DocCheck Community GmbH, Vogelsanger Strasse 66, D-50823 Cologne ("DocCheck") collects personal data as part of its business activities
which are necessary for the use of the services and information offered by DocCheck ("Services") or for the processing of which we are otherwise entitled or obligated. The protection of these data is ensured in compliance with the data protection regulations, in particular the EU General Data Protection Regulation (GDPR). You give your consent to the collection, storage and use of your personal information for the purposes set forth in this statement. If a form of data collection or processing is not covered by this privacy policy, we will ask for a separate consent. You can view and change the data you provide in your user account. Any consent given by you may be withdrawn at any time with effect for the future.
1. Name and address of the responsible legal entity
Responsible in terms of the General Data Protection Regulation (GDPR), and other regulations and laws with data protection character is:
DocCheck Community GmbH
Vogelsanger Str. 66
50823 Cologne
Germany
Tel .: 0221-920530
E-mail: info(at)doccheck.com
The legal representative of DocCheck Community GmbH are the managing directors: Dr. Frank Antwerpes and Julia Kroll.
2. Name and address of the data protection officer
The data protection officer of DocCheck Community GmbH is:
Tim Halver
DocCheck AG
Vogelsanger Str. 66
50823 Cologne
Germany
Tel .: 0221-920530
E-mail: datenschutz(at)doccheck.com
For any questions about privacy, you can contact our data protection officer directly.
3. Collection of your data
As part of your registration for DocCheck and during your membership with DocCheck, as well as in the context of market research studies in which you participate, personal data is collected or updated. This data is collected in two ways
Regardless of the type of collection, DocCheck follows the principle of data economy. We only collect data that is necessary or beneficial for our business mission, for an optimal user experience ("User experience") or for the fulfillment of the research purpose.
3.1 Data that you provide
3.1.1 Basic personal data
When registering, we will collect the personal information we need to set up your DocCheck account and provide our services. These are first name, surname, profession, area of expertise, area of activity, additional names, postal code, street, residence, e-mail address and a self-chosen password. This data is assigned to an individual user ID, which is provided by DocCheck. Your password will be saved via a one-way hash function. This means it cannot be recovered or read by anyone, including DocCheck. This data processing is based on Art. 6 para. 1 letter b) GDPR.
You can also use DocCheck without signing up in read-only mode, but you will not have a user profile, cannot post or upload files to DocCheck, and will not receive personalized information.
3.1.2 Proof of medical qualification
In addition, we ask you to upload a proof of your medical qualification. If you provide a proof of your affiliation to a medical profession to DocCheck, it will be stored with link to your user profile. Without your basic personal data and professional credentials, DocCheck cannot review your affiliation with the medical community and cannot grant access to information and services that are restricted under the EU-Directive 2001/83/EC or due to ethical reasons. You can use DocCheck without professional credentials, but you will have limited access to some services. The above-mentioned data processing is necessary to extend the functionality of your DocCheck account and is based on Art. 6 para. 1 letter b) GDPR as well as to comply with the legal obligation and therefore Art. 6 para. 1 letter c) GDPR.
3.1.3 Photograph
If you want, you can upload a photo to your profile on DocCheck. This photo will be publicly displayed in your profile. The data processing is based on your consent given by uploading your profile picture in accordance with Art. 6 para. 1 letter a) GDPR and Art. 9 para. 2 letter a) GDPR.
3.1.4 Extended personal data
As part of your usage of DocCheck, we kindly ask you from time to time to provide further information after you finished your registration, e.g. which professional interests you have, if and how you would like to be contacted by e-mail or if you would like to participate in market research studies. This extended personal data will be added to your user profile "non-publicly". You may delete, amend, publish or update this data at any time for the future, depending on how much information you want to share with DocCheck and other DocCheck users. The processing of data is based on your personal consent in accordance with Art. 6 para. 1 letter a) of the GDPR.
3.1.5 Ratings, Posts and Files
When using DocCheck, you can post reviews, write posts (e.g. comments, blogs, case reports, Flexikon articles) and upload various files (such as pictures, lectures, scripts, videos). These reviews, posts, and files are linked to your user profile. By saving your posts and/or uploading files, you agree to publish this information under your chosen authorship and privacy preference. In addition, your publications will appear under "activities" in your user profile and elsewhere on the DocCheck website. The data processing is based on your consent by using the respective functions according to Art. 6 para. 1 letter a) GDPR. As part of the provision of our services requested by you, the data processing is also necessary for the execution of the contract and is based in this respect on Art. 6 para. 1 letter b) GDPR. Since DocCheck can neither verify the nature nor the content of the files during the upload process, you have to ensure that the posts or files contain no personal information that violates your rights or the rights of third parties.
3.1.6 Communication data
We store the information, if you want to receive e-mails from DocCheck and what kind of e-mails you want to receive (see also point 3.1.4). When you communicate with DocCheck via e-mail or chat or use the DocCheck platform to communicate with other users ("inMail"), we store the content of the communication and any information you choose to provide. Without the storage of this communication data, DocCheck cannot perform its customer service and you cannot use the DocCheck platform to exchange messages with other users. The data processing takes place in order to provide and carry out the respective communication process or in the case of your request to the customer service for answering this request and is therefore based on Art. 6 para. 1 letter b) GDPR.
3.1.7 Market research data
When you take part in a market research study at DocCheck, we store all the answers you give when answering the questionnaire. Additional personal data (e.g. practice location or size, age, gender, place of residence) may also be collected. Depending on the study objective, health data may also be requested (e.g. diagnoses, illnesses, use of medication, doctor visits, dietary habits, physical limitations). Participation in market research studies is voluntary. Your consent to the storage of your answers will be requested separately before your participation. If we request particularly sensitive data pursuant to Art. 9 GDPR (e.g. health data), we will explicitly point this out before the start of the study in the context of this consent request. If you have agreed to be contacted again, we can contact you again about the content of the study at the e-mail address you provided. In this respect, the data processing is based on your consent pursuant to Art. 6 para. 1 letter a) and Art. 9 para. 2 letter a) GDPR.
If you participate in a survey via chat or video telephony, we store the chat history and record the video. Irrespective of your consent to this privacy policy, we will ask for your consent to record this data again separately before participation. In this respect, too, the data processing is based on your consent in accordance with Art. 6 para. 1 letter a) and Art. 9 para. 2 letter a) GDPR.
3.1.8 Bank details
For participation in some DocCheck services, we request your bank details. We need this information to process payments for financial claims. You do not have to provide us with your bank details, but then you cannot assert any financial claims from DocCheck services. Since the data processing thus serves the fulfillment of your contractual payment claims, it is based on Art. 6 para. 1 letter b) GDPR.
3.1.9 Competitions
In order to carry out competitions, your e-mail address is stored for contact purposes and, in the event of a win, your address data is stored in order to be able to send the prize. Your address data may be passed on to a shipping service provider. Your data will not be passed on to third parties in any other way.
Data processing is solely for the purpose of carrying out the competition. The legal basis for the processing of personal data to fulfill this obligation is therefore Art. 6 para. 1 letter b) GDPR.
3.1.10 Continuing education/CME
DocCheck offers live CME's as well as on-demand CME's in its own name and CME-certified continuing education for its contractual partners. In addition, we offer you the possibility to search for CME events of external providers via the CME-Scout. Please inform yourself about the data protection regulations of external providers. You can find out who the provider is in the relevant training information.
In order to conduct our own on-demand training courses as well as training courses of our contractual partners, your e-mail address and your DocCheck password will be requested as part of the DocCheck login for the purpose of participation. Information about which data is processed when registering with DocCheck can be found under point 3.1.1. In addition, you must provide your EFN number when registering.
When registering for a live CME from DocCheck, the registration does not take place via your DocCheck login, but via a separate form. Here your title, name and e-mail address, profession, EFN number and current residence (state) will be collected. You can find more details about the provider used for this under point 3.3.17.
In addition, you can optionally enter your cell phone number to receive a reminder via SMS on the day of the event. For more information on the provider used for this purpose, please refer to point 3.3.16.
Your examination result will be stored by us for certified events with learning success control and, in the event of a pass, will be forwarded to the relevant examination body together with your EFN number. You can find the respective examining body in the CME notes. Your consent to the storage and forwarding of your answers will be requested separately before your participation. This serves the purpose of the proper implementation and certification of training courses. If we offer the training on behalf of one of our contractual partners, the latter will also be informed about the answers given and the examination result and, if you pass, will forward your result and your EFN number to the relevant examination body.
