Privacy Policy

This summary in plain language is non-binding. It is only meant to provide an overview. Only the following text is binding.

BGGI GmbH in Bonn is responsible for your data on Love Your Life. You can reach us by e-mail with any questions about data protection.

We process your data in order to organise your treatment, manage your account, carry out billing and operate the platform securely.

We process health data only with your explicit consent. Doctors and clinics see your documents only once your case has been assigned to them and released.

For some tasks we use service providers, for example for data centres in Frankfurt, payments, e-mails, video calls and AI. Some are based in the USA. We name each service provider and the purpose.

AI helps with translations, summaries, in the chat and on the phone. It can make mistakes and does not replace medical advice.

You can request information, have data rectified or erased and revoke consents at any time. Much of this can be done directly in the portal under “Privacy”.

How long we store data is set out in the section on the storage period. The details of each processing operation are set out in the following sections.

The controller within the meaning of the DSGVO is:

BGGI GmbH Rostocker Straße 43 53117 Bonn Germany

E-mail: datenschutz@love-you.life · Phone: +49 228 50446781

Please direct data protection enquiries to this postal address or this e-mail address. Data export and erasure requests are additionally available to you in the portal under “Privacy”.

The platform “Love Your Life” is a brand of BGGI GmbH. Where this policy refers to “we”, “BGGI” or “Love Your Life”, this means BGGI GmbH, unless another body is expressly named.

Master data: name, e-mail address, telephone number, date of birth, nationality, address.

Health data (Art. 9 DSGVO): medical documents uploaded by you as well as case, appointment and treatment information.

Usage data: IP address, sign-in times, log data (tamper-proof audit log).

Billing data: cost estimates, invoices, payments including the payment currency, the proof regarding the immediate start of services (§ 11).

Communication and translation data: messages in the case, their source language and machine translations; the original and the translation are stored separately.

Speech and voice data: spoken segments in the AI interpreter, the text recognised from them, its translation and the voice generated from it (§ 13).

Location data: during an ongoing assignment, the interpreter or driver deployed may transmit their own location (§ 14); before a video consultation, the patient confirms their whereabouts (§ 14a). At the meeting point, the patient can share their own location with consent, and the driving service and the passenger can exchange fixed short messages (§ 14).

Verification documents: proof of licensure, permits and licences of doctors, clinics, pharmacies as well as delivery and courier services; passport, visa and identity documents of patients and companions (§ 15).

Payment and bank data: bank details for payouts and refunds, desired payout currency, announcements of bank transfers and incoming payments.

Order and delivery data: prescriptions, pharmacy orders, delivery address and delivery status.

Employee data: working time data of the administration's employees (§ 12).

Device and session data: for each sign-in, one entry with the name of the device, the browser identifier, the application (patient application, application for contributors, administration application or ordinary browser), the shortened IP address, the time of sign-in, the time of last use and any revocation (§ 19).

Scan data: pages of documents captured with the camera, the PDF file generated from them, the text of the pages recognised on your device, the details extracted from it (sender, recipient, date, invoice, customer and file reference numbers, amount and currency, bank details, e-mail address, telephone number, address) and the automated classification (type, title, date, issuer, language), § 20.

Coordination of international medical treatments (case management, matching with suitable doctors and clinics, appointment scheduling).

Account management and authentication, including optional two-factor authentication.

Billing and fulfilment of statutory retention obligations.

Security, error analysis and misuse prevention.

Operation of the promotional programmes “Customers invite customers” and for social media partners, including the prevention of misuse and verification that no members of the healing professions and no persons acting on behalf of a clinic, a practice or a pharmacy take part in them (§§ 25 to 25c).

Answering questions in the chat, on the phone and via WhatsApp, help with filling in forms and processing of incoming and outgoing e-mails, in each case also with the support of AI.

Communication in the video consultation and its follow-up; AI interpreter, transcript and summary only with consent.

Forwarding of enquiries to insurers, transfer of travel data to our travel portal BGGI Travel with your consent, and staff recruitment.

Presentation of provider profiles, acquisition of new providers, handling of complaints and quality assurance of translated texts.

Attachment to an agency upon registration, settlement with agencies and support for agencies in sending e-mails and in acquiring new customers (§§ 25a and 30a).

Proof of which version of the terms and contracts was effectively incorporated into the contract and when, and performance of the contract in the version applicable at the time (§ 26a).

Transfer of your appointments to your Google Calendar with your consent (§ 35a).

