The portal uses cookies to provide service functions such as “Bookmark” and to improve website usage. Information and opt-out options can be found in the cookie settings in the privacy policy.

Search

Privacy policy

The Federal Ministry of Health (BMG) takes the protection of your personal data very seriously. We have therefore adopted measures to ensure that data protection regulations are observed both by ourselves and by our external service providers.

Further information about which data is collected for what purpose and on what basis, how you can contact the data controller and data protection officer, and what rights you have with regard to the processing of personal data can be found in this privacy policy.

Changes to this privacy policy may be required as a result of developments to our website and the technologies used. We therefore recommend that you re-read the privacy policy from time to time.

1. Controller and data protection officer

The controller responsible for processing personal data is the

Federal Ministry of Health (Bundesministerium für Gesundheit – BMG)
53123 Bonn
Telephone: +49 (0)228 99441-0
E-mail: poststelle@bmg.bund.de
DE mail: poststelle@bundesgesundheitsministerium.de-mail.de

For any specific questions regarding the protection of your data and further information in relation to the handling of personal data in the BMG, please contact the BMG data protection officer:

Bundesministerium für Gesundheit
- Datenschutzbeauftragte -
11055 Berlin
DSB@bmg.bund.de

2. What data do we collect when you visit gesund.bund.de?

According to the General Data Protection Regulation (Art. 4 (1) GDPR) personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier.

All data collected shall be exclusively processed for the purposes of the use and improvement of the national health portal available to citizens as the central German web portal for information about health matters so as to make an important contribution to the improvement of public health competence.

2.1. Data generally recorded during visits to the health portal

The following personal data is recorded when you visit the health portal to enable the portal to be provided in the optimum manner from a technical perspective:

  • your IP address
  • date and time of your visit
  • protocol version
  • browser access connection type that indicates whether or not a connection is encrypted (HTTP method)
  • website from which you came to the current website (referrer)
  • user-agent string (usually contains the name and version of the browser and potentially the operating system of the accessing device)
  • the target address you accessed
  • name of the file accessed and the data volume transmitted in bytes
  • notification of whether the access was successful (HTTP status code)
  • contact data from the contact form or other type of contact (e-mail address, name, message content)

2.2. “Matomo” web analysis tool

To provide information in a needs-oriented manner and optimize the functions on the health portal, the BMG analyzes anonymous usage information for statistical purposes.

The following information is collected for this purpose:

  • the URL from which the health portal or one of its subpages is accessed (e.g. a search engine or link from another website)
  • the health portal URLs accessed
  • the length of time spent on each of the health portal pages
  • the search terms entered
  • information transmitted from the user’s access device (operating system, screen resolution, browser, browser language setting)

This is done using the web analysis tool “Matomo” (formerly “PIWIK”), which is also used on the servers of the German Federal Center for Information Technology (ITZBund). The software is configured so that instead of IP addresses being fully processed, two octets of them are masked (e.g. 192.168.xxx.xxx). This means that the IP address can no longer be associated with your access device, so you remain anonymous as a user.

“Matomo” uses this part of your IP address and various other pieces of technical information transmitted by your access device (operating system, browser name, browser plug-ins, browser language settings) to create an ID number that enables the software to assign activities on the health portal to a website visitor. This ID cannot be used to determine or track your identity as a user. The assignment to an ID number is done using JavaScript elements.

Please note: If you do not agree to the anonymous processing and evaluation of the data from your visit, you can prevent this in most browsers, for example by using a Do Not Track option or by searching in private mode. Activating ad blockers or disabling JavaScript for your browser also prevents “Matomo” from recording data.

2.3. Cookies

Please note: You can use any internet browser to view when cookies are stored and what they contain. Depending which browser you use, you can already configure your browser settings to generally allow cookies, only accept certain cookies, or reject all cookies. You can also generally use your browser to see which cookies are stored on your access device. You can then fully or partially delete these. More detailed information can be found on the Federal Commissioner for Data Protection and Freedom of Information’s website.

2.4. “Rate article” function

If you rate an article, we record the following details:

  • your IP address
  • the fact that you have accessed and submitted the survey
  • the information you provided in the survey (if the article was helpful (yes/no) and any comment)

The information you provided is automatically separated from your IP address and evaluated by us anonymously.