We currently offer training on behalf of the following contract partners as a processor:
The data processing serves this purpose only. The legal basis for the processing of personal data is your given consent according to Art. 6 para. 1 letter a) GDPR.
3.1.11 Pharmaceutical/medical device safety-relevant events (AEs/SAEs)
Patients can react in many different ways to the same medical treatment, and some adverse drug reactions and/or safety-relevant information - including those related to medical devices - are only discovered after many people have received medical treatment over a long period of time. If you provide information that is relevant in the context of pharmacovigilance or medical device safety as part of our products, services, surveys or through one of your postings, it may be necessary for us to contact you again to request further safety-relevant information. This re-contacting is carried out on the basis of our existing legal obligations from the applicable legal requirements for medicinal product & medical device safety, whereby DocCheck partly acts as a vicarious agent here (Art. 6 para. 1 letter c) GDPR), as well as from our legitimate interest in fulfilling our contractual reporting obligations to the manufacturers (Art. 6 para. 1 letter f) GDPR).
3.2 Data that is collected automatically
3.2.1 Usage data
We collect information about your interaction with the DocCheck website, such as page-calls or downloads, your search queries, the channels you subscribe to, the logins on partner sites and apps that use DocCheck as an access system, your participation in market research and other activities on the DocCheck platform. These data are mostly pseudonymised and are not visible to third parties. Above all, your usage data serves to continuously improve the individual information offered by DocCheck. In addition, usage data is statistically evaluated in order to optimize the services and the user interface of DocCheck. Your usage data will also be collected to increase privacy and data security in our organization to ensure the best possible level of protection for the personal information we process. The processing of your data takes place in this respect in our legitimate interest and is based on Art. 6 para. 1 letter f) GDPR.
3.2.2 Protocol data
When using DocCheck services, we and any third-party providers whose offers are integrated into our websites via "embed" or iFrame (e.g. Sketchfab, Easyzoom, Trinket, YouTube, Instagram, Vimeo, Twitter, Facebook, etc.) collect your
This data is not used to draw conclusions about your person, but is used to ensure the correct display of the page or iFrame content. You can prevent the processing of the relevant data and the setting of any cookies by not giving your consent. The legal basis for the processing is therefore your consent pursuant to Art. 6 para. 1 letter a) GDPR. You can make the appropriate setting under our Cookie Policy or within your Internet browser. However, if you block cookies, it is possible that you will not be able to use all the technical functions of our website and that this may have a negative impact on your user experience.
You can find more detailed information about the third-party providers integrated by DocCheck via "embed" or iFrame under 3.3.
3.2.3 E-mail data
DocCheck stores information related to the sending of e-mails. This includes the type of e-mail, the date it was sent, information as to whether the e-mail was opened and any interactions that may have taken place in the e-mail (e.g. clicking on a button). This data is aggregated and processed in the form of anonymized statistics, which are used either by DocCheck or by third parties to analyze general user behavior in relation to the sending of e-mails. Furthermore, we register when you have opted-in or opted-out of the various types of e-mails from DocCheck. We record the sending of the e-mails, the date of sending, the opening and the clicking of links in the e-mails for 24 months, after which they are deleted. In this respect, the processing is carried out to ensure the technical functionality of our services, the prevention of any use in violation of our terms of use and the proof of consent to receive e-mails. In this respect, it is carried out in our legitimate interest pursuant to Art. 6 para. 1 letter f) GDPR.
When sending bMails (see § 6 General Terms & Conditions), DocCheck additionally stores the information whether and on which link you have clicked at the end of the bMail, so that we can allocate the amount according to our donation accounts or your DocCheck customer account. In this respect, the processing is carried out for the calculation and settlement of your contractual payment claims and is thus based on Art. 6 para. 1 letter b) GDPR.
3.2.4 Chat data
DocCheck stores the history of conversations between users and support staff that take place as part of user support via chat on the DocCheck website. Since the chat takes place without registration, i.e. anonymously, this conversation data cannot be assigned to an individual user, unless the user transmits data within the conversation on his or her own initiative that enables his or her identification (e.g. e-mail address). The processing of the chat data is carried out for the execution of the contract and is based on Art. 6 para. 1 letter b) GDPR.
3.2.5 Payment data
In connection with payment transactions on the DocCheck platform, we store the payment instrument used, date and time of the transaction, payment amount, expiration date of the payment instrument and other transaction details. This information is necessary to adequately fulfill the contract between you and DocCheck and to enable the provision of the payment services and is in this respect based on Art. 6 para. 1 letter b) GDPR.
3.2.6 DocCheck customer account
When you receive credit through one of the various DocCheck services, DocCheck stores the payment claims you have acquired, as well as the actions that give rise to these claims, in your DocCheck customer account. This is done for contract processing and is based on Art. 6 para. 1 letter b) GDPR. Since the acquired claims are subject to taxation, the storage period is based on the legal storage obligations; storage that goes beyond the billing is therefore for the fulfillment of a legal obligation and is therefore based on Art. 6 para. 1 letter c) GDPR.
3.2.7 Flexikon
The Flexikon is an open medical encyclopaedia. Registered DocCheck users can participate in the Flexikon and check, correct, add to or create new articles. By saving contributions and/or including links and files, as well as editing or creating Flexikon articles, you agree to the publication of this data under the author attribution or privacy setting you have chosen. You can find more information on how you can participate in Flexion and make your medical knowledge available to the community in our Flexikon Manual.
Our Flexikon is based on MediaWiki technology. If you want to become an author in the Flexikon and create or edit articles, MediaWiki functions are integrated for this purpose, which automatically set technically necessary cookies in order to recognise you as a user and to be able to name you as an author as well as to enable correct display and formatting of your contributions. The Flexikon is one of our central services that we offer you as a user; the use of the corresponding cookies and technologies is therefore carried out for the fulfilment of the contract in accordance with Art. 6 para. 1 letter b) GDPR. If you are only a "passive" user and reader of our Flexikon, the necessity of cookies results from our obligation to transparency and disclosure of authors and sources in accordance with Art. 6 para. 1 letter c) of the GDPR.
Naked Flexikon
If you would like to enjoy our Flexikon ad-free in the future, you have the option of taking out a paid subscription to our "Naked Flexikon". The provider for the conclusion and billing of the subscription is PayPal, a service of PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). Your data processing when concluding a subscription via PayPal is carried out for the fulfilment of the contract and is therefore based on Art. 6 para. 1 letter b) GDPR. You can find more information in PayPal's privacy policy.
3.2.8 Flexa
Flexa is a ChatBot that uses generative artificial intelligence to answer medical questions for you as a logged-in user and also suggests suitable Flexikon articles for more detailed reading. It is currently based on ChatGPT 3.5. In order to be able to answer your questions to Flexa, DocCheck sets a session cookie that stores your questions and entries within a conversation with Flexa in order to be able to refer to the conversation history. In addition, Flexa reads another cookie set by DocCheck, which helps us to collect statistical data. This cookie is read in order to be able to optimally adapt our Flexa service to your target group. Depending on the purpose of the processing, our cookies are used to fulfil a contract in accordance with Art. 6 (1) (b) GDPR or in our legitimate interest in accordance with Art. 6 (1) (f) GDPR.
Please also read our Flexikon article for more information on Flexa.
3.2.9 Cookie Management with Cookie First
In order for our website to function properly, we use cookies. In order to obtain your valid consent to the use and storage of cookies in the browser you use to access our website and to properly document this, we use a consent management platform CookieFirst. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, The Netherlands. When you access our website, a connection is established with the CookieFirst server to give us the opportunity to obtain valid consent from you for the use of certain cookies. CookieFirst then stores a cookie in your browser in order to be able to activate only the cookies you have consented to and to properly document this. The processed data will be stored until the specified storage period expires or you request the deletion of the data. Notwithstanding this, certain statutory retention periods may apply.
CookieFirst is used to obtain the legally required consent for the use of cookies. The legal basis for this is Article 6 para. 1 letter c) of the GDPR. We have concluded a data processing contract with CookieFirst. This is a contract required by data protection law, which ensures that the data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR. Our website and CookieFirst automatically collect and store information in so-called server log files, which your browser automatically transmits to us. The following data is collected:
If you want to manage your cookie settings, you can do so at any time in our Cookie Policy.