Consolidation of the course of treatment across several cases so that doctors have the course available (§ 20a), as well as orders to external diagnostic and service units (§ 18a).

Performance of contract: Art. 6 para. 1 lit. b DSGVO.

Explicit consent to the processing of health data: Art. 9 para. 2 lit. a DSGVO.

Legal obligation, for example retention under commercial and tax law: Art. 6 para. 1 lit. c DSGVO.

Legitimate interest in the security of the platform: Art. 6 para. 1 lit. f DSGVO.

Consent: Art. 6 para. 1 lit. a DSGVO, in particular for optional cookies (§ 25 para. 1 TDDDG), the transfer of travel data to BGGI Travel, the transfer of appointments to your Google Calendar, the public partner card, custom voices and the consent of doctors to the transcript and summary of a video consultation.

Transfer to third countries on the basis of your explicit consent: Art. 49 para. 1 lit. a DSGVO (§ 10).

Performance of the employment relationship: Art. 6 para. 1 lit. b and c DSGVO in conjunction with § 26 BDSG (§§ 12 and 40).

Which legal basis applies to a particular processing operation is stated in the relevant section. Where we base a processing operation on a legitimate interest, we name that interest there.

Treating clinics and doctors obtain access to your case data only after your case has been allocated, after receipt of any outstanding payment and after release by BGGI, and only to the extent of the documents released by BGGI.

We use the following processors pursuant to Art. 28 DSGVO (country of establishment in brackets in each case): • Google Cloud EMEA Ltd. (Ireland): operation of the application, the database and file storage in the Frankfurt am Main data centre (europe-west3), including Firebase Hosting as the delivery layer; operation of our own system BGGI AI Hub (§§ 17a and 40a) with speech recognition and speech output on the phone; speech output of the AI interpreter and the AI assistants with Google Cloud Text-to-Speech (Chirp 3 HD) via the endpoint of the European Union (§§ 13, 28 and 40); operation of our own video server for the video image of the Digital Human in the Frankfurt am Main data centre (§ 22). • Stripe Payments Europe Ltd. (Ireland): payment processing in euros and in US dollars, including for the purchase of voice credit, and reversal of refunded card payments; card data remain exclusively with Stripe. At the request of doctors, hospitals, agencies and service providers, also payouts to their own Stripe account (§ 15). • Resend (USA): sending and receiving of e-mails of the platform via its SMTP access; the sender domain is love-you.life. • Daily.co (USA): video rooms for video consultations; media servers in the EU region (eu-central-1); Daily.co does not record the conversations. • Anthropic (USA): AI processing, namely preliminary analysis of submitted documents, analysis of individual documents and summaries of the course (§ 20a), classification of scanned documents, machine translation of messages, texts and in the AI interpreter, AI form-filling aid, chat “Love Your Life KI Assistant”, answers of the AI assistants on the phone and via WhatsApp (§§ 40a and 40b), AI correction, AI wording and checking of outgoing e-mails (§ 30b), AI texts for e-mails from agencies (§ 30a), classification and suggested replies of the automatic e-mail reply and, only with the consent of both sides, summaries of a video consultation from its transcript. Anthropic processes health data only after your separate consent; results of the preliminary analysis are checked by Love Your Life staff. • ElevenLabs (USA): speech recognition for the AI interpreter, the chat with voice, the live assistance of the administration and, only with the consent of both sides, the transcript of a video consultation without the AI interpreter; speech output only for languages for which Google has no voice, currently Persian, and for the separately bookable text translation with speech output (§ 13); replicated voices of AI personas (§ 40). • Beyond Presence Inc. (USA): video image of the Digital Human in the video call, only if BGGI has switched it on; Beyond Presence receives only the identifier of the face, an access authorisation limited to the individual video room of our own video server and the finished audio of the translation (§ 22). • Sentry (Functional Software, Inc., USA): technical error diagnosis; personal and medical content is automatically removed or masked before transmission; in the browser only after your consent in the cookie banner (§ 9). • Lexware Office, formerly Lexoffice (Germany): transfer of invoice documents to our accounting; the data transmitted are the name and country of the person to whom the invoice is addressed as well as the invoice data, no health data.

Account data: until your account is deleted or until an erasure request has been completed.

Invoice and accounting data: 10 years pursuant to § 147 AO (GoBD).

Audit logs: stored in an unalterable and tamper-proof manner.