2.5. Contact inquiries to the BMG

If you e-mail us at kontakt@gesundbund.de, we will record the following details:

  • the e-mail address from which you have contacted us
  • the date and time at which your e-mail was received
  • the content of your message

2.6. “Report an accessibility barrier” function

If you send us a message via the “Report an accessibility barrier” function, we will record the following data:

  • your IP address
  • the data and time at which you sent your message
  • the name you provided, your e-mail address, and the subject
  • if you have provided this information, your address and telephone number
  • the content of your message

2.7. “Read out loud” function

The “Read out loud” function offered on a number of pages is provided by the company “ReadSpeaker”. If you click the “Read out loud” button, the corresponding text will be transferred to the ReadSpeaker server via your IP. An audio file will be generated and returned to the user IP using a streaming process.

As soon as the audio file has been delivered, the process and user IP address will be deleted from the ReadSpeaker server. ReadSpeaker does not collect or store any data that can be used to identify people. All services are provided in Europe (Sweden).

If a user changes the settings (highlighted setting, text size, etc.) in the player, ReadSpeaker will store this information in a cookie in the user’s browser. To retain the settings selected by the user for all website pages, the cookie is connected to the website’s URL.

ReadSpeaker generally performs statistical data analyses on the use of the “Read out loud” function. However, the statistical data cannot be linked to individual users or their usage. ReadSpeaker only stores the total number of times the “Read out loud” button is activated per web page and language. ReadSpeaker stores the IP addresses associated with the activation. This occurs using standard web logs to enable suitable security measures such as detecting bots and tracking any service failures. The logs are only stored for one month.

2.8. Hosting

This website is hosted by an external service provider (hoster). The personal data collected on this website is stored on the hoster’s servers. This can primarily include IP addresses, contact inquiries, meta and communication data, contract data, contact data, names, website accesses, and other data generated via a website.

Our hoster shall only process your data to the extent necessary to perform its service obligations and shall follow our instructions with regard to the data. To ensure that all processing complies with data protection regulations, we have concluded an order processing contract with our hoster.

3. What personal data do we store beyond your visit?

3.1. Data stored in log files

The following data is stored on the server in a “log file” beyond the duration of your visit to the health portal:

  • the first two octets of your IP address (e.g. 192.168.XXX.XXX)
  • the date and time of your access
  • protocol version
  • HTTP methods (browser access connection type that indicates whether or not a connection is encrypted)
  • referrer (website from which you came to the current website)
  • user-agent string (usually contains the name and version of the browser and potentially the operating system of the accessing device)
  • the target address you accessed
  • name of the accessed file and transmitted data volume in bytes
  • notification of whether the access was successful (HTTP status code)

We create the log files to enable us to conduct error analyses in the event of technical issues as well as to perform maintenance to the health portal. The log files are stored for 30 days, after which they are automatically deleted.

3.2. Statistical data

The anonymous usage data collected by the web analysis tool “Matomo” is stored beyond your visit to enable statistical evaluation over a longer period of time as well as to determine the extent to which the functions offered by the health portal should be optimized. Statistical evaluation is carried out by the BMG. The statistical data is not shared with third parties.

3.3. Data saved in association with your contact inquiries

If you send us a message using the “Report an accessibility barrier” form or by e-mail, the data you provide will be processed in the BMG for as long as it takes to deal with your inquiry and then deleted.

4. Legal bases

The data listed under 2.1 is collected on the basis of Art. 6, paragraph 1, point (e) of the GDPR in conjunction with Section 3 of the German Federal Data Protection Act (BDSG) and Section 1, paragraph 1 of the German Online Access Act (OZG).

The legal basis for storing this data in log files is Art. 6, paragraph 1, point (c) of the GDPR in conjunction with Art. 32, paragraph 1, point (b) of the GDPR: the log files are used to track and analyze any system errors so that they can be quickly eliminated and the integrity, availability, and resilience of the health portal as per Art. 32, paragraph 1, point (b) of the GDPR can be ensured.

The processing of usage information using the web analysis tool “Matomo” (2.2) occurs on the basis of Art. 6, paragraph 1, point (e) of the GDPRR in conjunction with Section 3 of the BDSG.

The data recorded under 2.3 within the scope of the use of session cookies is collected on the basis of Art. 6, paragraph 1, point (e) of the GDPR in conjunction with Section 3 of the BDSG and Section 1, paragraph 1 of the OZG. In accordance with Art. 6, paragraph 1, point (a) of the GDPR, the persistent cookies are only used with your consent.

