Data processing agreement (DPA) pursuant to Art. 28 GDPR

This data processing agreement (“DPA”) forms part of the main contract on the use of the Psymira software and governs the processing of personal data that the processor processes on behalf of the controller.

1. Contracting parties and incorporation

Processor: Gleevity GmbH, Kolonnenstr. 8, 10827 Berlin, Germany, represented by its managing director Ronny Laudien (hereinafter “Provider”). Contact for data protection matters: support@psymira.de (data protection officer: datenschutz@psymira.de).

Controller: the psychotherapy practice or institution designated in the main contract or at registration, with the company and contact data stored there (hereinafter “Customer”). The Customer is the controller within the meaning of Art. 4(7) GDPR for the patient and treatment data processed in Psymira.

This DPA is incorporated and accepted at registration (confirmation by checkbox in the registration process). The accepted version is stored with its version and time and is made available to the Customer for retrieval and download before acceptance.

2. Subject matter, nature, purpose and duration

(1) The subject matter is the provision of the web-based practice software Psymira. The Provider processes personal data exclusively for the provision of this service and on documented instructions of the Customer.

(2) Purposes of the processing: session documentation, audio recording and transcription, text recognition (OCR) on uploaded documents, AI-supported summaries and draft applications, crisis protocol, clinic finder, patient and practice administration as well as export and deletion functions.

(3) The term corresponds to the main contract. Obligations relating to confidentiality, return, deletion, support and evidence continue to apply beyond the end of the contract insofar as necessary.

3. Categories of data and data subjects

(1) Categories of data: patient master data or pseudonymous codes, health and diagnosis data, session notes, audio recordings, transcripts, summaries, application and report content, crisis documentation, uploaded documents as well as technical processing and log data. Special categories of personal data pursuant to Art. 9 GDPR (health data) are also processed.

(2) Data subjects: patients and clients of the Customer as well as users and employees of the Customer.

4. Instructions and areas of responsibility

(1) The Provider processes personal data only on documented instructions of the Customer, unless a legal provision requires processing; in this case, the Provider informs the Customer of this before the processing, insofar as legally permissible. The initial instruction results from the main contract and the use of the software; further instructions are given verifiably via authorised contact persons of the Customer (also by email to support@psymira.de). If an instruction appears unlawful, the Provider informs the Customer and may suspend its execution until it has been clarified.

(2) Legal bases: The Customer determines and documents the legal bases of the processing it initiates. It obtains consent only insofar as consent is required for the respective processing operation; the processing of health data in the treatment context can in particular be based on Art. 6(1)(b) in conjunction with Art. 9(2)(h) GDPR (and, where applicable, § 22 BDSG, German Federal Data Protection Act); for statutory documentation and retention obligations, Art. 6(1)(c) GDPR in conjunction with Art. 9(2)(h) GDPR may in particular be considered. The Provider does not claim that every processing of health data is based on consent.

(3) Audio recordings: Before the start, the Customer checks on its own responsibility both the permissibility under data protection law and the permissibility under criminal and professional law (in particular § 201 StGB, German Criminal Code, on the confidentiality of the privately spoken word) and documents any required consents. Enabling the microphone in the browser does not replace this check. A withdrawal does not in every case lead to the immediate deletion of treatment documentation that has already been created; statutory documentation and retention obligations as well as other legal bases remain unaffected.

5. Obligations of the Provider

The Provider undertakes in particular: processing only on behalf; obligation of the persons authorised to access the data to confidentiality; implementation and regular review of the technical and organisational measures pursuant to Art. 32 GDPR (Annex 2); support of the Customer with data subject rights, data protection impact assessment and prior consultation; notification of personal data breaches (section 11); provision of appropriate evidence (section 12); handling of requests for information by authorities in accordance with Annex 6.

6. Confidentiality and professional secrecy (§ 203 StGB)

(1) The Provider obliges all persons entrusted with the processing to maintain confidentiality; the obligation continues beyond their activity.

(2) Because of the particular sensitivity of psychotherapeutic content subject to professional secrecy under § 203 StGB, the Provider binds the contributing persons and the relevant sub-processors into the chain of confidentiality as “other contributing persons” within the meaning of § 203 para. 3 StGB, limits access to the necessary extent, logs administrative access and supports the Customer in its review under professional law.

(3) Information about access by the Provider. If the Provider or a person engaged by it accesses commissioned data for reading or writing outside the Customer’s use of the software, the Provider informs the Customer of this in text form (Textform) to the address of the practice lead on file. This also applies to access on the Customer’s instructions, for example in the case of a support request; the information can then be given with the answer to the request. The information states the reason, start and duration, the state from which access took place, the nature (reading, writing, export) and extent (categories of data concerned and number of records) of the access as well as the retention period of the logs or copies created in the process. It is given without undue delay, no later than 72 hours after the start of the access. If a legal provision or an official order prohibits the information, it is not given as long as the prohibition exists (Annex 6 para. 2 (c)) and is provided subsequently as soon as the prohibition ceases to apply.