Case data and medical documents: they remain stored in the case profile for as long as your account exists, so that you and the treating doctors have the entire course available (§ 20a); no lapse of time deletes them automatically. If you request erasure, we delete them as soon as no statutory retention obligation precludes this; for treatment records, this is generally 10 years (§ 630f BGB applied by analogy).

Communication with clinics by e-mail and in the portal: like case data, because it is part of the case file.

Records of consent: up to 3 years after revocation or deletion of the account (obligation to provide proof, Art. 7 para. 1 DSGVO).

Server logs and security logs: no more than 90 days, unless a security-relevant incident requires longer retention.

Daily encrypted database backups: daily snapshots 30 days, monthly snapshots 12 months, storage location exclusively the Frankfurt region.

Working time data of employees: until expiry of the period set by BGGI (default 400 days, § 12); thereafter automatic deletion, unless a longer statutory retention obligation exists.

Access log of the interface for partner systems: until expiry of the period set by BGGI (default 400 days); thereafter automatic deletion.

Location information of an assignment: it is transmitted and displayed only during an ongoing assignment. The last reported point is deleted when the assignment ends or is cancelled. If the person deployed reports the non-appearance of the patient, the last shared point is first transferred to the audit log as evidence and retained like audit logs. We likewise delete the location that the patient shares with consent at the meeting point when the assignment ends or is cancelled and upon revocation. We delete short messages at the meeting point 90 days after the end of the journey (default set by BGGI).

Video consultations: access to the video room exists only within the time window of the appointment, from 15 minutes before the start until 30 minutes after the scheduled end, and expires thereafter. Audio and video are not recorded. If both sides have consented to the summary, the recognised text of the spoken contributions is stored as a transcript (§ 13a). The appointment details, including the confirmed whereabouts (§ 14a), remain stored as part of the case file.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 DSGVO).

Right to object: where we process data on the basis of a legitimate interest (Art. 6 para. 1 lit. f DSGVO), for example in the misuse comparison of “Customers invite customers” or in the comparison under § 25c, you may object at any time on grounds relating to your particular situation (Art. 21 para. 1 DSGVO).

We make automated decisions within the meaning of Art. 22 DSGVO only in the comparison under § 25c: if an account or an e-mail address is already registered as a doctor, clinic, pharmacy, healthcare professional or care partner, the platform rejects the registration as an agency, active agent or social media partner or does not issue a promotional link. You can demand that a human being review this decision and present your point of view. If a system otherwise reports an anomaly, for example in the misuse comparison or in the checking of outgoing e-mails (§ 30b), a human being decides; you can present your point of view.

You can revoke consents given at any time with effect for the future.

Data export and erasure requests are available to you directly in the portal under “Privacy”.

Right to lodge a complaint: you can lodge a complaint with a data protection supervisory authority; the authority competent for BGGI is the data protection supervisory authority of North Rhine-Westphalia, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

Data protection requests: We record an e-mail to datenschutz@love-you.life as a data protection file, with receipt, type of request, deadline and status; we attach further e-mails in the same thread. The response period is one month from receipt; it can be extended by up to two further months only for a reason (Art. 12 para. 3 DSGVO). We assign a request to an account only if the sender address belongs to exactly one account; otherwise the administration assigns it after review. If you request erasure, we create the erasure request for it.

TLS transport encryption, encryption of sensitive secrets and details such as telephone numbers and bank details (AES-256-GCM), Argon2id password hashing, optional two-factor authentication, role-based access control and a tamper-proof audit log are the technical and organisational measures pursuant to Art. 32 DSGVO.

We use technically necessary cookies for sign-in and session, for the protection of forms, for the language setting, for storing your cookie choice, for the notice of an amended contract version and for recording which of our applications and which phone shell you are using. These are necessary for the operation of the platform (§ 25 para. 2 no. 2 TDDDG; Art. 6 para. 1 lit. b and f DSGVO). The complete list with name, purpose and lifetime is set out in the Cookie Statement. It also lists the entries in your browser's storage, such as your choice of colour scheme (“lyl-theme”), the position of the chat helper on a computer (“lyl.chat-helfer.lage”) and of its tab on phone and tablet (“lyl.chat-helfer.lasche”), the chat history for the lifetime of the browser tab (“lyl.plattformChat.v1”) and a random value during sign-in with Apple or Google (“lyl-sozial-bindung”).

We set optional cookies only with your consent via the cookie banner (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a DSGVO). Your choice is valid for 12 months and can be changed at any time via “Cookie settings” in the page footer. If you choose “Accept all”, this has four effects: one cookie remembers for 30 days via which promotional link of an agency you came to us (“bggi_ref”); another cookie remembers for 30 days the promotional code from “Customers invite customers” (“bggi_kwk”); a third remembers for 30 days the promotional code of a social media partner (“bggi_smp”, § 25b); and error diagnosis in the browser (Sentry, § 5) is started. We do not use statistics or marketing cookies.

Since the introduction of the cookies “bggi_kwk” and “bggi_smp”, we ask for your choice again: consent to “Accept all” given previously does not extend to these cookies. Details are set out in the Cookie Statement.

The purpose of the platform is the organisation and coordination of medical treatments in Germany and in other countries in which Love Your Life cooperates with doctors, clinics and hospitals. At your request, case data may be transferred to treating clinics or doctors outside the European Economic Area, for example in your home country or in the chosen country of treatment.

Such a transfer takes place exclusively on the basis of your explicit consent (Art. 9 para. 2 lit. a, Art. 49 para. 1 lit. a DSGVO) and only to the extent of the documents released by you. In third countries there may not be a level of data protection equivalent to that of the European Union; we point this out before each transfer.

You can revoke your consent at any time with effect for the future, in the portal under “Privacy”. Transfers already made remain unaffected.

Each clinic receives from us its own e-mail mailbox on the platform with an address following the pattern klinik-Name-des-Hauses@love-you.life, for correspondence with BGGI and with its own doctors. The clinic's International Office records the doctors of the hospital with name, e-mail address and specialist field; doctors can also register themselves with an invitation code from the clinic, and the clinic confirms them.

The clinic can pass documents of a case that BGGI has released to the clinic to a doctor of the hospital in two ways: via its mailbox on the platform or directly from the system with a protected link that expires after 14 days. The e-mail with the link contains no health data. Each transfer is logged; the certificate and log are created only once the message has actually been delivered.

The doctor's reply goes to the clinic. We assign it to the case via the case identifier in the reply address, via the case number in the subject line or via exactly one open matter of the known sender; if this is not clearly possible, we submit it to the clinic for assignment and never assign it to another person's case. The clinic confirms the reply, amends it or discards it stating reasons and forwards it to BGGI; all versions are retained.

The legal basis is your explicit consent to the processing of health data (Art. 9 para. 2 lit. a DSGVO) in conjunction with the performance of the contract with you and with the clinic (Art. 6 para. 1 lit. b DSGVO); for the details of the hospital's doctors, our legitimate interest and that of the clinic in orderly cooperation (Art. 6 para. 1 lit. f DSGVO).

For billing purposes, we process per case cost estimates, invoices, incoming payments (amount, date, payment reference), the actual treatment costs and refunds. These data are displayed to doctors and to the treating hospitals to the extent necessary to comply with the agreed cost framework (legal basis: performance of contract, Art. 6 para. 1 lit. b DSGVO). We transfer the associated documents to our accounting system Lexware Office (processor pursuant to Art. 28 DSGVO). If BGGI pays out a refund to you, the credit note for your invoice is also sent there; for a cash payment, we record the receipt number, amount and date there.

If you pay in US dollars, we convert the amount using the daily reference rate of the European Central Bank or, if BGGI has set its own rate, using that rate, and note the dollar amount, the rate and the exchange rate surcharge on the receipt; the booking is made in euros.

If, when opening a case, taking out a membership or ordering an assignment, you request that we begin performance before the withdrawal period expires, we record your declaration and your confirmation that you may thereby lose your right of withdrawal, with the time and version. This serves as proof under § 356 para. 4 BGB and for the billing of services rendered after a withdrawal (Art. 6 para. 1 lit. b and c DSGVO).

Payment on site (“collection”): the administration of Love Your Life and the agency that supports you can create an amount on your case for a service on site and collect it in your presence; drivers and interpreters do so for their own assignment via direct payment (§ 18b). For this purpose, we process the case, your name, the amount and the payment currency, the purpose entered, the collecting person and their organisation, the payment method — contactless by card on the collecting person's phone (“Tap to Pay”), at the card reader, via a QR code or payment link, by bank transfer or in cash, namely at the administration or at an agency, a doctor, a driver or an interpreter for whom BGGI has expressly activated cash payments — as well as the time and status of the payment. We store the purpose only with the collection transaction; it does not appear on the billing document, in notifications or in the audit log. Card data is received solely by our payment service provider Stripe (§ 5); neither we nor the collecting person see it. You receive a notification about the billing document in your portal; for a cash payment, you receive a receipt of the platform with a number. The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and, for billing documents, the statutory retention obligation (Art. 6 para. 1 lit. c DSGVO); if the purpose states information about your health, it is health data, and the processing is additionally based on your explicit consent (Art. 9 para. 2 lit. a DSGVO).

For employees of the administration and of the office system, we record working time data while they are signed in to the administration area: start and end of the session, at one-minute intervals the area or case accessed (only the identifier, no content), whether an input was made in the last minute, as well as the browser identifier. Keystrokes, texts, click targets and contents of cases, messages or documents are not stored.

The purposes are proof of working time (§ 16 of the Working Hours Act, Arbeitszeitgesetz), the allocation of working time to treatment cases for billing and the evaluation by management by day, week and month. The legal basis is Art. 6 para. 1 lit. b and c DSGVO in conjunction with § 26 para. 1 BDSG.

Brief inactivity up to the short break set in the settings (default five minutes) counts as working time; if every signal is absent for longer than the set session gap (default thirty minutes), the session ends automatically. Recipients are exclusively the owner and the administration; there is no disclosure to third parties.

The data are automatically deleted after the period set in the settings (default 400 days), unless a longer statutory retention obligation exists. Each employee can view the data recorded for their account at any time under “My times”; the rights under Art. 15 to 21 DSGVO apply without restriction.

For the review of translated interface texts, we work with external reviewers. They receive an account that in the administration area opens only the “Texts” workspace, their own profile, the security settings and their own notifications. Cases, accounts, messages, documents and financial data of patients or partners are not accessible through it.

We process the account data of the reviewer, their suggestions and comments on texts with the time and, for remuneration by hours worked, the working time at the “Texts” workspace: start and end of the session and, at regular intervals, whether work is being done. Key sequences, screen contents as well as camera and microphone are not recorded.

The minute-by-minute individual data on working time are deleted as soon as the monthly statement has been approved and is undisputed; the hours billed per day are retained as the basis for billing for the statutory retention period. The legal basis is the performance of the contract with the reviewer (Art. 6 para. 1 lit. b DSGVO) and the fulfilment of retention obligations under tax law (Art. 6 para. 1 lit. c DSGVO).

For communication we use machine translation: for messages in the case, for messages to Love Your Life that are translated into the language of the recipient, for a separately bookable text translation with optional speech output and for the AI interpreter in the video call.

Process for the AI interpreter: your microphone signal is cut into short segments at the pauses in speech in your browser; silence does not leave your device. Each segment is sent via our server to ElevenLabs for speech recognition, the recognised text to Anthropic for translation and the translation for speech output to Google Cloud Text-to-Speech via the endpoint of the European Union; for Persian, ElevenLabs generates the voice, and Kurdish appears only as subtitles. The audio recording is not stored in the process; it exists only for the duration of the processing of the respective segment. If the AI interpreter shows an artificially generated face, § 22 applies.

You give your consent to the AI interpreter before the conversation in the same step in which we ask about the transcript and summary (§ 13a). You answer both questions separately with yes or no; one does not depend on the other.

The original and the translation appear as subtitles during the conversation. They are stored only if you have additionally and separately consented to this; a revocation deletes the stored segments. Separately from this, both sides can consent to a transcript for the summary; in that case the original and the translation of the interpreted utterances are additionally stored in encrypted form as a transcript and deleted in accordance with § 13a.

In the case of the separately bookable text translation, the source text, the translation and, if you choose speech output, the generated audio file are stored in your case file. The audio file can only be retrieved via a short-lived address linked to your account. The audio file is generated by ElevenLabs (USA).

When messages are translated, the original wording remains stored; the translation is stored separately and is labelled as machine-generated.

The legal basis is your explicit consent to the processing of health data (Art. 9 para. 2 lit. a DSGVO) in conjunction with the performance of the contract (Art. 6 para. 1 lit. b DSGVO). Without active consent, no machine translation of your health data takes place.

On-site interpreting with Lina: a doctor can send you a link by e-mail via the platform with which you book one hour of interpreting for a conversation on site, even without an account. For this purpose, we process the e-mail address entered by the doctor, only in encrypted form, the languages of both sides, the time and version of your declarations on the immediate start of the service and on machine interpreting, the payment via Stripe as well as the start and end of the session; we store the link itself only as an irreversible hash. The e-mail contains no health information and not the name of the doctor. In the session, what is said is sent section by section at the press of a button, as in paragraph 2, to ElevenLabs for speech recognition, to Anthropic for translation and to Google Cloud for speech output; Lina appears only as a voice, without a face. Audio and text are neither stored nor recorded. If you register via the same link, we assign the booking to your account. The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and, for health information in the conversation, your explicit consent, which you give on the booking page with the consent to machine interpreting (Art. 9 para. 2 lit. a DSGVO); you can revoke it at any time with effect for the future, for example by ending the session.

