General terms and conditions (B2B)

These general terms and conditions (hereinafter “Terms”) govern the use of the web-based practice software Psymira. For the processing of patient and treatment data, the data processing agreement (DPA) applies in addition and, in matters of data protection law, with precedence.

§ 1 Provider, scope and customer group

(1) The provider is Gleevity GmbH, Kolonnenstr. 8, 10827 Berlin, represented by its managing director Ronny Laudien (hereinafter “Provider”). These Terms apply to contracts on the use of Psymira between the Provider and the customer.

(2) The offering is directed exclusively at entrepreneurs (Unternehmer) within the meaning of § 14 BGB (German Civil Code), in particular psychotherapy practices, practice associations and other eligible healthcare institutions. Contracts with consumers are not concluded.

(3) Deviating terms of the customer are hereby rejected; they only become part of the contract if the Provider expressly agrees to them in text form (Textform).

(4) Eligibility check as a prerequisite for productive use. The Provider processes health data on behalf of the customer only if, before the first processing, the customer has completed the information for the eligibility check in full and this results in the outcome “approved”. The background is § 393 SGB V (German Social Code, Book V): the provision is addressed to service providers within the meaning of Chapter Four of SGB V and to the processors acting on their behalf; it ties the processing of social data and health data in cloud computing to additional conditions which are not currently met. The information must be provided separately for the practice and for each treating person.

(5) Assurance by the customer. The customer assures that its information for the eligibility check is accurate and complete and that it uses Psymira exclusively within the scope of the activity stated in that check. This assurance does not replace the data processing agreement; it applies alongside it.

(6) Blocking. If the eligibility check does not result in the outcome “approved”, or if that outcome subsequently ceases to apply, the Provider blocks the processing of health data for the account or the practice concerned. The blocking also covers read access, because retrieving and holding data available already constitutes processing. Data export expressly remains possible, so that the customer can take over its documentation and fulfil its retention obligations in another system. In this case, the Provider does not delete any data without the customer’s involvement; the details are governed by § 15.

§ 2 Subject matter of the contract and scope of services

(1) Psymira is web-based practice software for documentation, practice organisation and professionally controlled AI support. The plan selected at the conclusion of the contract, the service description incorporated at that time and any individual agreements determine the scope of services owed.

(2) The functions include in particular: manual session documentation as well as audio recording and transcription, summaries of individual and several documented sessions, editable drafts in the application assistant, a structured crisis protocol and clinic finder, patient and practice administration as well as export and deletion functions.

(3) Roadmap functions, previews and functions expressly labelled as beta are only owed if they form part of the incorporated service description.

§ 3 AI functions and professional responsibility

(1) AI functions produce exclusively suggestions and editable drafts. They do not constitute a diagnosis, therapy recommendation or emergency decision and are not a medical device.

(2) The customer must review all AI outputs before professional use, amend them where necessary and make the final decision itself. It may not adopt AI outputs without review in treatment decisions, applications, reports or crisis measures. Psymira does not replace any professional duty of care, any legally required documentation or any existing emergency procedure.

(3) The Provider points out the required AI literacy of the persons entrusted with the AI functions within the meaning of Art. 4 of the AI Act.

§ 4 Registration and conclusion of the contract

(1) Use requires an account with truthful practice and contact data. The customer protects its access data, assigns user accounts only to authorised persons and reports unauthorised use without undue delay.

(2) The contract for a paid plan is concluded upon completion of the Stripe checkout. Before completion, the customer is shown an order overview with plan, price, tax and billing interval as well as the incorporated contract documents (these Terms and the DPA); the customer expressly agrees to the plan price and to the conclusion with an obligation to pay.

(3) The version of these Terms and of the DPA accepted in each case is stored with its version; the customer receives a confirmation of the conclusion of the contract in text form (email). Registration and any trial period alone do not establish a paid contract.

§ 5 Trial period

(1) Insofar as a free trial period is offered, its duration, the usage volume included and the transition to a paid plan result from the description shown at registration. A paid contract only arises if the customer has clearly agreed to the price and to the conclusion with an obligation to pay pursuant to § 4.