3.3 Integration of services and content of third parties
Within our online offer, we use content or service offers from third-party providers on the basis of our legitimate interest (i.e. the interest in the analysis, optimization and economic operation of our online offer in the sense of Art. 6 para. 1 letter f) GDPR) in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content"). This always requires that the third-party providers of this content are aware of the IP address of the user, since without the IP address they could not send the content to their browser. The IP address is thus required for the display of this content. We strive to use only such content whose respective providers use the IP address only for the delivery of the content. Third-party providers may use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The pixel tags provide information on visitor traffic to pages with externally embedded content. The pseudonymous information may also be stored in technically necessary cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offering, as well as being linked to such information from other sources.
The following presentation provides an overview of third-party providers and their content, along with links to their privacy statements, which contain further information on the processing of data and, in part already mentioned here, opt-out options. Some of the content and services we provide also require your consent to the cookies set by the services. If you block cookies, it is possible that you will not be able to use all the technical functions of our website and that this may have a negative impact on your user experience.
3.3.1 YouTube
On our website we make use of YouTube. This is a video portal operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary company of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA (hereinafter only referred to as “YouTube”).The processing of user data partly takes place on servers operated by Google in the USA. Data transfer to the USA is based on standard contractual clauses of the EU Commission. In addition, we have concluded a contract on the commissioning of data processing with Google which ensures that the processing of personal data is subject to a level of security corresponding to that of the GDPR.
We use YouTube employing the “Privacy-enhanced mode” function in order to be able to show you videos. The legal basis for this is Art. 6 para. 1 letter f) GDPR. Our legitimate interest is to improve the quality of our website. According to information provided by YouTube, the “Privacy-enhanced mode” function ensures that the data specified in more detail below will only be transferred to the YouTube server if you actually start a video.
Without this “Privacy-enhanced mode”, a connection to the YouTube server in the USA is established as soon as you visit one of our web pages with an integrated YouTube video.
This connection is necessary in order to be able to display the respective video on our website via your web browser. In the course of this, YouTube records and processes a minimum of your IP address, the date and time as well as the website you visited. Furthermore, a connection to the Google advertising network “DoubleClick” is established.
If you are logged in to YouTube simultaneously, YouTube assigns the connection information to your YouTube account. If you want to prevent this, you must either log out from YouTube before visiting our website or enter the corresponding settings in your YouTube user account.
For the purpose of functionality and to analyse user behaviour, YouTube stores performance cookies on your end device via your Internet browser. The legal basis for the processing is your consent pursuant to Art. 6 para. 1 letter a) GDPR. If you do not agree to this processing, you have the option of preventing the storage of cookies by making the appropriate setting under our Cookie Policy or within your Internet browser.
Further information about the collection and use of data as well as your rights and protection options in this regard can be found in Google's privacy policy.
3.3.2 Vimeo
We make use of Vimeo in order to display videos on our website. This is a service operated by Vimeo, LL C, 555 West 18th Street, New York 10011, USA, hereinafter only referred to as “Vimeo“.
The processing of user data partly takes place on servers operated by Vimeo in the USA. Data transfer to the USA is based on standard contractual clauses of the EU Commission. In addition, we have concluded a contract on the commissioning of data processing with Vimeo which ensures that the processing of personal data is subject to a level of security corresponding to that of the GDPR.
The legal basis for this is Art. 6 para. 1 letter f) GDPR. Our legitimate interest is to improve the quality of our website.
When visiting a page on our website in which a Vimeo video is embedded, a connection to the servers of Vimeo in the USA is established to display the video. For technical reasons, it is necessary for Vimeo to process your IP address. Furthermore, the date and time of your visit to our website is recorded.
If you are logged in to Vimeo simultaneously while visiting one of our webpages in which a Vimeo video is embedded, Vimeo may assign the information gathered to your personal Vimeo user account. If you want to prevent this, you must either log out from Vimeo before visiting our website or configure your Vimeo user account accordingly.
For reasons of functionality and usage analysis, Vimeo uses the web analysis service Google Analytics. Google Analytics stores cookies needed for technical reasons via your internet browser on your terminal device and information about the use of our webpages in which a Vimeo video is embedded is transmitted to Google. We cannot rule out that Google processes this information in the USA.
If you do not wish to allow this data processing, you can prevent the installation of cookies by entering the corresponding settings for your internet browser. If you are a registered member of Vimeo, you can also use the settings of Vimeo to manage the cookies used.
You can find further information about the collection and use of data as well as about your rights and ways to protect your privacy in Vimeo’s Privacy Policy.
3.3.3 Instagram
On our website, we use technically necessary social plugins ("plugins") of the social network instagram.com (hereinafter referred to as "Instagram") on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 para. 1 letter f) GDPR). Instagram is an internet service provided by Meta Platforms Inc, 1 Hacker Way, Menlo Park, CA 94025, USA. In the EU, this service is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, hereinafter both referred to as "Meta". The plugins can display interaction elements or content (e.g. videos, graphics or text contributions) and are recognisable by one of the Instagram logos or are marked with the addition "Instagram Social Plugin".
In some cases, user data is processed on Meta servers in the USA. The data transfer to the USA is based on the standard contractual clauses of the EU Commission and we have also concluded an order processing contract with Meta, which guarantees that the processing of personal data is subject to a level of security that corresponds to that of the GDPR.
If you visit a page of our website that contains such a technically necessary plugin, your device establishes a direct connection with Meta's servers. The content of the plugin is transmitted by Meta directly to your device and integrated into the online offering. The processed data can be used to create a user profile for you. We have no influence on the scope of the data that Meta collects with the help of this plugin and inform you according to our level of knowledge.
By integrating the plugins, Meta receives the information that you have accessed the corresponding page of the online offer. If you are logged in to Instagram, Meta can assign the visit to your Instagram account. If you interact with the plugins, e.g. by clicking the Like button or posting a comment, the corresponding information is transmitted directly from your device to Meta and stored there. If you are not a member of Instagram, there is still the possibility that Meta will find out your IP address and store it. According to Meta, only an anonymised IP address is stored in Germany.
The purpose and scope of the data collection and the further processing and use of the data by Meta as well as the related rights and setting options to protect your privacy can be found in Meta's data policy.
If you are an Instagram member and do not want Meta to collect data about you via our online offering and link it to your membership data stored on Instagram, you must log out of Instagram and delete your cookies before using our online offering. Further settings and objections to the use of data for advertising purposes are possible within the Instagram profile settings. The settings are platform-independent, i.e. they are adopted for all devices, such as desktop computers or mobile devices.
We also operate a fan page on the instagram.com platform of Meta Platforms Inc, 1 Hacker Way, Menlo Park, CA, 94025, USA; in the EU, the platform is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, hereinafter both referred to as "Meta".
Every visit and every interaction on our fan page leads to data processing, regardless of whether you have an Instagram or Facebook account or not. In the case of a logged-in account, the operators of Instagram and/or their affiliated companies merge the information about the visit to the fan page with your account information and may use it to create profiles. If you do not wish to be profiled in this way, log out before visiting our fan page.
In joint responsibility with Meta, we analyse how you use our fan page (page insights). Using these page insights, we process statistical data from our fan page such as gender, age range, location, page views, interactions and information on paid activities, reach, accounts reached, impressions and impressions per day. This is done on the basis of our legitimate interest in accordance with Article 6(1)(f) GDPR to make posts on the page more attractive or to find the right time to publish them.
The information required by the GDPR on data processing in the context of Page Insights can be found in Meta's data policy.
Meta also provides you with the relevant contents of the contract concluded between Facebook and us on processing under joint responsibility in accordance with Art. 26 GDPR.
3.3.4 Sketchfab
In our online offering, we make use of the website sketchfab.com operated by Sketchfab, Inc., Sketchfab HQ, 1123 Broadway #501 (25th St), New York City, NY 10010 USA, hereinafter only referred to as “Sketchfab“, for displaying and animating 3D models. All Sketchfab servers are located in the European Union (Ireland).
If you visit one of our webpages which has a Sketchfab plugin, a connection to Sketchfab servers is established. For technical reasons, it is necessary for Sketchfab to process your IP address. Furthermore, date and time of your visit to our website is processed. In addition, the Sketchfab server receives information on which of our pages you visited.
