Skip to content

Data processing agreement (Auftragsverarbeitungsvertrag, AVV)

English convenience translation. This English version is provided for convenience and was translated with AI assistance. It has not been independently reviewed for legal accuracy. In the event of discrepancies, the German contract version prevails to the extent permitted by applicable law. Mandatory rights remain unaffected. German version

Version: As of 14 Oct 2026 · Scope: Organisations as referrers (controllers) – PHP Schmiede KG as processor

1. Subject matter

PHP Schmiede KG (processor) processes personal data on behalf of the referring organisation (controller) in order to arrange care through the referral platform Pflege Patienten. This agreement specifies the obligations under Art. 28 GDPR.

2. Nature, purpose and scope

The details of a care need are processed so that eligible care providers in the service area are informed, can express interest and an acceptance can be agreed.

3. Type of data

  • details of the care need: postcode and town, type of care, start and planned discharge, services required with times and notes, care level (Pflegegrad), age group, gender, diagnoses, care situation, type of payer, short description (may be health data under Art. 9 GDPR)
  • messages between the controller and care providers, team notes, responses and the result of the referral
  • name of the referring organisation
  • confirmation that consent has been given
  • work contact of the controller (role, ward, department, function number or shared mailbox, optionally the name of the contact person)
  • data of the controller’s staff, where they use the platform

4. Data subjects

Persons to be cared for and their representatives as well as staff of the controller.

5. Instructions and confidentiality

The processor only processes the data on documented instructions from the controller. Persons authorised to process the data are bound to confidentiality.

The controller instructs the processor to view case content read-only exclusively for the following occasions: support request, request from a data subject, error analysis, review of suspected misuse, suspected misuse in the communication, legal obligation or another occasion justified in writing. The processor only views messages and team notes where misuse in the communication is suspected and with a justifying note. Every access is logged before reading; the log is kept for six months and the controller can view it in the portal under ‘Operator access log’.

6. Security

The processor takes appropriate technical and organisational measures under Art. 32 GDPR. They are described in the annex ‘Technical and organisational measures’.

7. Sub-processors

The processor engages the following sub-processors:

  • Hetzner Online GmbH, Gunzenhausen, Germany – hosting and backups; processing in data centres in Germany.

The processor sends platform emails (for example case notifications to care providers and account information) and form notifications through its own mail server; its servers are operated by Hetzner Online GmbH.

The processor informs the controller of changes in advance; the controller can object.

8. Assistance

The processor assists the controller with requests from data subjects, with notifications of personal data breaches and with data protection impact assessments.

The processor shall inform the controller without undue delay and no later than 24 hours after becoming aware of a personal data breach. An incomplete investigation shall not delay the initial notification. Further information shall be provided without undue delay as it becomes available. Statutory notification duties remain unaffected.

9. Deletion and return

After a case has been completed or after the end of the cooperation, the data is deleted in line with the agreed maximum periods unless there is a statutory obligation to retain it. On request, the processor provides the data beforehand in a common format.

10. Audits

The controller can verify compliance with this agreement; the processor provides the necessary information.

11. Term

This agreement applies for the duration of the controller’s use of the platform.

12. Contact persons

The processor’s contact person for instructions and for notifications of personal data breaches is Fabian Lücker, telephone +49 5971 9588922, email kontakt@php-schmiede.com. For data protection matters, datenschutz@pflege-patienten.com can also be used.

Annex: Technical and organisational measures

This annex describes the measures under Art. 32 GDPR for the platform and hosting. It is updated when changes occur. The hosting provider Hetzner Online GmbH is responsible for the data centre, hardware and network; from the operating system upwards, the measures lie with the processor.

Physical access control

The servers are located in data centres of Hetzner Online GmbH in Germany. Hetzner is responsible for the physical security of the data centres, power supply, air conditioning and fire protection in line with its technical and organisational measures.

System access control

  • Sign-in only with a personal user account; passwords with at least 12 characters, stored only as a hash value (bcrypt).
  • Failed sign-in attempts are limited per IP address and per account.
  • Two-factor sign-in (TOTP with recovery codes); mandatory for hospitals, can be enforced for other organisations.
  • Sessions are stored encrypted; session cookies are restricted to secure transmission and cannot be read by scripts. A session ends after eight hours without activity.
  • The servers are behind firewalls that block everything by default; the administration interface and database ports can only be reached from approved IP addresses.

Data access control

  • Roles in the organisation’s team: administration, case handling, read-only and audit/IT; the audit/IT role does not see case content.
  • Every access to a case is checked against the permissions of the account. A case can only be retrieved by the referring organisation and by the care providers informed or selected, to the extent released in each case; other access is refused.
  • The operator only opens case content with a documented occasion from a fixed list of seven occasions: support request, request from a data subject, error analysis, review of suspected misuse, suspected misuse in the communication, legal obligation or another occasion justified in writing. The access is logged before reading. The operator only opens the messages and team notes of a case for the occasion ‘suspected misuse in the communication’ and with a justifying note.

Transfer control

  • Transmission between browser and platform is encrypted (TLS 1.2 or 1.3); requests over HTTP are redirected to HTTPS.
  • Email notifications only contain the details of a fixed allow list; diagnoses and free texts are not sent by email.

Input control

  • Events in the case history, changes to teams and roles, operator access to case content and deletions are logged.
  • Application logs contain a time stamp and user identifier; failed sign-ins are recorded.

Order control

Processing only takes place on the controller’s instructions (section 5); sub-processors are engaged in accordance with section 7.

Availability control

  • The servers are backed up daily by the hosting provider.
  • The hosting provider provides redundant network connectivity and detection of DDoS attacks.
  • Security updates of the operating system are installed automatically.

Separation control

  • The data of the organisations is processed separately in the application; access to other organisations’ records is refused.
  • Hetzner is responsible for the separation between the hosting provider’s customers.
  • Only synthetic data is used for development and testing; data of the controllers is not transferred to development or test environments.

Encryption

  • Content and free-text fields of the case data are stored encrypted in the database (AES-256-CBC with HMAC-SHA256). Fields needed for search and matching – such as status, postcode, type of care and dates – remain unencrypted.
  • Passwords and recovery codes are only stored as hash values.

Deletion

Data is deleted by automatic deletion control in line with the maximum periods of the deletion policy; deletions are logged, and statutory retention obligations and deletion holds are taken into account. In backups, deleted data is retained until the backup generations expire. The hosting provider is responsible for erasing and destroying decommissioned data media.

Status

As of 14 Oct 2026.