7. Technical and organisational measures (summary; details in Annex 2)

The Provider implements measures appropriate to the risk. The statements correspond to the status actually implemented:

• Transmission: application data are transmitted exclusively via TLS 1.2 or higher; HTTPS enforcement (HSTS). Connection attempts with older TLS versions are rejected by the application.
• Storage: encryption of data at rest by the cloud provider according to its standard (Google-managed keys, AES-256).
• Authentication: email/password via Firebase Authentication; minimum password length of 8 characters with complexity requirements (upper/lower case letters and special characters); protection mechanisms against automated sign-in attempts.
• Authorisation: role-based authorisation model (administrator, practice lead, therapist) according to the least privilege principle; administrative access to productive data only for the reasons named in Annex 2, logged and notified in accordance with section 6 para. 3.
• Tenant separation: practice-related access control enforced at application level (authorisation on the basis of practice membership).
• Identifier filtering/data reduction: before AI calls, configurable rules for replacing recognised identifiers are applied; free text (e.g. notes, transcripts) may still contain identifying information, the control of which lies with the Customer.
• Availability/backup: regular, encrypted backups with point-in-time recovery (retention 7 days); recoverability is tested.
• Logging/monitoring: automated monitoring with alerting; logging of access to patient data (retention 12 months, then deletion).
• Network security: protection via the edge infrastructure of the cloud provider as well as application-side rate limiting.
• Deletion: secure deletion procedures in accordance with Annex 4.

8. Sub-processors

(1) The Customer grants general authorisation for the sub-processors named in Annex 3. Annex 3 lists the service providers that process commissioned data on behalf. The authentication of the practice users (Firebase Authentication) takes place on behalf of the controller; the service is listed as a sub-processor in Annex 3. Further service providers that the Provider uses under its own or mixed responsibility (e.g. payment, map and email services) are described in the privacy policy and are not the subject of this annex.

(2) By contract or another legal act under Union or Member State law, the Provider imposes on each sub-processor the same data protection obligations on which this DPA is based pursuant to Art. 28(3) GDPR, in particular sufficient guarantees for appropriate technical and organisational measures. If the sub-processor fails to fulfil its data protection obligations, the Provider remains liable to the Customer for the performance of the sub-processor’s obligations (Art. 28(4) GDPR).

(3) The Provider gives verifiable notice of changes at least 30 days before they take effect. The Customer may object within 14 days on specifically substantiated grounds under data protection law. If the Provider cannot resolve the objection (alternative service, deactivation of the function concerned), the Customer has an extraordinary right of termination.

9. Transfers to third countries

The processing of the commissioned data by the sub-processors under Annex 3 takes place in principle in the EU; persistent storage takes place in the region europe-west3 (Frankfurt). Exception: Firebase Authentication (account/login data of the practice users, no patient data) is operated exclusively from US data centres; the transfer basis is the EU-U.S. Data Privacy Framework (Google’s Alternative Transfer Solution since Sept 2023; Google LLC listed); EU Standard Contractual Clauses in accordance with the Google Cloud DPA, Appendix 3 – European Data Protection Law, § 4.1 Restricted Transfers as a fallback (Art. 44 et seq.). Any support, security or sub-processor access from third countries on the part of the provider takes place only in accordance with the applicable Google Cloud contract documents; where necessary, EU Standard Contractual Clauses (SCC) are incorporated. Transfers outside the EEA take place only under the conditions of Art. 44 et seq. GDPR.

10. Data subject rights

The Provider supports the Customer with appropriate technical and organisational measures in fulfilling the rights of access, rectification, erasure, restriction, portability and objection, in particular through export and deletion functions.

11. Personal data breaches

The Provider notifies the Customer of breaches without undue delay, with the internal target of a first notification within 24 hours of becoming aware of them, insofar as operationally feasible. The first notification contains at least the nature and extent, the categories of data concerned, the likely consequences and the measures taken or proposed; it is supplemented on an ongoing basis. The notification channel and escalation contacts are set out in Annex 5.

12. Audits and evidence

On request, the Provider provides appropriate information and evidence; audits take place primarily through information and remote evidence, with reasonable advance notice, while safeguarding security, confidentiality and the rights of other customers. Insofar as remote evidence is not sufficient for the audit or there is a specific reason, audits including appropriate on-site inspections remain unaffected (Art. 28(3)(h) GDPR). The costs are borne by the Customer, unless the audit was caused by a breach of duty by the Provider.

13. Return, change of provider and deletion

(1) The Customer controls the professionally required retention of its patient documentation; the ten-year period under § 630f BGB (German Civil Code) is an obligation of the Customer, not a storage decision of the Provider’s own. The Provider provides export functions.