If you are logged in to Sketchfab simultaneously while visiting one of our webpages in which a function or content of Sketchfab is embedded, Sketchfab may assign the information gathered to your personal Sketchfab user account. If you want to prevent this, you must either log out from Sketchfab before visiting our website or configure your Sketchfab user account accordingly.
If you use the services of Sketchfab to display 3D models on our pages, a functional cookie is set for Sketchfab. The legal basis for the processing is your consent in accordance with Art. 6 para. 1 letter a) GDPR. If you do not agree to this processing, you have the option of preventing the storage of cookies by making the appropriate setting under our Cookie Policy or within your Internet browser. However, if you block cookies, it is possible that you will not be able to use all the technical functions of our website and that this may have a negative impact on your user experience.
You can find further information about the collection and use of data as well as about your rights and ways to protect your privacy in Sketchfab’s Privacy Policy.
3.3.5 Facebook
On the basis of our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offer within the meaning of Art. 6 para. 1 letter f) GDPR), we use technically necessary social plugins ("plugins") of the social network facebook.com (hereinafter referred to as "Facebook") on our website. Facebook.com is an internet service provided by Meta Platforms Inc, 1 Hacker Way, Menlo Park, CA 94025, USA. In the EU, this service is in turn operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, hereinafter both referred to as "Meta". The plugins can display interaction elements or content (e.g. videos, graphics or text posts) and are recognizable by one of the Facebook logos (white "f" on blue tile, the term "Like" or a "thumbs up" sign) or are marked with the addition "Facebook Social Plugin". Here you can find a list and the appearance of Facebook social plugins.
In some cases, the processing of user data takes place on Facebook servers in the USA. The data transfer to the USA is based on the standard contractual clauses of the EU Commission and we have also concluded an order processing contract with Meta, which ensures that the processing of personal data is subject to a level of security that corresponds to that of the GDPR.
If you visit a page of our website that contains such a technically necessary plugin, your device establishes a direct connection with Meta's servers. The content of the plugin is transmitted by Meta directly to your end device and integrated by it into the online offer. A usage profile of you can be created from the processed data. We have no influence on the scope of the data that Meta collects with the help of this plugin and inform you according to our state of knowledge.
By integrating the plugins, Meta receives the information that you have accessed the corresponding page of the online offer. If you are logged into Facebook, Meta can assign the visit to your Facebook account. If you interact with the plugins, e.g. by clicking the Like button or posting a comment, the corresponding information is transmitted from your device directly to Meta and stored there. If you are not a member of Facebook, there is still the possibility that Meta will learn and store your IP address. According to Meta, only an anonymized IP address is stored in Germany.
The purpose and scope of the data collection and the further processing and use of the data by Meta, as well as the related rights and settings options for protecting your privacy, can be found in Meta's privacy policy.
If you are a Facebook member and do not want Meta to collect data about you via our online offer and link it to your membership data stored on Facebook, you must log out of Facebook and delete your cookies before using our online offer. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings or via the US side or the EU side. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.
3.3.6 X (formerly known as "Twitter")
We use the plugin of the social network "X" on our website. X is an internet service of Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, which is a subsidiary of X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, both hereinafter referred to as "X." User data is partly processed on X servers in the USA. The data transfer to the USA is based on the standard contractual clauses of the EU Commission and we have also concluded an order processing contract with X, which guarantees that the processing of personal data is subject to a level of security that corresponds to that of the GDPR.
If you visit a page on our website that contains such a technically necessary plugin, your internet browser will download a representation of the plugin from X's servers in the USA. For technical reasons, it is necessary for X to process your IP address. In addition, the date and time of your visit to our website are also recorded.
If you are logged in to X while visiting one of our websites equipped with the plugin, the information collected by the plugin about your specific visit to X will be recognised. X may assign the information collected in this way to your personal user account there. For example, if you use X's "Share" button, this information will be stored in your X user account and may be published via X's platform. If you wish to prevent this, you must either log out of X before visiting our website or make the appropriate settings in your X user account.
If you wish to have the content of X displayed on our pages, a functional cookie will be set for X. The legal basis for the processing is your consent pursuant to Art. 6 para. 1 letter a) GDPR. If you do not agree to this processing, you have the option of preventing the storage of cookies by making the appropriate setting under our cookie notices or within your Internet browser. However, if you block cookies, it is possible that you will not be able to use all the technical functions of our website and that this may have a negative impact on your user experience.
X provides further information about the collection and use of data as well as your rights and protection options in this regard in their Privacy Policy.
3.3.7 Trinket
In our online offering, we make use of the internet service Trinket to display and deal with applications, requests, and medical calculations. Trinket is a service operated by Forkable, Inc., Trinket, 502 Adams St, Raleigh, NC, 27605-1202 USA, hereinafter referred to as “Trinket“. The applications we developed together with Trinket are integrated via iFrame in our website.
The processing of user data partly takes place on servers operated by Trinket in the USA. Data transfer to the USA is based on standard contractual clauses of the EU Commission. In addition, we have concluded a contract on the commissioning of data processing with Trinket which ensures that the processing of personal data is subject to a level of security corresponding to that of the GDPR.
When you visit a page on our website which contains a Trinket iFrame, a connection to the Trinket servers is established. When the iFrame is clicked on, it is necessary for Trinket for technical reasons to record your IP address as well as the date and time you clicked on it. If you are logged in to Trinket simultaneously while visiting one of our webpages which contains an application created with Trinket, the information gathered may be assigned to your personal Trinket user account. If you want to prevent this, you must either log out from Trinket before visiting our website or configure your Trinket user account accordingly.
If you wish to have Trinket's services displayed on our pages, a functional cookie will be set for Trinket. The legal basis for the processing is your consent pursuant to Art. 6 para. 1 letter a) GDPR. If you do not agree to this processing, you have the option of preventing the storage of cookies by making the appropriate setting under our Cookie Policy or within your Internet browser. However, if you block cookies, it is possible that you will not be able to use all the technical functions of our website and that this may have a negative impact on your user experience.
You can find further information about the collection and use of data as well as about your rights and ways to protect your privacy in Trinket’s Privacy Policy.
3.3.8 Use of Google Data Studio
We use Google Looker Studio, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter referred to as "Google". Google Looker Studio uses data from Google Analytics and other data sources if we link them. Access is via a browser, the data sources are connected directly via Google Looker Studio. Further information on the use of Google Looker Studio can be found in Google's information.
Some of the user data is processed on Google servers in the USA. The data transfer to the USA is based on the standard contractual clauses of the EU Commission and we have also concluded a contract with Google for order processing, which guarantees that the processing of personal data is subject to a level of security that corresponds to that of the GDPR.
The use of Google Looker Studio is based on the data and your consent in accordance with Art. 6 para. 1) letter a) GDPR in the services of Google Analytics and other anonymised analysis data (not requiring consent) of our services. Our legitimate interest lies in the visual creation of reports and dashboards for optimisation and needs-based design for our customers. The legal basis for the use of Google Looker Studio is therefore Article 6 para. 1 letter f) GDPR.
Further information on the use of Google Analytics can be found in section 10.1 of this privacy policy.
You can find more information about Google Looker Studio here.
3.3.9 Zammad
We use the helpdesk system Zammad provided by Zammad GmbH, Marienstraße 18 in 10117 Berlin, Germany, hereinafter referred to as “Zammad“. We have concluded a contract on the commissioning of data processing with Zammad for this purpose.
Zammad helps us to organise and process your support requests, queries about your account and all incoming messages and chat requests in a structured manner. Zammad uses the data (chat logs, emails with email address) only for the technical processing of the enquiries and does not pass them on to third parties.
In the course of processing service requests, it may be necessary to collect further data from you.
The use of Zammad enables us to be able to offer you our DocCheck services and the associated support at all and is therefore used to fulfil the contract. The legal basis for the use is therefore based on Art. 6 para. 1) letter b) GDPR.
If you are not happy to have your data collected by the Zammad software, you can use alternative means of communication such as e-mail or telephone.
You can find further information in Zammad’s Privacy Policy.
