Unless otherwise stated in a specific service agreement or privacy notice, the controller responsible for processing your personal data is:

Where ChatDok processes personal data on behalf of a hospital, healthcare provider, insurer, research institution, or other enterprise customer, that organization may be the controller and ChatDok may act as a processor. In those circumstances, the relevant organization remains responsible for determining the purposes and means of processing, and its own privacy information may also apply.

If you participate in a research study or clinical validation program, the study documentation and the responsible study institution may provide additional information about data processing.

This Privacy Policy applies to personal data processed in connection with:

• the ChatDok website and related websites;
• the ChatDok App and web applications;
• ChatDok conversational AI and medical information services;
• ChatDok-Navigator, including post-discharge and longitudinal care coordination services;
• ChatDok-Heart and related cardiovascular monitoring and care-support services;
• research, clinical validation, pilot and evaluation programs;
• communications with ChatDok, including customer support;
• enterprise services provided to healthcare organizations, insurers and other partners, where this Privacy Policy applies;
• account registration, authentication and related services; and
• other ChatDok products or services that link to this Privacy Policy.

Certain services may have additional privacy notices or specific consent forms. Where they apply, those documents supplement this Privacy Policy.

The information we process depends on how you use ChatDok and which services you access.

3.1 Account and contact information

This may include:

• name;
• email address;
• telephone number;
• account credentials or authentication information;
• date of birth or age where required;
• language and communication preferences;
• organization or professional information where relevant; and
• other information you provide when contacting us.

3.2 Health and medical information

Depending on the service, ChatDok may process information concerning your health, including information you voluntarily provide or information generated through your use of a healthcare service. This may include:

• symptoms and health concerns;
• medical history;
• diagnoses or conditions;
• medications and medication-related information;
• allergies;
• treatment and recovery information;
• patient-reported outcomes;
• lifestyle information relevant to a care pathway;
• physiological or monitoring data;
• information from connected devices or integrations where enabled;
• information contained in documents or other materials you provide;
• conversations with ChatDok's AI systems;
• information exchanged with healthcare professionals or healthcare organizations through an applicable service; and
• information generated through your participation in research or clinical validation activities.

Health information is generally considered special-category personal data under Article 9 GDPR and receives additional protection. We only process health data where an applicable legal basis and, where required, an applicable Article 9 condition for processing special-category data exists.

3.3 Conversations and AI interactions

When you use a ChatDok conversational service, we may process information contained in your interactions with the service. Depending on the product, this may include:

• text entered by you;
• questions and responses;
• structured health information;
• voice input or audio, where voice functionality is enabled;
• images or documents you upload;
• information generated from your interaction with the service; and
• feedback you provide about the service.

The exact information collected depends on the functionality you use.

3.4 Information from healthcare organizations and other sources

Where appropriate and legally permitted, ChatDok may receive information from:

• hospitals;
• physicians and other healthcare professionals;
• insurers;
• research institutions;
• healthcare technology platforms;
• connected devices or applications;
• electronic health record systems;
• organizations providing a ChatDok service to you; and
• other sources where you have authorized or requested the transfer.

For enterprise services, the healthcare organization or other partner may determine which information is made available to ChatDok.

3.5 Technical and usage information

We may process technical information required to operate, secure and improve our services, including:

• IP address;
• device type and operating system;
• browser information;
• application version;
• language and time-zone settings;
• login information;
• date and time of access;
• diagnostic and security logs;
• service performance information;
• interactions with our websites or applications; and
• information concerning how features are used.

3.6 Location information

Some services may use approximate or precise location information where this functionality is enabled and where necessary for the relevant service. For example, location may be relevant when a service is designed to help identify nearby healthcare resources. You can generally control location permissions through your device or browser settings.

3.7 Payment information

If a ChatDok service involves payment, payment information may be processed by our payment service providers. Where possible, payment card information is handled directly by the relevant payment provider rather than stored by ChatDok.

We use personal data only for specified and appropriate purposes. Depending on the service and applicable law, these purposes may include:

Providing and operating ChatDok services

We process information necessary to:

• create and maintain your account;
• provide ChatDok services;
• respond to your requests;
• provide conversational AI functionality;
• provide personalized health information and support;
• support post-discharge and longitudinal care pathways;
• enable patient-reported monitoring and check-ins;
• support communication and coordination between patients and care teams;
• operate cardiovascular monitoring and care-support functionality;
• provide requested integrations; and
• maintain the security and functionality of our services.