(2) Unused trial volume is not paid out. Misuse, multiple accounts to circumvent restrictions or use outside the intended business purpose may lead to the blocking of the trial period.

§ 6 Prices, taxes and payment

(1) The prices and plan components shown at the conclusion of the contract are decisive. All prices are net plus the statutory value added tax applicable at the time. For customers from other EU member states who provide a valid VAT identification number, the reverse charge procedure applies; in this case, the customer owes the VAT in its state of establishment.

(2) Paid plans are billed monthly in advance for the following billing period in each case. Payments and subscriptions are processed via Stripe Payments Europe, Limited; the regulated payment services are provided by Stripe Technology Europe, Limited. Credit card and SEPA direct debit are currently provided as payment methods.

(3) Invoices, payment method, change of plan and termination are managed via the Stripe Customer Portal or the Psymira interface provided for this purpose. The customer keeps its billing and tax information complete and up to date.

(4) In the event of a change of plan within a current billing period, the difference is taken into account pro rata. Fees already paid for current periods are not refunded pro rata in the event of ordinary termination, unless mandatory law provides otherwise.

§ 7 Default and payment failures

(1) If a payment does not go through, the payment service provider attempts the charge again in the context of automatic retries (Smart Retries). The customer is informed of the failed payment and asked to update its payment data.

(2) If payment is still not made after a reasonable grace period of at least three days, the Provider may, after prior notice, switch access to restricted read-only access. This does not result in any deletion of data. Blocking measures are proportionate and are lifted as soon as the payment arrears have been settled.

§ 8 Usage volume and limits

(1) The usage limits included in the plan (e.g. for transcription or AI functions) result from the incorporated service description.

(2) When a limit has been exhausted, the function concerned is restricted until the end of the billing period or until an upgrade. No automatic overage fees are charged; additional volume is available via an upgrade.

§ 9 Term and termination

(1) The publicly offered standard plans can be terminated monthly. Termination takes place via the Stripe Customer Portal or the termination route offered there and takes effect at the end of the current billing period, unless otherwise agreed at the conclusion of the contract.

(2) The right to extraordinary termination for good cause remains unaffected. Blocking or extraordinary termination by the Provider may be considered in particular in the event of significant security risks, unlawful use, payment default or serious breaches of contract, insofar as this is proportionate.

§ 10 Availability, maintenance and support

(1) The Provider renders the service with commercially reasonable efforts. No fixed availability rate (uptime) is promised; no service credits are granted. Maintenance, security updates, necessary changes to cloud services and unforeseeable disruptions may temporarily restrict availability.

(2) Planned significant maintenance is announced in advance where possible and, where reasonable, scheduled for times of low usage.

(3) Support is provided by email on working days; working days are Monday to Friday with the exception of statutory public holidays at the Provider’s registered office. The Provider promises a first response: for reported operational disruptions that prevent the use of the core functions (sign-in as well as read and write access to the record) within one working day; for other enquiries within two working days. First response means a substantive reply on the status of handling, not the resolution; no resolution time is promised. In the “Praxis” plan, enquiries are handled with priority, without this establishing a shorter time limit.

(4) If the Provider repeatedly and significantly exceeds the first response time promised under paragraph 3, the customer may terminate the contract extraordinarily for good cause. Further claims are governed by § 18.

(5) Incident communication. The Provider publishes significant operational disruptions on the status page (https://www.psymira.de/status) with the start, the component affected, the expected duration, the time of the next update and an indication of whether data are affected. Affected customers are additionally informed by email to the address of the practice lead on file. The status page is operated separately from the application and therefore remains accessible even when the application itself is disrupted. By way of derogation, notifications of personal data breaches are governed by section 11 of the data processing agreement.

