of medical care by means of progress reports or status information.

Transmission does not take place automatically, but only:

• if it is necessary for treatment, or
• if you have explicitly consented thereto.

Legal basis: Within the treatment relationship with the Service Provider: Art. 6(1)(b) GDPR in conjunction with Art. 9(2)(h) GDPR.Outside such a relationship: consent pursuant to Art. 6(1)(a) and Art. 9(2)(a) GDPR.

Transmission to merely recommending Service Providers without an existing care relationship takes place exclusively with your explicit consent.

6) Connection of wearables, health apps, devices, and laboratories (optional)

Purpose:
Import and display of activity, vital, and measurement data for structured support.

Legal basis:
Your consent pursuant to Art. 6(1)(a) and Art. 9(2)(a) GDPR.

The connection of such services takes place exclusively on the initiative of the user. The user’s consents may be withdrawn at any time, and connected services may be deactivated at any time.

We receive data (i) directly from you (entries / uploads), (ii) from connected sources activated by you (e.g., Apple Health / Google Fit / wearables / laboratories, to the extent technically connected), and (iii) — insofar as you are integrated into treatment / care — where applicable from the treating Service Provider or its systems, to the extent this is provided for in the respective usage constellation.

The connection of such services takes place exclusively on the initiative of the user and may be deactivated at any time.

7) Billing / reimbursement (only where applicable)

Purpose:
Support of statutory or contractual billing processes.

Legal basis:
Art. 6(1)(c) GDPR (legal obligation)
Art. 9(2)(h) GDPR (health care)

8) Quality control, product safety, regulatory obligations

Purpose:
Quality assurance, IT security, documentation, and fulfillment of regulatory requirements (e.g., MDR obligations and obligations to record and report adverse events).

Legal basis:
Art. 6(1)(c) GDPR
where applicable Art. 9(2)(i) GDPR or Art. 9(2)(h) GDPR

• ‍ONCARE GmbH as technical platform provider (processor pursuant to Art. 28 GDPR, depending on constellation)Service providers
• Service providers (referring or treating), if you were referred or consented to transmission‍
• Billing service providers, if applicable
• Technical service providers (hosting, support, security services) as processors pursuant to Art. 28 GDPR. A current list of our main processors (e.g. hosting, support, e-mail dispatch, payment processing, security services) is provided upon request.
• Authorities/courts, if we are legally obliged
• Further service providers or organizations with whom you enter into treatment or care via the platform or to whom you expressly grant access to your data via the platform

9) Research / analytics (only in anonymized form or at an aggregated level)

For research and analytics purposes, myon.clinic uses exclusively anonymized data or evaluations at an aggregated level, provided and to the extent that no conclusions can thereby be drawn as to identified or identifiable persons. To the extent that personal data are anonymized, such anonymization shall take place only on the basis of the respectively applicable data protection legal bases and by applying appropriate technical and organizational measures.

10) Personalized suggestions / recommendations (optional)

Purpose:
Provision of individually tailored content and programs.

Legal basis:
Your explicit consent pursuant to Art. 6(1)(a) and Art. 9(2)(a) GDPR.

This may constitute profiling within the meaning of Art. 4 No. 4 GDPR. No solely automated decision-making producing legal effects within the meaning of Art. 22 GDPR takes place. Automated evaluations are based on rule-based algorithms (e.g., thresholds, comparative values, or standardized questionnaires) and serve exclusively to generate recommendations.

VIII. PROCESSING METHODS, LOCATION OF DATA PROCESSING, TRANSFERS TO THIRD COUNTRIES

Processing generally takes place within the EU/EEA.

If services are provided via a US service provider or a HIPAA-relevant constellation exists, storage in the USA may take place. In these cases suitable safeguards pursuant to Art. 44 et seq. GDPR are implemented (e.g. EU standard contractual clauses or — if applicable — EU-US Data Privacy Framework).