Supporting continuous care

Where a service is designed for longitudinal care, we may use relevant information to maintain context across interactions and help deliver the configured care pathway. For example, ChatDok-Navigator may process information to support:

• post-discharge follow-up;
• recovery guidance;
• medication and appointment reminders;
• patient check-ins;
• collection of patient-reported information;
• care-plan activities;
• identification of information requiring review by a care team; and
• communication or escalation according to the configured clinical workflow.

ChatDok does not independently determine the medical treatment you receive. Clinical decisions remain the responsibility of the relevant healthcare professionals and organizations.

Supporting cardiovascular care

Where you use ChatDok-Heart, relevant health and monitoring information may be processed to support:

• remote monitoring;
• symptom and patient-reported tracking;
• personalized care support;
• adherence support;
• risk-related analytics;
• communication with clinical teams; and
• clinical evaluation and validation.

Specific research or clinical-study activities may be governed by additional study documentation.

Safety, security and quality

We process information where necessary to:

• protect our systems and users;
• detect and prevent misuse, fraud and security incidents;
• investigate technical problems;
• maintain service reliability;
• monitor and improve system performance;
• validate AI systems;
• identify and address potentially unsafe outputs or behavior;
• comply with applicable legal and regulatory requirements; and
• maintain appropriate records.

Research and clinical validation

ChatDok conducts and supports research, pilot programs and clinical validation activities relating to digital healthcare, AI, cardiovascular care and longitudinal care. Where personal data is processed for research or clinical validation, the applicable legal basis, safeguards and information provided to participants will depend on the specific project. Where required, research participants will receive additional information and consent documentation.

Research processing may involve safeguards such as pseudonymization, access controls, data minimization and other technical and organizational measures. Where data has been genuinely anonymized so that individuals are no longer identifiable, the resulting anonymous information is no longer personal data under the GDPR.

Improving our products and AI systems

Where legally permitted, we may use information to improve our services, evaluate system performance, identify errors and develop safer and more useful healthcare technologies.

Where health data or other sensitive information is involved, we apply the legal requirements applicable to that category of data. We do not assume that information becomes anonymous merely because direct identifiers such as a name or email address have been removed. Pseudonymized information may still constitute personal data.

Where a particular processing activity requires your consent, we will request it separately.

The legal basis for processing depends on the purpose and circumstances. Depending on the activity, we may rely on:

• Article 6(1)(a) GDPR — Consent, where you have provided valid consent;
• Article 6(1)(b) GDPR — Contract, where processing is necessary to provide a service you have requested or to take steps at your request before entering into a contract;
• Article 6(1)(c) GDPR — Legal obligation, where processing is necessary to comply with a legal obligation;
• Article 6(1)(d) GDPR — Vital interests, where applicable;
• Article 6(1)(e) GDPR — Public interest, where applicable; or
• Article 6(1)(f) GDPR — Legitimate interests, where permitted by applicable law and where our interests are not overridden by your rights and freedoms.

For health data and other special categories of personal data, an additional condition under Article 9 GDPR is required. Depending on the circumstances, this may include explicit consent, healthcare-related provisions, substantial public interest, scientific research, or another applicable condition under Article 9 and national law.

The applicable legal basis and Article 9 condition will depend on the specific processing activity.

ChatDok uses artificial intelligence and machine-learning technologies as part of its products and services. Depending on the service, AI may be used to:

• understand and respond to user questions;
• organize or summarize information;
• support patient engagement;
• provide personalized educational or care-support content;
• identify information that may require attention;
• support clinical workflows;
• analyze monitoring or patient-reported information; and
• assist research and product evaluation.

AI-generated information may be incomplete, inaccurate or inappropriate. ChatDok's AI services are designed as healthcare-support technology and do not replace professional medical judgment or emergency medical services. Where AI is used within a clinical workflow, the role of healthcare professionals and the applicable clinical governance remain important.

We will not make decisions based solely on automated processing where doing so would produce legal effects concerning you or similarly significantly affect you, unless such processing is permitted by applicable law and the required safeguards are in place.

