Privacy policy

This privacy policy provides information pursuant to Art. 13 and 14 GDPR on the processing of personal data. It distinguishes between the public marketing website and the logged-in Psymira practice software.

For patient data, the respective practice acts as the controller; Gleevity GmbH processes these data on its behalf pursuant to Art. 28 GDPR. Gleevity GmbH is itself the controller for the website, the contract account, billing, contact and its own secure operation of the service. Insofar as we do not obtain personal data directly from the data subject but via the customer (the practice), they originate from this source (Art. 14 GDPR).

1. Controller

Gleevity GmbH
Kolonnenstr. 8
10827 Berlin
Germany

Represented by: Ronny Laudien, Managing Director
Email: support@psymira.de
Phone: +49 30 29045266

2. Data protection officer

You can reach our data protection officer at datenschutz@psymira.de.

3. Visiting the public website

The public website is delivered via Firebase Hosting. When the website is visited, the hosting infrastructure processes technically necessary connection and log data. These may include the IP address, time, requested resource, referrer, browser and device information as well as status and error data. The processing serves the secure delivery, error analysis, prevention of misuse and stability of the offering.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and trouble-free operation of the website. Patient, diagnosis, session, crisis or free-text data do not enter the hosting logs.

4. Necessary browser storage and optional measurement services

Optional analytics and marketing services are loaded only after your express consent. Without consent, no corresponding cookies are set and no third-party scripts are executed; the initial consent status remains “denied” (Google Consent Mode). You can change or withdraw your choice at any time with effect for the future via the privacy settings in the page footer.

If you have given your consent, we use – where configured – Google Tag Manager and, through it, Google Analytics 4 for pseudonymous audience measurement; Meta Pixel for measuring marketing and campaign contacts; and a pseudonymous first-party campaign attribution of our own without third-party providers. Pseudonymous usage and interaction data are processed; special categories of personal data (in particular health data) are not transmitted to these services.

The providers are Google Ireland Limited and Meta Platforms Ireland Limited. Processing may take place in the USA. The transfer mechanism is primarily the adequacy decision EU-U.S. Data Privacy Framework — Google has named it since 1 September 2023 for transfers in the context of its advertising and analytics services, and Meta Platforms, Inc. is certified under it —, supplemented by the EU Standard Contractual Clauses together with the respective data processing terms of the providers. The legal basis for storing and reading information on your terminal device is § 25 para. 1 TDDDG (German Telecommunications Digital Services Data Protection Act), and for the subsequent processing Art. 6(1)(a) GDPR (consent).

Technically necessary settings may be stored on the terminal device, for example the consent decision or a display preference. Insofar as storage is necessary for the provision expressly requested, it takes place pursuant to § 25 para. 2 no. 2 TDDDG; the subsequent processing is based, depending on the purpose, on Art. 6(1)(b) or (f) GDPR.

These measurement services are not used in the logged-in area (app.psymira.de).

5. Contacting us

When you contact us by email or telephone, we process the information transmitted in order to answer the enquiry and, where applicable, to carry out pre-contractual measures. Depending on the matter, the legal basis is Art. 6(1)(b) or (f) GDPR; our legitimate interest lies in handling business enquiries in a traceable manner.

The contact form transmits name, email address, name of the practice, the selected matter and the message to the configured contact endpoint; in the case of a registration of interest for the launch, additionally a voluntary statement on the patient structure of the practice (predominantly privately insured, predominantly insured under statutory health insurance, or mixed). Sending takes place via the email service provider ALL-INKL.COM – Neue Medien Münnich (SMTP). Please do not transmit any patient, diagnosis, session, crisis or other treatment data via the contact form. Contact enquiries are kept until they have been finally dealt with and then for six months, after which they are deleted, unless there is a statutory retention obligation; for a registration of interest, the handling is only completed with our notification that registration has opened, so that the six-month period only starts from that point in time.