3.3.10 Typeform
On our website, we make use of the service Typeform operated by TYPEFORM S.L., Carrer Bac de Roda, 163, 08018 Barcelona (Spain) (“Typeform”) to process user information in online contact forms. In doing so, personal data supplied by the user are stored and processed. Processing of data is done on the servers of Amazon Web Services, Inc. 410 Terry Avenue North Seattle WA 98109 (USA). The main server is located in Virginia, USA and the backup server in Frankfurt/Main, Germany.
For the aforementioned purposes, we have concluded a contract on the commissioning of data processing with Typeform according to Art. 28 GDPR and the security of transmission is additionally provided for by so-called standard contractual clauses which ensure that the processing of personal data is subject to a level of security corresponding to that of the GDPR.
To ensure that these online contact forms work properly on the website, a functional cookie is set for the use of Typeform. The legal basis for the setting of this cookie and the associated provision of Typeform services is your consent pursuant to Art. 6 para. 1) letter a) GDPR. If you do not agree to this processing, you have the option of preventing the installation of cookies by making the appropriate settings under our Cookie Policy. However, if you block cookies, it is possible that you will not be able to use all the technical functions of our website and that this may have a negative impact on your user experience.
You can find further information in Typeform’s Privacy Policy.
3.3.11 SoundCloud
On our website, audio files are embedded using the service SoundCloud. The service is operated by SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin, Germany, hereinafter referred to as "SoundCloud".
To display audio content, we use SoundCloud cookies needed for technical reasons via iFrame on individual pages. In this way, a connection between your browser and a SoundCloud server is established and SoundCloud receives the information that you visited our website with your IP address. If you click the share button while logged in to your SoundCloud user account, you can link the contents of our website to your SoundCloud profile and/or share these contents. In this way, SoundCloud can assign your visit to our website to your user account. We underline that as the provider of the website we receive no information as to the content of the transmitted data or their use by SoundCloud.
If you do not want SoundCloud to assign your visit to our website to your SoundCloud user account, please log out from your SoundCloud user account before activating any content of the SoundCloud plugin.
We use SoundCloud in our legitimate interest in the attractive appearance of our online offering. This constitutes a legitimate interest in the sense of Art. 6 para. 1 letter f) GDPR. You cannot use this function without supplying data.
You can find further information on the treatment of user data in SoundCloud’s Privacy Policy.
3.3.12 Accusoft
We use Accusoft PrizmDoc Hosted for converting documents (PDF, MS Office, etc.) that users upload to our portal. The provider is AccuSoft Corporation, 4001 N. Riverside Drive, Tampa, FL, 33603, USA, hereinafter referred to as "Accusoft".
The converted documents are stored at Amazon Web Services, Inc., 410 Terry Avenue, North Seattle, WA 98109, USA, and displayed via viewer in the portal and in Flexikon.
In part, the processing of user data takes place on Amazon Web Services servers in the USA and the security of the transmission is also secured via standard contractual clauses, which ensure that the processing of personal data is subject to a level of security equivalent to that of the GDPR.
The use of Accusoft enables us to be able to offer you our DocCheck services in the form of the presentation of documents in the portal and Flexikon at all and therefore takes place for the execution of the contract. The legal basis for the use is therefore based on Art. 6 para. 1) letter b) GDPR.
You can find more information about the handling of user data here.
3.3.13 Smart In Media AG
We use the services PathoZoom and easy Zoom to integrate histological images. The provider is Smart In Media AG, Gleueler Strasse 245-249, 50935 Cologne, Germany, hereinafter referred to as "Smart In".
To display this content, we use technically necessary cookies from Smart In on some web pages via iFrame.
Functional cookies are set for Smart In / easy zoom to enable the display of histological images and the provision of the service. The legal basis for the setting of this cookie and the associated provision of the Smart In / easyZoom services is your consent pursuant to Art. 6 para. 1) letter a) GDPR. If you do not agree to this processing, you have the option of preventing the installation of cookies by making the appropriate settings under our Cookie Policy. However, if you block cookies, it is possible that you will not be able to use all the technical functions of our website and that this may have a negative impact on your user experience.
You can find more information about the handling of user data here.
3.3.14 Embed.ly
We use embed.ly to embed podcasts and images. The provider is A Medium Corporation, 799 Market Street, 5th Floor, San Francisco, CA 94103, USA, hereinafter referred to as "Medium".
For technical reasons, Medium uses tracking cookies on our website to track and evaluate website visits and the use of Medium's services.
Partial processing of user data takes place on Medium servers in the USA. The data transfer to the USA is based on the standard contractual clauses of the EU Commission and we have additionally concluded a contract for commissioned processing with Medium, which ensures that the processing of personal data is subject to a level of security that corresponds to that of the GDPR.
Functional cookies are set for Medium / embed.ly to enable the provision of Medium services. The legal basis for the setting of this cookie and the associated provision of the Medium / embed.ly services is your consent pursuant to Art. 6 para. 1) letter a) GDPR. If you do not agree to this processing, you have the option of preventing the installation of cookies by making the appropriate settings under our Cookie Policy. However, if you block cookies, it is possible that you will not be able to use all the technical functions of our website and that this may have a negative impact on your user experience.
You can find more information about the handling of user data here.
3.3.15 websms
We use the websms service to send reminder SMS to participants of DocCheck's own live training courses. The provider is LINK Mobility Austria GmbH, Brauquartier 5/13, 8055 Graz, Austria, a subsidiary of LINK Mobility Group AS, Universitetsgata 2, 0164 Oslo, Norway, hereinafter both referred to as "websms".
Websms uses your cell phone numbers to send you a text message on the day of the training event to remind you of the upcoming event.
The use of websms is based on your consent and thus on the legal basis of Art. 6 para. 1 letter a) GDPR.
Further information can be found in the websms privacy policy.
3.3.16 LiveWebinar
We use the provider LiveWebinar to conduct our continuing education / CME events. The provider of LiveWebinar is RTCLab Sp. z o.o., Grunwaldzka 212, 80-266 Gdañsk, Poland, hereinafter referred to as "LiveWebinar". LiveWebinar will use the data provided in 3.1.10 for your registration for the training / CME: your title, name and e-mail address, profession, EFN number and current residence (state). If you also enter your cell phone number in the registration form to be reminded of the event, this will also be stored.
In addition, LiveWebinar collects your user behavior during the training in order to prove your attendance time required for the certification of participation and to enable interactions during the event (e.g. queries/contacting in the chat). LiveWebinar also uses your contact information to send you event registration confirmation and event reminders.
The use of LiveWebinar is based on your given consent in the context of your registration and thus on the legal basis of Art. 6 para. 1 letter a) GDPR. For more information, please see the LiveWebinar privacy policy.
3.3.17 Google Tag Manager
We use the Google Tag Manager of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, hereinafter referred to as "Google", on our website. If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is the controller of your data. Google Ireland Limited is therefore the company affiliated with Google that is responsible for processing your data and complying with applicable data protection laws.
This application manages JavaScript tags and HTML tags that are used to implement tracking and analysis tools in particular. The data processing serves the purpose of demand-oriented design and optimization of our website.
The Google Tag Manager itself neither stores cookies nor does it process personal data. However, it enables the triggering of other tags that can collect and process personal data.
More information on terms of use and data protection can be found here.
3.3.18 Google Ads Conversion Tracking
We use the online advertising program "Google Ads" on our website and in this context conversion tracking (visit action evaluation). Google Conversion Tracking is an analysis service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter referred to as "Google". If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is the controller of your data. Google Ireland Limited is therefore the company affiliated with Google that is responsible for processing your data and complying with applicable data protection laws.
Google Ads (formerly Google AdWords) is the in-house online advertising system of Google LLC. We can create online adverts via Google Ads to bring our products or services closer to interested people. We are convinced of the quality of our offer and want as many people as possible to get to know our website. When you click on an advert placed by Google, a cookie for conversion tracking is stored on your computer. These cookies have a limited validity, do not contain any personal data and are therefore not used for personal identification. If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognise that you have clicked on the ad and have been redirected to this page. Each Google Ads customer receives a different cookie. It is therefore not possible for cookies to be tracked via the websites of Ads customers.
The information collected with the help of the conversion cookie is used to create conversion statistics. This tells us the total number of users who clicked on one of our adverts and were redirected to a page with a conversion tracking tag. However, we do not receive any information with which users can be personally identified. Your data may be transferred to the USA.
We also use Enhanced Conversions from Google Ads. This uses an algorithm to generate hashed data from the customer data collected from you (e.g. your email address), which is then matched with logged-in Google accounts in order to assign the conversions of our campaigns to ad events such as clicks or views.
The legal basis for the processing is your consent pursuant to Art. 6 para. 1) letter a) GDPR. If you do not agree to this processing, you have the option of preventing the installation of cookies by making the appropriate settings in your Internet browser. You can find instructions on how to do this at Googles Browser Settings.
You can disable personalized advertising for you in Google's advertising settings. You can find instructions on how to do this here. Alternatively, you can prevent the use of cookies by third parties by visiting the deactivation page of the Network Advertising Initiative here and implementing the further information on opting out given there. You will then not be included in the conversion tracking statistics. You can find more information and Google's privacy policy here.
3.3.19 easyRadiology
We are using the service easyRadiology for the integration of X-ray images. This service is provided by easyRadiology AG, Gleueler Str. 245-249, D-50935 Köln, hereinafter reffered to as "easyRadiology".
To display this content, we use technically necessary cookies from easyRadiology on some websites via iFrame.
The use of the services of easyRadiology in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 para. 1 letter f) GDPR.
You can find more information about the handling of user data here.
3.3.20 ChatGPT
We use the service ChatGPT from OpenAI to support our artificial intelligence Flexa, see 3.2.8. The provider of ChatGPT is OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA.
ChatGPT forms an interface to our AI and uses the questions and search terms entered by you in Flexa to generate additional answer options. Within a conversation with Flexa, ChatGPT also accesses the transmitted conversation history for this purpose. ChatGPT itself does not set any cookies; moreover, we do not transmit any personal data about you as a user to ChatGPT.
If you wish to use Flexa, you automatically consent to the transmission of your questions and search terms to ChatGPT. Personal data will not be passed on. However, under certain circumstances, your input may result in assignable data that can be related to you as a person. The legal basis for the processing of this data is therefore Art. 6 para. 1 letter a) GDPR. Further information can be found in the OpenAI privacy policy.
3.3.21 Emarsys Web Extend & Web Channel
We use the "Web Extend" and "Web Channel" services of Emarsys eMarketing Systems AG, Märzstrasse 1, 1150 Vienna, hereinafter referred to as "Emarsys", on our website. The purpose of these services is to target you as a user with relevant and personalised content. The Emarsys Web Extend Tag has been implemented on the website for this purpose. Emarsys processes data exclusively in accordance with the settings we have made. The Web Extend Tag tells Emarsys which of our pages you have visited and assigns this information to your personal user profile. User master data from your profile is also used for personalisation purposes. In the next step, Web Channel enables us to display campaigns to you based on your user behaviour. We use embedded, overlay and ribbon campaigns on our websites.
We collect the following data on our website via Web Extend:
We store this information in your local storage in order to recognise your browser so that we can track your movements on our website and record and measure the success of certain marketing measures. Local Storage works in a similar way to cookies and stores data in your end device by creating a local identifier. Your user information is stored on the basis of Art. 6 para. 1 lit. a GDPR. If you do not agree to the processing of your user behaviour and the corresponding display of campaigns and content via Web Channel, you can prevent the storage in your Local Storage.
Further information on Emarsys' privacy policy can be found here.
4. Storage of your data
Personal data is generally stored on DocCheck servers and is protected from modification and intervention by unauthorized third parties, including by access controls and firewalls. The processing of user data is mainly carried out internally. When third parties are involved in data storage or processing, a contract for order processing exists with them, which guarantees the processing of your data at the same level as DocCheck processes your data.
Professional certificates are stored partly electronically and partly as physical documents (depending on how a certificate was issued).
When uploading files, some file formats (e.g. videos, PDF documents, PowerPoint presentations, etc.) are stored in cloud services. When uploading the files, no personal data is transferred accompanying the file, the link of the files with the respective user is stored on servers of DocCheck.
Pseudonymized data collected in the context of the use of counting pixels is stored on the systems of the respective providers.
5. Visibility of your data
In principle, you can determine the visibility of your data yourself. Since DocCheck is a social media platform, a public display is preset for some of your data and activities according to the following instructions. DocCheck offers you a selection at the corresponding data fields, which defines different levels of visibility.
The visibility of your user profile as well as your assets published at DocCheck (channels, articles, files, etc.) can be freely selected:
The visibility of your comments at DocCheck depends on the visibility of the commented content. Comments can be deleted or hidden by DocCheck moderators if they violate our netiquette.
All articles and texts published in the DocCheck Flexikon are made available to other users under a Creative Commons licence. Further information can be found in the terms of use of the Flexikon.
Part of your DocCheck profile data is also visible outside DocCheck by default. This includes your first and last name, title, profession, area of expertise, field of activity, and your professional position.
If you do not understand the visibility settings or have general concerns about publishing your professional profile or parts of it on the Internet, you should not use DocCheck.
6. Use of your data
6.1 DocCheck services
We use the data listed in sections 3.1 and 3.2 when registering and using the various DocCheck services. The processing is thus carried out to provide these services and is based on Art. 6 para. 1 letter b) GDPR.
Your user master data is the basis of your public profile at DocCheck and enables you to access the various contents and functions of DocCheck. This allows you to write comments under your name at DocCheck, create content and upload files and make them available to other users. Furthermore, you can post job offers or job searches at DocCheck. We use your delivery address to be able to deliver goods ordered by you. We use your bank data to pay you once a quarter the claims that you have acquired against DocCheck through various DocCheck services.
6.2 Authorization
If you are a licensed medical professional, your data authorizes you to access content that, under the terms of the EU-Directive 2001/83/EC, may only be made available to healthcare professionals (for example, prescription drug information). In this respect we process the data for the purpose of fulfilling the contract between you and DocCheck (Art. 6 para. 1 letter b) GDPR) as well as for fulfilling a legal obligation (Art. 6 para. 1 letter c) GDPR).
6.3 Personalization
We use your data to personalize the information on DocCheck in order to offer contents and services that match your professional activity and your interests. This includes a personal home page that provides an overview of news in channels that you have subscribed to. The same applies to the information you receive with the DocCheck News via e-mail. In this respect the data processing has the purpose to fulfill our contract and to make our offers more user-friendly, as stipulated in Art. 6 para. 1 letters b) and f) GDPR.
6.4 Improvements
We use your data to continuously improve our services. By analyzing the usage data, we can see if there are any errors in the use of our services or problems in understanding the user interface. In addition, we can see which areas and services of DocCheck are particularly interesting for users and which content we may need to optimize. The rationale for the data processing is based on Art. 6 para. 1 letter f) GDPR and takes place in our legitimate interest in website statistics and improving our services.
6.5 Communication
We use your data to ensure smooth communication between you and DocCheck via e-mail. Through the data, we can address you personally and customize the e-mail delivery to your needs. The data processing takes place to answer your request and thus to fulfill our contract. Furthermore we have a legitimate interest to ensure the technical functionality of our services and to personalize them in favor of a higher user-friendliness and attractiveness. The use of your data is based on Art 6 para. 1 letters b) and f) GDPR.
6.6 Marketing
We use your data to inform you about new DocCheck services that are relevant for your interests and professional activities. The data also enables us to present our advertising or third-party advertising in a way that it reaches the right recipient. Your usage data will also be used to evaluate the success of marketing campaigns. We also use DocCheck's own advertising cookies for the display of target group-specific advertising, which, among other things, also enable the target group-specific allocation of campaigns on our ad server. If you do not agree with these cookies, you have the option of preventing the storage of cookies by making the appropriate setting under our Cookie Policy or within your Internet browser. If you agree to advertising cookies, advertising will be displayed on the basis of your consent in accordance with Art. 6 para. 1) letter a) GDPR.
6.6.1 Evaluation of marketing measures for advertising customers
Your data is used to evaluate the success of marketing measures. We make this evaluation available to advertising customers. However, it only contains anonymized and aggregated data, so that no information about your individual response to advertising is passed on to third parties. Consequently, no personal data is passed on. In addition, advertisers may use their own tracking in the advertising that is displayed to you via our third-party advertising content. This tracking may, in some cases, allow the advertiser to obtain personal data. Although DocCheck permits the use of third-party tracking on the condition that they comply with our Advertising Policy, we have no control over these third parties' use of tracking or how they manage the information they collect, and DocCheck may not be able to verify compliance with our Advertising Policy.
6.6.2 healthy ID
To improve the targeting of banners and tailor them to your professional interests, we use the "healthy.ID" function of antwerpes healthy media GmbH, Vogelsanger Str. 66, 50823 Cologne. For this purpose, we assign a random partner targeting ID (PTID) to you as a user and link this to some of the properties of your profile (your profession, your specialist group and your field of activity, if applicable) and an irreversible encryption of your e-mail address. We transmit this anonymised data to generate your "healthy.ID", which later enables advertising to be displayed according to your profession. Your identity as a DocCheck User will not be disclosed or passed on at any time. If you do not agree to the targeting of adverts according to your professional interests in connection with the healthy.ID, you have the option of preventing this by making the appropriate settings. The banner display in connection with the "healthy.ID" function is therefore based on your consent in accordance with Art. 6 para. 1) letter a) GDPR. Please make a corresponding selection in your user account under the heading "healthy.ID". An advertising cookie is also set to display the target group-specific banners. If you do not agree to this processing, you have the option of preventing the storage of cookies by making the appropriate setting under our Cookie Policy or within your Internet browser. If you agree to the use of healthy.ID, the banner display in connection with the "healthy.ID" function will be based on your consent in accordance with Art. 6 para. 1) letter a) GDPR.
6.7 Market research
We use your data to invite you to market research studies. We use data that you provide as part of market research studies to conduct our own studies or studies on behalf of customers. Since market research helps to finance DocCheck services, we have a legitimate business interest in collecting this data. Your participation enables us to provide you with our services free of charge. The data is pseudonymized and aggregated in the evaluation process, so that neither the raw data nor the evaluation allow us to draw conclusions about a specific person. We use an employer authorization to check whether employed physicians are allowed to participate in our market research in accordance with the rules. In this respect, the data processing is carried out in our legitimate interest to conduct market research and to query your legal authorization and to be able to prove it later, and is thus based on Art. 6 para. 1 letters f) and c) GDPR.
6.8 Statistics
We use pseudonymized and anonymized data for legitimate business interest (Art. 6 para. 1 letter f) GDPR) to improve and finance our Internet offering in order to develop usage statistics, overall analyses and business intelligence strategies. They enable us to make informed decisions, to inform advertising customers about the reach of DocCheck and to provide information about our business performance.
6.9 Customer Support
We store your communication with DocCheck to help you to solve problems you might experience with our services. The relevant data processing helps us to fulfill our contract and is based on Art. 6 para. 1 letter b) GDPR.
6.10 Security
We want to create a trustworthy environment for the exchange of professional information. Your public profile and professional credentials give other users the assurance that medical statements are backed by the necessary expertise. We use stored IP addresses to prevent misuse of your password after it has been spied out, lost or passed on. An indication of misuse of a password arises, for example, if it is used by several IP addresses. Since your DocCheck password gives access to your user profile, this mechanism serves your data security. The data processing in this regard is therefore also in our legitimate interest to increase data security and is based on Art. 6 para. 1 letter f) GDPR.
6.11 Availability
We collect the data mentioned in point 3.2.2 to improve the availability of our services. Among other things, they serve to ensure a smooth connection of the website, system stability and the responsive display of content on various end devices. The data processing in this respect is carried out in our legitimate interest in this regard and is based on Art. 6 para. 1 letter f) GDPR.
6.12 Conflict resolution
We use your data to resolve possible conflicts between you and DocCheck, for example, if it is unclear whether you have consented to receive e-mails or not. The data processing is therefore in our legitimate interest to be able to keep appropriate records and is based in this respect on Art. 6 para. 1 letter f) GDPR.
6.13 Special Service & Information Offers; DocCheck VIP Program
A good community lives from its members. We therefore offer particularly committed users the opportunity to participate in our DocCheck VIP programme, in which we communicate exclusive information, event invitations and features to our VIP members. To invite you as a DocCheck VIP, we use the contact details you provide in your user profile. The invitation to participate in our VIP programme is sent via our business email programmes as part of our customer care and thus in our legitimate interest pursuant to Art. 6 para. 1 letter f) GDPR.
We use HubSpot to manage our VIP members and to contact our VIP members as well as to send mailings. HubSpot is a software company from the USA with a branch in the EU, HubSpot Ireland Limited in 2nd Floor 30 North Wall Quay, Dublin 1, Ireland. We only store your data in the form of your name, age, profession, contact details and user information (e.g. the date of your registration, your user ID) with HubSpot if you have given us permission to do so as part of your participation in the VIP program. If you revoke this consent, data processing by us will end. You can find more information about HubSpot's privacy policy here.
7. Disclosure of data
7.1 Conditions of Disclosure
Your personal information will not be shared with third parties unless
7.2 Single sign-on (DocCheck Login)
The login on websites and apps of companies that use DocCheck as an access system is processed on DocCheck servers. Depending on the procedure (s.b.) this can involve a transfer of personal data. The extent of the data transfer depends on the method used:
If you are unsure, which method is used on a given website, you can always ask us under info(at)doccheck.com.
If you use our single sign-on as a B2B customer for your website as an external login, you can easily set it up and manage it via DocCheck CReaM. You can find more information about DocCheck CReaM here. The use of our login services requires the creation of a company account. The data stored there by you as a B2B customer is used for the purpose of contract fulfilment (Art. 6 (1) (b) GDPR) for the user contract that is concluded.
7.3 E-mail dispatch
DocCheck uses order processors in accordance with Art. 28 GDPR for the sending of e-mails.
Emarsys eMarketing Systems GmbH, Zeppelinstrasse 2, 85399 Hallbergmoos, Germany (hereinafter "Emarsys") handles the sending of e-mails for DocCheck. For this purpose, Emarsys receives from DocCheck the e-mail address, title, salutation and other user parameters so that e-mails can be sent with a personal address. The conditions of data processing are fixed in an order processing contract with Emarsys in accordance with Art. 28 GDPR. Emarsys is prohibited from passing on user data to third parties.
7.4 Collection of data in the framework of market research
DocCheck uses a selected contract processor for data collection in the context of market research studies.
For the collection of market research data, DocCheck uses the survey software TIVIAN of Tivian XI GmbH, Gustav-Heinemann-Ufer 72a, 50968 Cologne, Germany (hereinafter referred to as "TIVIAN") for quantitative surveys and the software "QDC Studio" of Kernwert GmbH, Gubener Strasse 24, 10243 Berlin, Germany (hereinafter referred to as "Kernwert") for qualitative surveys.
The conditions of the data processing are fixed in a contract for commissioned processing with TIVIAN and Kernwert according to Art. 28 GDPR.
7.4.1 Quantitative surveys with G3Plus
To draw samples, DocCheck uses in-house software in addition to the software we use to send e-mail invitations for quantitative market research studies.
If surveys of personal data in TIVIAN are necessary - e.g. for participants who are not DocCheck users and were recruited by e-mail - the data processing is explained in a separate data protection notice before participation. In this case, the data is collected by TIVIAN as an order processor for DocCheck. The collection is subject to the terms and conditions of the concluded contract for commissioned processing according to Art. 28 GDPR between DocCheck and TIVIAN.
For all collected data DocCheck remains responsible and your contact.
7.4.2 Qualitative surveys
To participate in qualitative studies, potential participants who were for instance recruited via a quantitative pre-survey, receive an invitation by e-mail including all important information on the planned DocCheck study. This comprises general information on who commissioned the study, the purpose of the study, description of the topic, type of data to be collected, duration of study and stipulations on data deletion. The invitation e-mail contains access data for each participant as well as a link to log in to Kernwert GmbH’s QDC Studio. Participation is voluntary and is subject to your consent to the purposes specified for this study and data processing according to Art. 6 para. 1 letter a) GDPR.
If it becomes necessary to collect personal data in QDC Studio, the data is collected by Kernwert GmbH as a service provider for DocCheck. This collecting of data is subject to the contract on the commissioning of data processing concluded between DocCheck and Kernwert GmbH according to Art. 28 GDPR.
DocCheck remains responsible for all data collected and remains your contact.
7.5 Statistics on usage / results from market research
Statistics on usage and results from market research which DocCheck provides to third parties contain only anonymised and aggregated data. It is impossible to trace this data to an individual person.
If particular categories of personal data are processed, for instance health data, processing is done to guarantee high standards of quality and safety in healthcare and in the use of drugs and medicinal products (Art. 9 para. 2 letter i) GDPR) and for scientific or statistical purposes (Art. 9 para. 2 letter j) GDPR).