Use of Google Firebase (via ONCARE GmbH)

ONCARE uses Google Firebase (Google Ireland Limited) for certain technical functions. Google Firebase is used to ensure technical stability and for notifications. In this context, technical usage data may be processed. Processing generally takes place on servers in the EU/EEA; access from the USA cannot be excluded in exceptional cases (support/maintenance). If required, this takes place on the basis of suitable safeguards (e.g., standard contractual clauses) and technical measures (e.g., pseudonymization/encryption).

Access to US-hosted data from the EU/EEA

Access to data stored in the USA from Europe may take place exclusively for support purposes:

by authorized employees of ONCARE GmbH (second-level support),
by authorized employees of myon.clinic GmbH (first-level support),
each only to the extent necessary and under technical and organizational safeguards.

If a transfer to third countries takes place, you may request a copy of the suitable safeguards (e.g. standard contractual clauses) using the contact details stated in Section II.

IX. AUTOMATED DECISIONS / PROFILING

No solely automated decision-making producing legal effects or similarly significant adverse effects within the meaning of Art. 22 GDPR takes place.

To the extent that automated evaluations, categorizations, or risk assessments (e.g., on the basis of questionnaire data or measurement values) are carried out within the myon.clinic Services, these serve exclusively for the purposes of information, support, and the structured presentation of data.

Personalized suggestions or recommendations based on voluntarily provided data are made exclusively on the basis of your consent.

A medical evaluation, diagnosis, or treatment decision is made exclusively by a qualified Service Provider and not automatically by the system. Automated evaluations (e.g., structured risk scores, evaluations of questionnaire data, or vital parameters) serve exclusively to support, structure, and prioritize information and do not constitute an independent medical evaluation or diagnosis.

X. DISCLOSURE OF DATA / RECIPIENTS

• if this is necessary for performance of contract,
• if you have consented,
• if a legal obligation exists,
• or if this is necessary for assertion/defense of legal claims.

We disclose personal data only if a legal basis exists, in particular:

Possible recipients:

Disclosure takes place exclusively to the necessary extent and only on the basis of a corresponding legal basis (in particular consent or medical treatment relationship).

We conclude the required contracts pursuant to Art. 28 GDPR with processors.

XI. LEGAL MEASURES

In case of misuse, personal data may be processed for assertion or defense of legal claims (Art. 6 para. 1 lit. f GDPR). Disclosure to authorities may also take place insofar as we are legally obliged.

XII. STORAGE PERIOD / DELETION

We store personal data only as long as necessary for the purposes stated in this privacy policy or statutory retention periods exist. After cessation of the respective purpose and expiry of statutory periods, the data are deleted or their processing restricted.

In the medical context, service providers may be subject to their own statutory documentation and retention obligations. Depending on the type of records, these periods may range from several years to several decades. myon.clinic generally has no influence on such data; deletion requests may therefore have to be addressed directly to the respective service provider.

For contract, billing and store-related data, commercial and tax retention obligations apply (in particular under HGB and AO).

For technical reasons, data may remain stored in backup copies for a limited period after deletion; such backups are stored separately for technical purposes and are accessible only for administrative purposes. During this period, no active processing takes place, and the data are finally deleted after expiry of the technical retention cycles.

• ‍Right of access (Art. 15 GDPR): You have the right to request information as to whether and how your personal data are being processed, including information about the purposes of the processing, recipients, storage periods, and your rights to rectification, erasure, and objection. You also have the right to obtain a copy of all personal data that we have stored about you.Right to rectification (Art. 16 GDPR):
• Right to rectification (Art. 16 GDPR): You may require us to update or correct inaccurate personal data or to complete incomplete personal data;Right to erasure / right to be forgotten (Art. 17 GDPR):
• Right to erasure / right to be forgotten (Art. 17 GDPR): You may require us to erase without undue delay the personal data collected and processed by us. Please note, however, that we may only erase your personal data after the expiry of applicable statutory retention periods.Right to restriction of processing (Art. 18 GDPR):
• Right to restriction of processing (Art. 18 GDPR): You may require us to “restrict” the use of your data where the accuracy of the data is contested, the processing is unlawful, the data are required for legal claims, or an objection to the processing is being examined, with the result that we may only continue to use your data subject to restrictions;Right to data portability (Art. 20 GDPR):
• Right to data portability (Art. 20 GDPR): In general, you may require us to provide you, in a machine-readable format, with personal data that you have provided to us and that are processed by automated means on the basis of your consent or for the performance of a contract with you, so that such data may be “ported” to a replacement service provider;Right to object to data processing (Art. 21 GDPR):
• Right to object to data processing (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you where such processing is carried out on the basis of Article 6(1)(e) or (f) GDPR. In such case, the controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims.