(2) Procedure at the end of the contract or trial period: The Customer first has 30 days of read-only access with the option to export (reminders on days 7, 14 and 28). The further procedure depends on whether there was a paid subscription:

a) Pure trial period (no paid subscription booked): Here too, the Customer chooses between (i) export/return (via the export function during the 30-day read-only period) with subsequent deletion and (ii) immediate deletion (right to choose pursuant to Art. 28(3)(g) GDPR). Without a deviating instruction, the account and the associated productive data are deleted automatically after the 30 days have expired (no final archive). The deletion takes effect immediately; technically, it remains reversible for seven days through the recovery function of the object storage, after which it is final (details in Annex 4). Earlier (accelerated) deletion can be requested at any time by instruction to support@psymira.de (after verification of identity).

b) Formerly paid subscription: After the 30 days have expired, access is deactivated and an encrypted final export is created automatically and kept securely. At the end of the contract, the Customer chooses between (a) return — provision of the final export with subsequent deletion — and (b) immediate deletion without provision (right to choose pursuant to Art. 28(3)(g) GDPR). In the case of option (b), the final export is deleted without undue delay without being provided. Option (b) and any accelerated deletion compared with the standard periods are exercised by instruction to support@psymira.de and are carried out after verification of identity (paragraph 3). In the case of option (a) or without a deviating instruction, the final export is kept for a further 90 days and provided to the Customer upon an identity-verified request in accordance with paragraph 3. After the 90 days have expired, productive data and the final export are deleted; the deletion takes effect immediately and is final after seven days have expired (Annex 4); the deletion is controlled by an internal approval in order to rule out accidental deletions, and is carried out promptly after the period has expired. Backup copies are purged within the backup rotation (7 days).

(3) Hand-over of the final export (obligation to return, Art. 28(3)(g) GDPR). The provision of the final export under paragraph 2 (b) requires verification of the identity of the requesting practice. The export is handed over as a password-protected, encrypted archive; the password is transmitted via a channel separate from the download link. Each provision is logged. At the practice’s request, the Provider can reactivate the practice’s access before the deletion periods have expired; the data remain unchanged, as nothing is removed until deletion has been confirmed.

(4) The export takes place in structured, commonly used, machine-readable formats; the details (categories, formats, exceptions) are governed by the data export and format register in accordance with the EU Data Act; it can be accessed in the application under “Practice administration → Subscription”. Provision takes place as an AES-256-encrypted archive; the password is handed over separately from the archive. Opening it requires a program that supports AES-encrypted ZIP archives (e.g. 7-Zip, Keka); the standard tools included in the operating system are not sufficient for this. The corresponding provisions of the terms and conditions apply to a change of provider.

14. Order of precedence and amendments

In matters of data protection law relating to processing on behalf, this DPA takes precedence over the terms and conditions. Amendments require text form with reasonable advance notice; the version accepted in each case is kept on record with its version. An amendment does not tacitly override a contract version that has already been accepted.

---

Annex 1 – Description of the processing

• Product/purpose: practice software Psymira (section 2).
• Categories of data / data subjects: section 3.
• Primary region: europe-west3 (Frankfurt, Germany).
• Transcription: Google Cloud Speech-to-Text (processing in the EU).
• Text recognition (OCR): Google Cloud Document AI (processing in the EU); the recognised text is transferred into the treatment documentation.
• AI processing: Google Vertex AI (europe-west3); outputs are drafts; no use of the content for training models.
• Duration: term of the main contract plus the return/deletion phase (section 13).

Annex 2 – Technical and organisational measures (Art. 32 GDPR)

This annex specifies the measures named in section 7. Only measures that have actually been implemented are promised. A distinction is to be made between the Provider’s own measures (application, configuration, organisation) and measures of the cloud provider (physical and infrastructure security); the Provider does not operate any server hardware of its own. The version and revision status of this annex are kept on record.

Annex 3 – Sub-processors (commissioned data)

Not in this annex (own/mixed responsibility, no processing of patient data on behalf; see the privacy policy): Stripe (payment), Google Maps Platform (clinic finder), ALL-INKL.COM – Neue Medien Münnich (website contact).

Annex 4 – Retention and deletion

Annex 5 – Contact persons and notification channels

• Data protection/data subject enquiries: support@psymira.de
• Security/incident notifications: security@psymira.de
• Data protection officer: can be reached at datenschutz@psymira.de
• Support: support@psymira.de

Annex 6 – Handling of requests for information by authorities

(1) Scope. This annex describes how the Provider handles lawful requests from authorities for information or disclosure that are addressed to it and concern the Customer’s commissioned data. Requests addressed to the Customer are handled by the Customer as the controller; the Provider supports it in this within the framework of section 10.

(2) Procedure. The Provider a) checks the legal validity of the request and the competence of the requesting authority, b) limits any disclosure to the strictly necessary extent (data minimisation), c) informs the Customer concerned in advance, insofar as this is legally permissible, d) discloses data only in a controlled and logged manner — as a targeted, encrypted export of the records concerned, e) documents the process in an internal register.

(3) Technical options. Possible are a tenant-specific export of the data of a specific practice or a specific patient as well as the provision of the access logs for treatment data (retention 12 months, Annex 4).

(4) Limits promised by the Provider. The Provider grants no blanket and no direct access to the database or infrastructure. It does not secretly pass on anything beyond the extent determined under paragraph 2 (b). It does not access data that the Customer has already deleted outside the periods documented in Annex 4. The commissioned data are stored encrypted and in the EU regions named in Annex 1; third-country references are governed exclusively by section 9.

(5) Maintenance. The Provider keeps these procedures up to date for each service and reviews them for accuracy at least once a year. Changes are notified in accordance with section 14.