7.6 Disclosure of information on events relevant to the safety of pharmaceutical products/medical devices (AEs/SAEs)
The passing on of your information (3.1.11) within the framework of pharmacovigilance and/or medical device safety is based on our legal obligation according to the AMG and MPG, whereby DocCheck partially acts in part as a vicarious agent here, Art. 6 Para. 1 Letter c) GDPR, as well as our legitimate interest in fulfilling our contractual reporting obligations to the manufacturers, Art. 6 Para. 1 Letter f) GDPR. If the event reported by you gives raises questions for the manufacturer subject to the reporting obligation, it may be necessary to contact you again as the reporting person in order to enable the manufacturer to fulfil its legal obligations under the regulations relevant to the safety of medicinal products and medical devices.
8. Data security
When using the DocCheck website we use SSL, so that the transfer of data between you and DocCheck is encrypted if your browser supports this technology. This is usually 256-bit encryption. If your browser does not support 256-bit encryption, we provide the next available standard. You recognize the encryption by a lock or key symbol in your browser. DocCheck takes appropriate technical and organizational security measures to protect your data from loss or unauthorized access by third parties resulting in manipulation, theft or destruction. Our security measures comply with the latest standards and are constantly being improved in line with technological developments.
9. Analysis tools
Some of the information mentioned under 3.2 is collected using external third-party analysis tools, which are listed below. The legal basis of the data processing is a legitimate interest in data processing according to Art. 6 para. 1 letter f) GDPR. The rationale lies in the continuous optimization of our website and in the need to maintain the functionality of our applications and in the coverage measurement necessary for media companies to exercise freedom of the press in Art. 5 para. 1 German Basic Law.
The respective data categories and processing purposes can be found in the descriptions of the analysis tools:
9.1 Google Analytics
For the purpose of customizing and the continuous optimization of our pages, we use Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA; hereinafter "Google". In this context, pseudonymized user profiles are created and technically necessary cookies (see point 4) are used. The information generated by the cookie about your use of this website such as
are transferred to a Google server in the USA and stored there. DocCheck has set a retention period of 26 months for the storage of this data by Google. The information is used to analyse the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the purposes of market research and the needs-based design of this website. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Google data. The IP addresses are anonymised so that they cannot be assigned (IP masking).
Some of the user data is processed on Google servers in the USA. The data transfer to the USA is based on the standard contractual clauses of the EU Commission and we have also concluded an order processing contract with Google, which guarantees that the processing of personal data is subject to a level of security that corresponds to that of the GDPR. The legal basis for the performance cookies used for Google Analytics is your consent in accordance with Art. 6 para. 1) letter a) GDPR. If you do not agree to this processing, you have the option of preventing the storage of cookies by making the appropriate setting under our Cookie Policy or within your Internet browser.
You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on under this link.
For more information about Google Analytics related privacy, please visit the Google Analytics Help Center.
10. Duration of data storage
We only process personal data for as long as this is necessary for the above-mentioned purposes. Afterwards, personal data is deleted if there is no conflict with legally stipulated retention periods.
11. Your rights
Regarding the use of your data, you have the following rights. You are welcome to contact us at any time under info@doccheck.com or to consult our data protection officer (see above).
11.1 Right of information
You have the right to receive from us at any time gratuitous information about the personal data stored about you and a copy of this information. Furthermore, you have the right of information about the following topics:
You also have the right to know whether personal data has been transmitted to a third country or to an international organization. If this is the case, you have the right to obtain information about the appropriate guarantees in connection with the transfer.
In order to get access to this information, you can contact our data protection officer or our customer service at info(at)doccheck.com at any time.
Your right of information is based essentially on Art. 15 GDPR.
11.2 Right to rectification
You have the right to demand the immediate correction of incorrect personal data concerning you. You also have the right to request the completion of incomplete personal data, including by means of a supplementary statement, taking into account the purposes of processing. DocCheck offers you the opportunity to process a large part of your data yourself in your user account. However, part of your data (especially your job or last name) cannot be changed directly by you. If you would like to exercise your right to rectification, you can always contact our data protection officer or our customer service at info(at)doccheck.com.
Your right to rectification is based on Art. 16 GDPR.
11.3 Right to erasure
You have the right to demand that your personal data is deleted without delay if one of the following reasons applies and the processing is not required:
If any of the above reasons apply and you wish to delete the personal information stored by us, you may contact our data protection officer or our customer service at info(at)doccheck.com at any time. Our data protection officer or our employees will arrange that the deletion request will be fulfilled as soon as possible.
Please note that depending on the scope of your request for deletion, the further use of your DocCheck account and DocCheck password may be impossible.
Documents that you have uploaded and published while using DocCheck under recognition of the DocCheck Terms and Conditions, e.g. texts, pictures, videos are no longer connected to your user account after deletion. Since DocCheck cannot verify that any documents you have published contain personal information, you must notify us separately if you also want to delete those documents. We kindly ask you to give this notice along with your request to delete your account, otherwise we will not be able to identify your documents clearly.
Your right to data deletion is based on Art. 17 GDPR.
11.4 Right to restriction of processing
You have the right to obtain restriction of data processing if any of the following conditions apply:
If one of the above conditions is met and you want to restrict the personal data stored by us, you can contact our data protection officer or our customer support at any time. Our data protection officer or another employee will set the restriction of processing into effect.
Your right to restriction of processing is based on Art. 18 GDPR.
11.5 Right to data portability
You have the right to receive your personal information provided to us in a structured, common and machine-readable format. This includes the right to transfer this data to another entity without hindrance by us, provided that (i) the processing is based on the consent pursuant to Art. 6 para. 1 letter a) GDPR or Art. 9 para. 2 letter a) GDPR or based on a contract pursuant to Art. 6 para. 1 letter b) GDPR; and (ii) the processing is carried out by automated means, unless the processing is necessary for the performance of a task in the public interest or in the exercise of public authority, which has been assigned to us.
In addition, when exercising your right to data portability, you have the right to obtain that personal data be transmitted directly from one controller to another, as far as technically feasible and provided that this does not affect the rights and freedoms of others.
Your right to data portability is based on Art. 20 GDPR.
11.6 Right to object
You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data pursuant to Art. 6 para. 1 letters e) or f) GDPR. This also applies to profiling based on these provisions.
We will not process personal information in the event of an objection unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or serve to assert, exercise or defend legal claims.
If we process personal data for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
In addition, you have the right, on grounds relating to your particular situation, to object the processing of your personal data for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 para. 1 GDPR unless such processing is necessary to fulfill a public interest task.
To exercise the right to object, you can contact our data protection officer or our customer support at info(at)doccheck.com at any time. You are also free, in the context of the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right of objection by means of automated procedures using technical specifications.
Your right to object is based on Art. 21 GDPR.
11.7 Automated decisions on a case-by-case basis, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for entering into, or the performance of, a contract between you and us, or is permitted by EU or Member State law to which we are subject, and that law contains adequate measures to safeguard your rights and freedoms and legitimate interests, or is made with your explicit consent.
If the decision is necessary for the conclusion or performance of a contract between you and us, or if it is made with your explicit consent, we will take reasonable steps to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain the intervention of a person from our company, to express your point of view and to contest the decision.
If you wish to assert rights relating to automated decisions, you can contact our data protection officer or another member of our staff at info(at)doccheck.com at any time.
These rights are based on Art. 22 GDPR.
11.8 Right to revoke your consent
You have the right to revoke consent to the processing of personal data in whole or in part at any time.
The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
If you wish to exercise your right to withdraw consent, you can contact our data protection officer or another member of our staff at any time. You will find the contact details above this privacy policy, immediately before the summary.
Your right to revoke a consent granted under data protection law is based on Art. 7 para. 3 GDPR.
11.9 Right to lodge a complaint
You have the right to he right to lodge a complaint with a supervisory authority.
This right is based on Art. 56 para. 2 GDPR.
12. Changes to this Privacy Policy
DocCheck reserves the right to change this data protection declaration at any time in compliance with the legal regulations and will - if this is necessary - refer to changes in an appropriate place. If necessary, DocCheck will also obtain your consent to changes to this privacy policy.
The current version of this privacy policy can be found here at any time.
Last change: 03/2024