6. Registration, contract and practice administration

For registration, conclusion of the contract and use of Psymira, we process in particular name, practice and contact data, email address, plan, subscription status, billing data as well as technical account and usage data. The processing takes place for the initiation and performance of the contract pursuant to Art. 6(1)(b) GDPR and for compliance with legal obligations pursuant to Art. 6(1)(c) GDPR.

Authentication takes place via Firebase Authentication with email and password. In the process, the email address, password hash, authentication and session data are processed. Patient and treatment data are not transmitted to Firebase Authentication. For the account of the practice as contracting party, which is created at registration and serves the contract and billing, we are ourselves the controller (Art. 6(1)(b) GDPR). The sign-in of the users in the software – including the employees whom the practice creates itself – is processed by us on behalf of the practice under the data processing agreement; Firebase Authentication is listed there as a sub-processor (section 11).

For contract handling, the application sends transactional service emails (e.g. reminders in the context of contract termination and exit/archive notices) to the practice email address on file via the email service provider ALL-INKL.COM – Neue Medien Münnich. The legal basis is Art. 6(1)(b) GDPR.

If, following the eligibility check, Psymira has not yet been approved for your practice, in particular for practices with a statutory health insurance licence (Kassenzulassung), you as the practice lead (Praxisleitung) can voluntarily state which plan you are interested in, in which KV district (region of the Association of Statutory Health Insurance Physicians) your practice is located and whether we may contact you for a short conversation, by telephone number if you wish. We use this information to notify you of the approval or of our decision against it, and to decide whether and when we create the conditions for your constellation. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). For contacting you for a conversation, it is your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time. If the registration link contains an identifier, for example from a letter, we store it with your practice in order to measure the effect of our outreach (Art. 6(1)(f) GDPR, legitimate interest in measuring success).

7. Patient data and special categories of personal data

Within the practice software, the respective practice processes patient and health data as the controller. These may include pseudonymous codes, master data, diagnoses, session notes, audio recordings, transcripts, summaries, draft applications, crisis protocols and documents. The practice decides on legal bases, information obligations, access rights, retention and deletion.

Gleevity GmbH processes these data as a processor exclusively on documented instructions and on the basis of a contract pursuant to Art. 28 GDPR. The practice remains responsible in particular for the lawfulness of the processing of health data pursuant to Art. 9 GDPR (for example Art. 9(2)(h) GDPR in conjunction with § 22 BDSG, German Federal Data Protection Act) and for requirements under professional law.

8. Audio recordings and transcription

Audio recordings are created in the browser after the microphone has been enabled, transmitted in encrypted form and stored in Google Cloud Storage in Frankfurt. Transcription is carried out with Google Cloud Speech-to-Text; the processing takes place in the EU. Audio file and transcript can be deleted separately. Audio files are deleted automatically after successful transcription, but no later than after 30 days.

Enabling the microphone in the browser does not replace the legal consent of the persons recorded. Before each recording, the practice must check its lawfulness, obtain any required express consent of all persons recorded and maintain a withdrawal and deletion process.

9. AI processing

Psymira uses Google Vertex AI in europe-west3 (Frankfurt) for approved AI functions, in particular summaries and editable draft applications. Before AI calls, configurable rules for identifier filtering/data reduction are applied; the models receive pseudonymous codes instead of plain names, insofar as the rules are configured correctly and the content is captured accordingly. This is not pseudonymisation within the meaning of Art. 4(5) GDPR: free text (e.g. notes, transcripts) may still contain identifying information, the control of which lies with the practice.

Uploaded documents are read by text recognition (OCR) with Google Document AI in the EU before further processing; the recognised text is transferred into the treatment documentation.

AI outputs are drafts. The professional review, editing and decision remain with the psychotherapist. The AI functions do not serve diagnosis, therapy or triage; they are not a medical device and not a high-risk AI system within the meaning of the AI Act. Under the applicable Google Cloud terms, customer data are not used for training or fine-tuning models without prior permission or instruction.