Where Article 22 GDPR or other applicable law gives you specific rights regarding automated decision-making, we will provide the information and safeguards required by law.

We do not sell your personal health information. We may disclose personal data in the following circumstances:

7.1 Service providers and processors

We may use trusted third-party providers to operate our services, such as providers of:

• cloud hosting and infrastructure;
• data storage;
• cybersecurity;
• communications;
• authentication;
• analytics;
• customer support;
• AI and machine-learning infrastructure;
• payment processing;
• software and technical services; and
• other services necessary to operate ChatDok.

Where these providers process personal data on our behalf, we require appropriate contractual and security safeguards.

7.2 Healthcare organizations and care teams

Where you use ChatDok through a hospital, physician, insurer or other healthcare organization, information may be shared with the relevant organization as necessary to provide the service and according to the applicable care pathway. The organization may be the controller for that processing. For example, ChatDok-Navigator may facilitate the transmission of relevant patient-reported information or care updates to an authorized care team according to the configured workflow.

7.3 Healthcare professionals and other providers

Where you request or authorize healthcare coordination, information may be shared with relevant healthcare professionals or organizations involved in your care. We may also disclose information where required or permitted by law to protect your vital interests or comply with legal obligations.

7.4 Research partners

Where appropriate and legally permitted, personal data may be processed with research institutions, universities, hospitals or other research partners participating in a research or clinical validation project. Research participants may receive additional information describing the specific partners, purposes and data involved.

7.5 Legal and regulatory requirements

We may disclose information where necessary to comply with applicable law, respond to lawful requests from public authorities, establish, exercise or defend legal claims, protect the rights, safety or property of ChatDok, users or others, or investigate fraud, abuse or security incidents.

ChatDok and our service providers may process personal data in countries outside Germany or the European Economic Area.

Where personal data is transferred outside the EEA, we will implement an appropriate transfer mechanism where required by GDPR, which may include:

• an adequacy decision of the European Commission;
• EU Standard Contractual Clauses;
• appropriate supplementary measures; or
• another lawful transfer mechanism.

The specific mechanism may depend on the service provider and processing activity. You may contact us at [email protected] if you require further information about applicable international transfers.

We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction. Depending on the service, these measures may include:

• encryption in transit and at rest;
• access controls;
• authentication and authorization mechanisms;
• logging and monitoring;
• security testing;
• infrastructure protection;
• data minimization;
• pseudonymization where appropriate;
• backup and recovery controls; and
• internal policies governing access to personal data.

No internet-based service can guarantee absolute security. We continuously review and improve our security measures in accordance with the nature and risks of the processing.

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law. The appropriate retention period depends on factors including:

• the type and sensitivity of the information;
• the purpose for which it is processed;
• whether you continue to use the service;
• applicable healthcare, regulatory, accounting or legal requirements;
• contractual requirements;
• research or clinical-study requirements; and
• the need to establish, exercise or defend legal claims.

Different categories of information may therefore have different retention periods. Where specific retention periods apply to a particular healthcare service, clinical study or enterprise deployment, those periods may be described in the relevant service documentation or study information.

When personal data is no longer required, we will delete it or anonymize it where appropriate, subject to applicable legal obligations and legitimate retention requirements.

We use cookies and similar technologies on our websites and applications. These technologies may be used for purposes such as:

• essential website functionality;
• authentication;
• security;
• preferences;
• analytics; and
• other optional functionality.

Where required by applicable law, we will request consent before placing or using non-essential cookies or similar technologies. Our Cookie Policy provides further information about the cookies and similar technologies we use and how you can manage your preferences.

Subject to applicable law, you may have the following rights:

Right of access — Article 15 GDPR

You may request information about whether we process personal data concerning you and, where applicable, obtain a copy of that data.

Right to rectification — Article 16 GDPR

You may request correction of inaccurate personal data or completion of incomplete information.

Right to erasure — Article 17 GDPR

You may request deletion of your personal data in circumstances provided by law. This right is not absolute. For example, we may need to retain certain information to comply with legal obligations or establish, exercise or defend legal claims.

Right to restriction — Article 18 GDPR

You may request restriction of processing in circumstances provided by law.