(6) Operational target values and incident classes. For the classification of paragraphs 1 to 5, the Provider discloses the following:

a) Availability. For the core functions — sign-in as well as read and write access to the record — the Provider pursues a monthly target availability of 99.5%. The application runtime and object storage are operated across zones; the database is currently operated zonally, and a zone failure is handled via tested point-in-time recovery.

b) Incident classes and first response targets. Incidents are divided into four levels: P1 critical (suspected disclosure of health data, unauthorised administrative or database access) — response immediately, containment within four hours; P2 high (exploitable vulnerability without confirmed exfiltration, circumvention of authentication) — within eight hours; P3 medium (limited disruption without data involvement) — within one working day; P4 low (cosmetic, observation) — in regular operation. The contractually promised first response time under paragraph 3 remains unaffected and takes precedence over these target values.

c) Recovery targets. In the event of data loss due to corruption or erroneous deletion, the Provider aims for recovery within 24 hours with a maximum data loss of one hour; for disruptions at the application level, recovery within eight hours without data loss. For a regional outage of the cloud provider, no recovery target is expressly given, because recovery in that case is not in the hands of the Provider.

(7) Legal nature of the information under paragraph 6. The values stated in paragraph 6 are target values and average considerations; they are not binding in the individual case and do not establish any service commitment. A fixed availability rate and service credits continue not to be granted (paragraph 1), and a resolution time continues not to be promised (paragraph 3). Only the first response time under paragraph 3, the contractual consequence under paragraph 4 and the incident communication under paragraph 5 are bindingly promised. If the underlying operating model changes, the Provider adjusts the information under paragraph 6 and identifies significant changes in text form.

§ 11 Rights of use and permitted use

(1) For the term of the contract, the Provider grants the customer a simple, non-exclusive, non-transferable and non-sublicensable right to use Psymira to the agreed extent for its own business purposes.

(2) The customer remains the holder of all rights to the data and documents it has uploaded. The Provider processes these exclusively for the performance of the contract and in accordance with the data processing agreement.

(3) The Provider does not use customer and patient data to train its own or third-party AI models.

(4) The customer ensures that access data and user accounts are only accessible to authorised persons. Sharing accounts and circumventing technical usage limits are not permitted.

(5) The customer does not use Psymira for unlawful purposes and does not process any content for which it lacks the required legal basis.

§ 12 Obligations of the customer

The customer is in particular obliged

• to process only data for which there is a legal basis and the required information has been provided,
• to assign access rights according to the need-to-know principle and to review them regularly,
• not to enter patient data into support or contact forms of the marketing website,
• to adequately secure its own end devices, browsers, passwords and organisational procedures,
• to observe statutory and professional documentation, retention and deletion obligations,
• to store and protect export files securely itself after downloading them.
• to keep the information for the eligibility check under § 1 paragraph 4 accurate,
• to notify a change in its licensing, authorisation or other status under the law on care provision without undue delay; if the change is foreseeable, no later than 30 days before it takes effect. The lead time serves to complete the data export and the subsequent transfer to another system before the change takes effect,
• to confirm its care provision status again at the Provider’s request, no more than once a year.

§ 13 Audio recordings

(1) The customer may only start audio recordings if the recording is legally permissible and all required express consents of the persons recorded have been obtained before the start. In doing so, it also checks on its own responsibility the permissibility under criminal and professional law, in particular the protection of the privately spoken word (§ 201 StGB, German Criminal Code). Enabling the microphone in the browser is not proof of such consent.

(2) The customer informs the persons concerned of the purpose, processing, recipients, storage period, withdrawal and deletion and maintains a robust withdrawal and error process. Psymira provides technical recording and deletion functions, but does not verify consent automatically. Audio files are deleted automatically after successful transcription, no later than after 30 days.

§ 14 Data protection and processing on behalf

(1) For patient and treatment data, the customer is the controller within the meaning of the GDPR. The Provider processes these data as a processor. Before such data are processed, the data processing agreement pursuant to Art. 28 GDPR is concluded in its version incorporated at the time.

(2) For the contract account, billing, contact and its own secure operation of the service, the Provider processes data under its own responsibility. Further information is contained in the privacy policy.

§ 15 Data export, end of contract and change of provider

(1) During the term of the contract, self-service export functions are available to the customer. The export takes place in structured, commonly used, machine-readable formats as a password-protected archive (JSON and PDF; documents and files in their original format). The details are governed by the data export and format register (annex to these Terms) in accordance with the EU Data Act; it can be accessed at any time in the application under “Practice administration → Subscription” and is also linked there when a data export is triggered. An application programming interface (API) for the export is not owed; no switching charges apply.

(2) At the end of the contract or trial period, the following procedure applies:

• 30 days of read-only access with the option to export (reminders on days 7, 14 and 28);
• if no paid subscription was booked (pure trial period), the account and productive data are deleted automatically after the 30 days have expired (effective immediately, final after seven days — DPA Annex 4); no final archive is kept;
• if there was a paid subscription, access is deactivated from day 31 and an encrypted final export is created automatically, kept for a further 90 days and provided to the customer upon an identity-verified request; after this period has expired, productive data and the final export are deleted — effective immediately, final after seven days (DPA Annex 4; backup copies within the backup rotation, 7 days).

The final export is handed over after identity verification as an encrypted archive; the password is transmitted via a separate channel.

(3) The professionally required backup and retention of the patient documentation (in particular under § 630f BGB) is the responsibility of the customer; timely export is its obligation. Keeping the final export available for 90 days is a temporary goodwill service of the Provider. Details under data protection law are governed with precedence by the DPA.

§ 16 Confidentiality

(1) The parties treat confidential information of the respective other party confidentially and use it only for the performance of the contract. This continues to apply after the end of the contract.

(2) The Provider takes into account the particular sensitivity of the patient data processed on behalf and the duty of confidentiality under professional and criminal law pursuant to § 203 StGB. The obligation of the contributing persons and of the sub-processors as well as the limitation of access are governed by the data processing agreement.

§ 17 Changes to the services, the prices and these terms

(1) The Provider may change services, prices and these terms insofar as this is necessary for legal, security or technical reasons or because of changed procurement and operating costs and does not unreasonably disadvantage the customer; the essential content of the services is preserved.

(2) The Provider announces significant changes in text form at least 30 days before they take effect.

(3) If a significant change disadvantages the customer more than insignificantly, the customer may terminate the contract extraordinarily with effect from the time of the change, up until it takes effect. The Provider points out the time limit and the right of termination in the notification.

§ 18 Warranty and liability

(1) The statutory provisions apply to defects; the Provider provides subsequent performance by remedying the defect within a reasonable period.

(2) The Provider is liable without limitation for damage resulting from injury to life, body or health, for damage due to an intentional or grossly negligent breach of duty, to the extent of a guarantee assumed and in accordance with mandatory statutory provisions, in particular under the German Product Liability Act and Art. 82 GDPR.

(3) In the event of a slightly negligent breach of an essential contractual obligation (cardinal obligation), the Provider’s liability is limited to the foreseeable damage typical for the contract, at most to the fees paid by the customer in the twelve months before the event causing the damage. Essential contractual obligations are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose compliance the customer may regularly rely.

(4) Otherwise, the Provider’s liability is excluded, in particular for slight negligence outside essential contractual obligations.

(5) The Provider is only liable for the loss of data to the extent that would have been required for recovery in the case of proper, regular data backup by the customer appropriate to the risk; this does not apply insofar as data backup is incumbent on the Provider under the contract.

(6) AI-supported outputs are drafts; the professional review and decision are incumbent on the customer. The Provider is not liable for damage resulting from the adoption of AI outputs without review.

(7) The above limitations of liability also apply in favour of the Provider’s legal representatives, employees and vicarious agents. This does not involve any change in the burden of proof to the detriment of the customer.

§ 19 Final provisions

(1) The law of the Federal Republic of Germany applies to the exclusion of the UN Convention on Contracts for the International Sale of Goods.

(2) The exclusive place of jurisdiction is Berlin, insofar as legally permissible and the customer is a merchant, a legal entity under public law or a special fund under public law. Otherwise, the statutory places of jurisdiction apply.

(3) Amendments and additions to the contract require text form. The customer may only transfer rights and obligations under this contract to third parties with the Provider’s prior consent. The customer may only set off against claims of the Provider with claims that are undisputed or have been finally established by a court.

(4) In the event of contradictions, the following order of precedence applies: (a) individual written agreement or order form, (b) service description/plan sheet, (c) service level annex, (d) these Terms, (e) data processing agreement. In matters of data protection law relating to processing on behalf, the data processing agreement takes precedence.

(5) Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.