10. Payment processing

Payments and subscriptions are processed via Stripe. In the process, in particular the name of the practice, email address, billing address, payment data, plan and subscription status are processed. Payment data are processed directly by Stripe; in its own system, Psymira stores in particular the Stripe customer ID and the subscription status. The legal basis is Art. 6(1)(b) GDPR and, for legally required records, Art. 6(1)(c) GDPR.

11. Recipients and sub-processors

For the processing on behalf of the practice, the provider uses Google Cloud (hosting, database, storage, logs), Google Cloud Speech-to-Text, Google Vertex AI and Google Document AI (in each case patient/treatment data) as well as Firebase Authentication (account/sign-in data, no patient/treatment data); these are listed as sub-processors in the data processing agreement (Annex 3). Firebase Authentication also serves the sign-in to the account of the practice as contracting party, for which we are ourselves the controller (section 6), and processes data in the USA (transfer basis: EU-U.S. Data Privacy Framework, supplemented by the EU Standard Contractual Clauses; see section 12). The other services named below (payment, clinic finder, website contact) process neither patient data nor commissioned data and are used for the provider’s own processing as controller. The contracts concluded for the specific production account are decisive.

12. Transfers to third countries

For Firebase Authentication and the clinic finder (Google Maps Platform), processing may take place in the USA. The transfer mechanism is primarily the adequacy decision EU-U.S. Data Privacy Framework (Art. 45 GDPR; Google’s “Alternative Transfer Solution”, Google LLC is certified under it), supplemented by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with the respective Google data processing terms. An adequacy decision can be amended, suspended or repealed; for this reason, a contractual fallback mechanism is in place alongside it throughout, and we check the certification status of the recipients before productive operation and regularly thereafter. Only authentication data are transmitted to Firebase Authentication, and only the address entered and a fixed search query to Google Maps Platform; patient and treatment data are not transmitted.

The processing of patient/commissioned data by the sub-processors under section 11 takes place in the EU; the exception is Firebase Authentication (account/sign-in data, no patient data), which is operated from US data centres (paragraph 1). Even with EU regions, limited support, security or sub-processor access from third countries cannot be completely ruled out, depending on the provider terms; it takes place only in accordance with the applicable Google Cloud contract documents and, where necessary, on the basis of the EU-U.S. Data Privacy Framework or, supplementarily, the EU Standard Contractual Clauses.

13. Storage period and deletion

14. Security and access logging

The measures implemented include HTTPS/TLS, encryption of cloud storage, Firebase JWT verification, binding of data queries to the practice and role, identifier filtering/data reduction before AI calls, rate limiting, audit logging as well as daily backups with point-in-time recovery. The recoverability of the backups is verified by documented restore tests.

Administrative access to productive data is restricted to a narrowly limited group of persons, takes place only in exceptional cases and is logged. No external support provider with database access is used. The complete technical and organisational measures are documented in Annex 2 to the data processing agreement.

15. Rights of data subjects

Within the scope of the statutory requirements, data subjects have the rights of access, rectification, erasure, restriction of processing, data portability and objection. Consent that has been given can be withdrawn with effect for the future.

For patient data, the treating practice is, in principle, the first point of contact, as it decides on the purposes and legal bases; we support the practice within the framework of the data processing agreement. Please address enquiries about processing for which we ourselves are the controller to support@psymira.de.

16. Automated decision-making

There is no decision based solely on automated processing within the meaning of Art. 22 GDPR that produces legal effects or similarly significantly affects you. AI functions produce drafts only; the professional review and decision are always made by the psychotherapist.

17. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority competent for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61, 10555 Berlin
https://www.datenschutz-berlin.de/

18. Data protection impact assessment and changes

For the processing of special categories of personal data and the use of generative AI, the controller carries out a data protection impact assessment pursuant to Art. 35 GDPR and keeps it up to date. This policy is adjusted when services, data flows, legal bases, retention periods or providers change.