Right to data portability — Article 20 GDPR

Where the legal requirements are met, you may receive certain personal data you have provided to us in a structured, commonly used and machine-readable format and may have the right to transmit it to another controller. This right applies only in the circumstances specified by Article 20 GDPR.

Right to object — Article 21 GDPR

Where processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, you may have the right to object to processing for reasons relating to your particular situation. You may also have an unconditional right to object to processing of personal data for direct marketing purposes.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Rights relating to automated decision-making

Where applicable, you may have rights relating to decisions based solely on automated processing under Article 22 GDPR.

To exercise your data protection rights, contact:

Please provide enough information for us to identify your request and, where necessary, verify your identity.

We generally respond to valid GDPR requests within one month. Where permitted by law, this period may be extended in accordance with the GDPR.

We may request additional information where reasonably necessary to verify your identity and protect your personal data against unauthorized disclosure.

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

For ChatDok GmbH, the competent supervisory authority may depend on the applicable rules and circumstances.

You may also contact the data protection supervisory authority in the EU Member State where you live, work, or where you believe an infringement occurred.

Our services are not universally designed for children, and the minimum age or conditions for using a particular service may depend on the product and applicable law.

Where a service is intended to be used by or on behalf of minors, we will provide appropriate information and safeguards for that service.

Where consent is relied upon as the legal basis for processing a child's personal data in relation to an information society service, the applicable requirements concerning parental authorization and minimum age will be observed.

If you believe that a child has provided personal data to ChatDok in circumstances where this was not permitted, please contact us at [email protected].

You should only provide ChatDok with personal data about another person where you are authorized to do so or where another lawful basis permits you to provide it.

This may be relevant, for example, where a caregiver, family member or authorized representative uses a ChatDok service on behalf of another person.

Please avoid providing unnecessary personal or health information about other people.

ChatDok provides technology to hospitals, healthcare providers, insurers and other organizations. In these deployments, the organization providing or commissioning the service may determine:

• which patients are enrolled;
• which categories of data are processed;
• the purposes of processing;
• the applicable clinical workflow;
• which healthcare professionals receive information; and
• applicable retention requirements.

Depending on the contractual arrangement, ChatDok may act as a processor on behalf of that organization rather than as an independent controller.

Where ChatDok acts as a processor, the relevant data processing agreement and the healthcare organization's privacy information govern the applicable processing relationship.

Patients may therefore receive privacy information from both ChatDok and the organization responsible for their care.

ChatDok may conduct or participate in research, pilot projects and clinical validation activities. These activities may involve products or technologies that are:

• being evaluated in real-world environments;
• undergoing clinical validation;
• being studied in prospective research;
• being evaluated for safety, usability or effectiveness; or
• under development.

Research and clinical validation activities may involve hospitals, universities, healthcare professionals and other research partners.

Where required, participation will be governed by separate participant information and consent documentation.

The processing of personal data for scientific research will be subject to the applicable legal framework and appropriate safeguards. The EDPB recognizes that GDPR provides several possible legal bases and Article 9 conditions for lawful scientific research involving health data; the appropriate basis depends on the circumstances of the research.

ChatDok develops AI infrastructure and healthcare technologies intended to support continuous and personalized care.

Where personal data is used for product improvement, evaluation, safety monitoring, research or AI development, we apply the legal requirements relevant to the specific processing activity.

We seek to minimize the amount of personal data used for these purposes and, where appropriate, use aggregated, anonymized or pseudonymized information.

Pseudonymization does not by itself make information anonymous under the GDPR.

Where consent is the legal basis for a particular processing activity, you may withdraw that consent as described in this Privacy Policy.

Our websites and applications may contain links to third-party websites, applications or services.

Third parties may have their own privacy policies and terms. ChatDok is not responsible for the privacy practices of third-party services that we do not control.

You should review the relevant third party's privacy information before providing personal data to it.

We may update this Privacy Policy from time to time to reflect:

• changes to our products or services;
• changes in applicable law;
• changes in our processing activities;
• new technologies or security practices; or
• changes to our organization.

When we make material changes, we will take appropriate steps to notify you where required by law.

The 'Last updated' date at the beginning of this Privacy Policy indicates when the policy was most recently revised.

If you have questions about this Privacy Policy or how ChatDok processes personal data, please contact us: