Skip to content

Privacy policy

English convenience translation. This English version is provided for convenience and was translated with AI assistance. It has not been independently reviewed for legal accuracy. In the event of discrepancies, the German contract version prevails to the extent permitted by applicable law. Mandatory rights remain unaffected. German version

Version: As of 14 Oct 2026 · Scope: Website pflege-patienten.com and referral platform

1. Controller

PHP Schmiede KG, Hagenstr. 18, 48429 Rheine, Germany
Represented by its personally liable partner Fabian Lücker
Telephone: +49 5971 9588922
Data protection contact: datenschutz@pflege-patienten.com

For questions about your personal data and the exercise of your data protection rights, contact datenschutz@pflege-patienten.com. Please do not send complete patient records or passwords by ordinary email.

On data protection matters we work with DSB Münster GmbH, Martin-Luther-King-Weg 42–44, 48155 Münster, Germany (data protection consultancy).

2. Who is responsible for which data

Pflege Patienten is a service of PHP Schmiede KG and arranges care between referrers (for example hospitals, medical practices, advisory services, home care services or private individuals) and care providers accepting cases.

  • Website, user accounts, contracts and billing: we are the controller, to the extent described in each case, for processing website enquiries, managing users and contracts and for our own billing.
  • Case data of care providers and organisations: for care cases that a care provider posts under its own responsibility, we may act as its processor under Art. 28 GDPR to the agreed extent, on the basis of a data processing agreement (Auftragsverarbeitungsvertrag, AVV). For questions about this data, please first contact the referring organisation.
  • Care requests posted by private individuals: we are the controller for these; we inform you separately before you enter the details.

3. Visiting this website

When you visit the website, our server processes technically necessary information: IP address, date and time, the address requested, referrer, browser type and status code. The purpose is to deliver the website and keep it secure (Art. 6(1)(f) GDPR). For our own access statistics we store visits on the server with a shortened IP address for no more than seven days and after that only combine them into daily totals that can no longer be linked to individuals. We log requests for pages that do not exist (error 404) for up to 90 days, without any link to individuals, in order to fix broken links.

We do not embed any analytics or advertising services, any social media plugins or any fonts, maps or videos from third-party providers.

4. Cookies and local storage

The website only sets technically necessary cookies (Section 25(2) No. 2 TDDDG):

  • CORESYS_FE – session cookie for security, such as protecting the contact form against abusive requests; it expires eight hours after it was set (Art. 6(1)(f) GDPR).
  • ps_consent – stores your choice in the cookie notice; storage period 182 days.
  • ps_consent_id – random identifier that is set on your first visit; storage period 182 days. We record your choice together with a hash value formed from this identifier, a hash value of your browser identifier and the version of the notice, so that we can prove it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
  • cb_locale – stores your language choice when you switch the language of the website; storage period one year.

We do not use any cookie-based analytics, statistics, marketing or personalisation services or third-party services; the corresponding categories in the cookie notice are currently empty. You can change your choice at any time via ‘Cookie settings’. If you choose the light or dark display, your browser stores this setting locally; it is not transmitted to us.

5. Contact form and email

If you write to us using the contact form or by email, we process your contact details and your message (enquiry, name, email address and – voluntarily – organisation, type of organisation, postcode, telephone number and message) in order to deal with your enquiry and, where applicable, to note your interest in taking part (Art. 6(1)(b) and (f) GDPR). With an enquiry sent through the form we also store the IP address, the browser identifier, the page it was sent from and the referring address so that we can detect abusive submissions (Art. 6(1)(f) GDPR). We store the referring address only without parameters (anything after “?” or “#” is removed before storage). The IP address is first stored in full and automatically shortened 30 days after receipt (for IPv4 the last octet, for IPv6 the device part is set to zero).

Please do not enter any names of persons in need of care, diagnoses or patient records here. A separate portal process is available for care requests. Using the contact form does not sign you up for advertising emails; enquiries are not passed on to third parties.

We delete stored form enquiries no later than twelve months after receipt, unless they are needed for statutory retention or the establishment or defence of specific legal claims. The same maximum period applies to enquiries by email.