The data required to provide the survey is collected on the basis of Art. 6, paragraph 1, sentence 1, point (e) of the GDPR in conjunction with Section 3 of the BDSG and Section 1, paragraph 1 of the OZG.

The legal basis for the storage and further processing of your inquiry via the ”Report an accessibility barrier” form or e-mail is Art. 6, paragraph 1 (a) of the GDPR as this occurs with your consent.

5. Is your data shared with third parties?

We solely share personal data with third parties outside of the BMG in the following cases:

  • You send us an inquiry/e-mail containing specific technical questions about the health portal; in some cases, the BMG may forward this to the technical service provider’s help desk for them to deal with. We request your express consent for this prior to sending us the contact form.
  • In some cases, the BMG can be legally obliged to provide law enforcement authorities (see Section 23, paragraph 1, no. 3 and 4 of the BDSG) or the German Federal Office for Information Security (BSI; see Section 5, paragraph 1, sentence 4 of the BSI Act (BSIG)) with access to personal data if this is necessary in association with the prosecution of crimes or to prevent attacks on the government’s IT infrastructure.
  • This site uses the cartographic service Google Maps via an API. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To use the Google Maps functions, it is necessary to store your IP address. This information is usually transmitted to a Google server in the USA, where it is stored. The provider of this website has no influence over this data transmission. Google Maps is used to attractively present our online services and to make it easier to find the places we specify on the website. The legal basis for processing the data is Article 6(1)(a) GDPR.
    For further information about how user data is handled, please see Google’s Privacy Policy: policies.google.com/privacy

We shall not share your data with third parties in any other situations.

6. Expert search and specials (external microsites)

gesund.bund.de service or topic microsites that have their own privacy policies:

expertensuche.gesund.bund.de

specials.gesund.bund.de

7. Your rights

You have the following rights in relation to the BMG with regard to your personal data:

Right of access, Art. 15 GDPR

The right of access provides the data subject with a comprehensive insight into the data concerning him/her and several other important criteria such as why the data is being processed and for how long it will be stored. The exceptions to this right established in Section 34 BDSG apply.

Right to rectification, Art. 16 GDPR

The right to rectification entitles the data subject to have inaccurate personal data concerning him/her rectified.

Right to erasure, Art. 17 GDPR

The right to erasure entitles the data subject to have the controller erase personal data. However, this is only possible if the personal data concerning the data subject is no longer necessary, is being processed illegally, or if a consent on which the processing is based has been withdrawn. The exceptions to this right established in Section 35 BDSG apply.

Right to restriction of processing, Art. 18 GDPR

The right to restriction of processing covers the data subject’s ability to provisionally prevent the further processing of the personal data concerning him/her. The restriction primarily applies when the data subject is reviewing other rights management aspects.

Right to object against the collection, processing, and/or use of data, Art. 21 GDPR

The right to object enables data subjects to object to the further processing of their personal data in a particular situation if justified by the exercise of public duties or public or private interests. The exceptions to this right established in Section 36 BDSG apply.

Right to data portability, Art. 20 GDPR

The right to data portability enables data subjects to obtain the personal data concerning them from the data controller in a commonly used, machine-readable format in order to potentially transmit it to another controller. According to Art. 20, paragraph 3, sentence 2 GDPR, however, this right shall not apply to processing necessary for the performance of a task carried out in the public interest.

The rights to consent and withdrawal of consent are regulated in Art. 7 GDPR.

If the processing of personal data is subject to a consent, the data subject has the right to withdraw this consent for the relevant purpose at any time. The lawfulness of processing based on consent provided shall remain unaffected until the consent is withdrawn.

You can exercise the aforementioned rights in writing or electronically using the contact details listed under point 1. Pursuant to Art. 77 GDPR, you are also entitled to lodge a complaint with a supervisory authority for data protection. This is the German Federal Commissioner for Data Protection and Freedom of Information.

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit Graurheindorfer Str. 153
D-53117 Bonn

Telephone: +49 (0)228-997799-0
Fax: +49 (0)228-997799-5550
E-mail: poststelle@bfdi.bund.de

Liaison office:
Friedrichstraße 50
D-10117 Berlin

In the event of questions and complaints, you can also contact the BMG data protection officer indicated under point 1.

Updated 27 August 2020