XIII. OBLIGATION TO PROVIDE DATA

The retention period and the necessity to provide data are determined on the basis of the following criteria: the duration of the usage agreement, statutory retention obligations, the necessity for IT security, and limitation periods for potential legal claims.

The provision of certain personal data is required for the registration for and use of the myon.clinic Services. Without such data, the conclusion of a contract and/or the use of individual functions may be impossible in whole or in part. The provision of health data is, as a rule, voluntary; however, insofar as health data are strictly required for the function selected by you, their processing is only permissible on the basis of consent. Without such consent, the respective function cannot be used.

XIV. YOUR RIGHTS (DATA SUBJECT RIGHTS)

We would like to inform you about your rights as a data subject. These rights include, in particular:

If you have given consent for the processing of your personal data, you may withdraw this consent at any time with effect for the future. The lawfulness of any data processing carried out prior to the withdrawal remains unaffected.

Responsibility for the exercise of your rights: For the processing of your treatment and health data, your Service Provider is the data protection controller. Please address corresponding requests generally to your Service Provider. myon.clinic typically processes such data as a processor and supports the Service Provider in fulfilling your rights within the scope of the data processing agreement. Insofar as myon.clinic processes personal data under its own responsibility (e.g., for purposes of IT security or product safety), you may exercise your rights by contacting privacy@myon.clinic .

Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by us. The supervisory authority competent for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de).

Proof of identity:  In order to process your request, suitable proof of identity may be required to ensure that personal data are not disclosed to unauthorized third parties.

XV. AGE RESTRICTION

Use of myon.clinic Services is generally intended from the age of 18. For users under 18 years, consent of the legal guardian is required insofar as consent is the legal basis of processing. Where appropriate, we reserve the right to request proof of the legal guardian’s consent.

XVI. SUPPLEMENT FOR US USERS — HIPAA

Insofar as services are provided within the US healthcare system, processing of Protected Health Information (PHI) takes place in accordance with the requirements of the Health Insurance Portability and Accountability Act (HIPAA). In these cases the respective US healthcare institution generally acts as “Covered Entity”. Insofar as services are provided via myoncare Inc., it acts as “Business Associate” on the basis of corresponding agreements. myon.clinic GmbH assumes no independent responsibility under HIPAA in these cases unless expressly contractually agreed.

XVII. DIGITAL PLATFORM AND DIRECT OFFERS (CLARIFICATION)

myon.clinic provides a digital platform through which users can use structured programs, supportive monitoring services as well as further medical and non-medical content and — optionally via the myon.clinic Store — purchase digital programs, either on their own initiative or upon recommendation or referral by a service provider.

The services serve information, structured support and organization of health-related data. They do not replace individual medical advice, diagnosis or treatment.

If use takes place within medical treatment, medical responsibility remains with the respective service provider.

myon.clinic itself does not provide independent medical treatment unless expressly provided by qualified cooperating service providers.

Use may take place, depending on the offer, independently of a treatment relationship or within medical care by a service provider. Data protection responsibility depends on the respective usage constellation.

XVIII. CHANGES TO THIS PRIVACY POLICY

We reserve the right to adapt this privacy policy if necessary for legal, technical or organizational reasons. The current version will be provided to you in an appropriate form.

‍

***