Privacy Notice for Patients pursuant to Art. 13, 14 GDPR in connection with the recording and storage of the treatment conversation

For the purpose of efficient documentation of the treatment conversation, we use the software 'Aeirmed'. This software records the treatment conversation between you and the attending physician and then summarizes it using AI technology. Below we inform you about the processing of your personal data in connection with 'Aeirmed'.

1. Who is responsible for processing my data and whom can I contact?

The responsible party is the medical practice of the attending physician. Reference is made to the general data protection declaration of the practice.

In addition, you can also contact our data processor 'Aeirmed' at the following contact details:

Aeirmed
Neherstraße 1, 81675 Munich
support@aeirmed.com
Phone: +49 162 2171920.

2. Which of my data is processed and how?

Using 'Aeirmed', we record the spoken word during the treatment conversation between you and the attending physician in order to create an AI-based summary of the treatment conversation for the purpose of medical documentation.

The recording begins once the attending physician informs you that the conversation is being recorded and, in any case, only after your consent has been given. The recording ends with the notice that the recording has been completed.

The recorded conversation is summarized during the recording and displayed in digital form on the end device of the attending physician. For this purpose, 'Aeirmed' uses artificial intelligence in the form of so-called Large Language Models (for details, see Section 3).

An AI-based, automated diagnosis or suggestion for a diagnosis based on the recording expressly does not take place. After the treatment conversation, and at the latest after 30 days, the recording of the spoken word is deleted. Only the summary of the treatment conversation remains stored.

In summary, we process all personal data mentioned during the treatment conversation with you, and potentially in particular:

• Personal master data (e.g. first name, last name, birth name, address, gender, age, date of birth, place of birth, marital status, nationality);

• Administrative data (e.g. email address, type of insurance (private or statutory), health insurance / insurance provider, insurance number, general practitioner / referring and follow-up physicians);

• Treatment data (e.g. data from your medical history, diagnosis, treatment and rehabilitation measures);

• Other health-related data (e.g. previous illnesses, allergies, prior treatments and procedures).

Furthermore, we process your scanned digital signature for the purpose of documenting your consent.

3. Which processing steps are supported by artificial intelligence?

While the treatment conversation is being recorded, artificial intelligence processes the spoken word in real time. The AI used belongs to the category of 'Large Language Models' (LLMs), which are capable of understanding and immediately summarizing spoken or written language. An AI-based evaluation of the spoken word in the sense of a potential diagnosis does not take place. Your data is also not used to further train or improve the 'Language Models' used.

4. For what purposes and on what legal basis are my data processed?

We process your data for the purpose of documenting the treatment conversation.

As the legal basis for the processing we rely on

• the recording of the treatment conversation and the AI-based summary of this recording on Art. 9 para. 2 lit. a) (consent);

• the subsequent storage of the summary on Art. 9 para. 2 lit. h), para. 3, para. 4 GDPR in conjunction with §§ 630a ff, 630f BGB).

You may revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent until revocation.

We process your digital signature for the purpose of proving the given consent. In this respect, we rely on Art. 7, 5 para. 2 GDPR.

5. Am I obliged to consent to the recording of the conversation?

No. The recording of the treatment conversation and the summarization of the spoken word by 'Aeirmed' is voluntary. You may revoke the consent you have given at any time – even during treatment – without affecting the legality of the processing carried out on the basis of the consent until revocation. This does not result in any disadvantages for you, especially with regard to medical treatment.

6. How long will my data be stored?

The recorded spoken word will be deleted immediately after the written summary of the treatment conversation has been created – regardless of whether the consent is revoked. Thus, only the written summary of the treatment conversation remains after the end of the treatment conversation. We generally store this for a period of 10 years (see § 630f para. 3 BGB). In individual cases, in particular if the data is required for the exercise or defense of legal claims, we store the data for up to 30 years (see § 199 para. 3 No. 2 BGB).

7. To whom are my data transferred? Will my data also be processed outside the EU/EEA?

Your data will only be disclosed to internal departments that need it to fulfill their respective tasks (in particular for the purpose of documenting the treatment conversation and subsequently for medical treatment).

External parties only receive your data if this is legally required or necessary for the fulfillment of our contractual obligations. An external recipient here is in particular 

• the provider of the software 'Aeirmed' as a data processor.

Your personal data is generally not transferred to recipients located in countries outside the European Union (EU) and the European Economic Area (EEA) whose laws may not guarantee an adequate level of data protection comparable to that of the EU/EEA. If, in exceptional cases, your personal data is transferred to so-called third countries, we will comply with the relevant requirements of the GDPR pursuant to Art. 44 et seq.

8. What rights do I have and how can I exercise them?

You have the right to:

• request information about the personal data processed concerning you and to receive a copy of this data (right of access pursuant to Art. 15 GDPR);

• request the correction of inaccurate data and, taking into account the purposes of the processing, the completion of incomplete data (right to rectification pursuant to Art. 16 GDPR);

• request the deletion of your data for legitimate reasons (right to erasure pursuant to Art. 17 GDPR);

• request the restriction of the processing of your data, provided the legal requirements are met (right to restriction of processing pursuant to Art. 18 GDPR);

• receive the data you have provided in a structured, commonly used and machine-readable format and to transfer this data to another controller or, if technically feasible, to have it transferred by us (right to data portability pursuant to Art. 20 GDPR); and

• not be subject to a decision based solely on automated processing, provided the legal requirements are not met (Art. 22 GDPR).

You also have the right to object to the processing of your data carried out in the public interest or on the basis of a legitimate interest of us or a third party for reasons arising from your particular situation (right to object pursuant to Art. 21 para. 1 GDPR).

If the processing of your data is based on consent, you have the right to revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent until revocation.

To exercise your rights or to revoke your consent, please contact us using the contact details provided in Section 1. In addition, without prejudice to other legal remedies, you have the right to lodge a complaint with a supervisory authority at any time:

The Bavarian Data Protection Authority, the State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
+49 (0) 981 180093-0

Status: May 2025