6. Use of the referral platform

User accounts

For registration we process name, email address, organisation and location as well as the sign-in details (Art. 6(1)(b) GDPR). We delete incomplete registrations after 30 days at the latest.

Care needs

A care need contains details of up to three types of care, postcode and town, start and planned discharge, services required with times, care level (Pflegegrad), age group, gender (voluntary), diagnoses, care situation, type of payer, short description and notes; for organisations also a work contact (role, ward or department, function number or shared mailbox, optionally the name of the contact person), for private individuals seeking care their telephone number and email address. Details that directly identify the person to be cared for (name, address, date of birth, insurance number) are not recorded; free texts are checked for such details. For private requests we store the contact details of the person seeking care; this may be the person concerned themselves. The details may be health data within the meaning of Art. 9 GDPR. We treat all details of a care need as personal data, because case details without names can also be linked to a person through their combination. The legal basis is the explicit consent of the person concerned (Art. 6(1)(a), Art. 9(2)(a) GDPR). Organisations obtain this consent themselves and confirm it in the portal; private individuals seeking care give it directly on the platform. Consent can be withdrawn at any time with effect for the future.

Recipients

Registered care providers whose service area covers the place of the care need and whose location profile matches it only receive the case number, type of care, service categories, postcode and town, start and a link to the portal by email. In the portal they see the details for the referral, including the approximate distance from their location, diagnoses, the short description, notes, the referring organisation and its work contact; locations without a location subscription see a preview without an identifiable referring organisation. Only the care provider selected by the referrer receives the telephone number and email address of private individuals seeking care. No care provider sees the offers of other care providers. For its case, the referring organisation sees which care providers were notified – with the name of the care provider, the date and the result of the response – as a record for its documentation. If an organisation belongs to an umbrella organisation, the umbrella organisation can only read with the organisation’s separate consent, which can be withdrawn at any time – separately for key figures and for case contents; the umbrella organisation never makes changes, and every access is logged.

Operator access to case content

In regular operation we do not view case content, messages between referrer and care provider or team notes. Operator access to case content is limited to persons with a separate permission and to a documented occasion from a fixed list: support request, request from a data subject, error analysis, review of suspected misuse, suspected misuse in the communication, legal obligation or another occasion justified in writing. We only open messages and team notes where misuse in the communication is suspected and with a justifying note. Access is read-only; the occasion, time and scope of access are logged before reading.

We store the access log for six months and delete it afterwards. We only keep it longer in the event of a specifically documented incident or another sound basis for retention.

Retention period

We only store case data for as long as it is needed for the referral and delete it afterwards in line with defined maximum periods. Statutory retention periods apply to billing records (as a rule eight years for accounting vouchers, six years for business letters, ten years for books and financial statements).

7. Location subscription and billing

For the paid location subscription we process contract and invoice data of the care provider (Art. 6(1)(b) and (c) GDPR). We issue the invoices ourselves in the portal.

Contract and billing data are processed separately from operational care cases. Invoice data that must be retained for tax purposes is stored for the applicable statutory period. Patient-related diagnoses and complete case details are not needed for this and are not archived as part of the invoice. Deleting a care case does not automatically remove an invoice that must lawfully be retained.

8. Service providers

For hosting we use service providers that act on our behalf under Art. 28 GDPR.

  • Hosting and backups: Hetzner Online GmbH, Gunzenhausen, Germany; processing in data centres in Germany.

We send platform emails (for example case notifications to care providers and account information) and form notifications through our own mail server; its servers are operated by Hetzner Online GmbH.

9. Your rights

Where the statutory requirements are met, you have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on consent, you can withdraw your consent at any time with effect for the future. You can object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21); you can object to direct marketing at any time.

You can also lodge a complaint with the competent data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. For case data of church-run care providers, a church data protection supervisory authority may be competent.

Please address concerns about a case posted by a care provider primarily to the controller named there. If such concerns reach us as processor, we forward them and support their handling. For processing under our own responsibility you can reach us at datenschutz@pflege-patienten.com; we answer within the statutory time limits. Organisations can additionally download their organisation data in the portal under ‘Settings’ → ‘Data export’.

10. Status

As of 14 Oct 2026.