After a video consultation, the platform uses AI to create a summary of the conversation: one each for the patient and for the doctor, each in their own language. This applies with the AI interpreter as well as with a personal interpreter or without an interpreter. The summary is created no earlier than 10 minutes after the scheduled end and after the last spoken contribution; it appears in the respective portal with the case, and both sides are notified. It is included in the appointment and costs nothing extra.

Before the conversation, we ask both sides whether they consent to the transcript and summary, the patient in the same step as for the AI interpreter. The answer is yes or no in each case and is voluntary. Transcription and summarisation take place only if both sides have said yes. If one side says no or does not answer, no transcript and no summary are created, for neither side; the consultation nevertheless takes place.

Process: audio and video are never stored; only the text of what was said is transcribed. • With the AI interpreter, we store the interpreted utterances, i.e. original and translation, as a transcript. • Without the AI interpreter, i.e. with a personal interpreter or without an interpreter, the patient's browser and the doctor's browser each send their own spoken contributions to our server. Our processor ElevenLabs (USA) converts them into text; we do not store the audio. Transcription takes place only for the patient and the doctor of this appointment and only within the time window of the appointment. For each contribution, the transcript contains the text, for interpreted contributions the translation, who spoke, the language and the time. From the transcript, our processor Anthropic (USA) creates the two summaries. Transcript and summaries are stored in encrypted form.

Further participants: the microphones of further persons, such as a personal interpreter or a companion, are not themselves transcribed. However, what they say may be captured via the microphone of the patient or the doctor. Anyone who brings further persons into the conversation informs them before the start that transcription and summarisation will take place.

The summary is machine-generated and labelled as an AI summary; it does not replace a medical report. It is only intended to reflect what was said in the conversation and to identify unclear points as unclear, but it may contain errors or omissions. It is not a medical finding, not a diagnosis, not a doctor's letter and not treatment documentation of the doctor. The conversation and the documents of the treating doctor remain authoritative.

Interpreters and drivers can transmit their location during an ongoing assignment so that the patient can follow their route. The transmission is switched on by the service provider personally and ends when it is switched off or the page is left.

Only the last reported point (latitude and longitude) and its time, linked to the assignment, are transmitted and stored. No movement profile is created outside the assignment; the location is deleted when the assignment ends or is cancelled; only in the case of reported non-appearance does the last shared point remain in the audit log as evidence (§ 6).

The location is displayed only to the patient of the associated case and to BGGI's administration. For each assignment, we also record the meeting point with the exact address; it can be seen by the patient, the person deployed and the administration. The legal basis is the performance of the contract with the service provider and with the patient (Art. 6 para. 1 lit. b DSGVO).

Location of the patient: At the meeting point, the patient can also share their own location, only during an ongoing assignment and only with explicit consent, which can be revoked at any time. Without consent, we do not store any location, and the person deployed sees only the entered meeting point. Only the last shared point is stored; it is deleted when the assignment ends or is cancelled and upon revocation. The legal basis is your consent (Art. 6 para. 1 lit. a DSGVO).

Short messages at the meeting point: For a journey, the driving service and the passenger communicate exclusively via fixed short messages, for example that someone is at the meeting point or will arrive later; there are no free texts. Only the patient — for family members, the head of the family — and the driver of the assignment can send them, once the assignment has been accepted, from 24 hours before until 6 hours after the planned start (default set by BGGI). The other side receives a notification; telephone numbers are neither displayed nor exchanged, and interpreters do not see the messages. The selected message, the sending side, the time and when the other side saw it are stored; we delete the messages 90 days after the end of the journey. The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO).

Area of operation and requests to driving services and interpreters: drivers and interpreters state an area of operation when registering, i.e. countries and, where desired, cities; they can change it in their area. They receive requests for assignments on site only if the place of assignment lies within this area. They receive a new request as a notification in the portal, according to their settings by e-mail, and as a push notification with the buttons “Accept” and “Decline”. It states the date, time, city and country of the assignment, for interpreting assignments the languages, the number of assignments requested and the duration; before acceptance, it contains neither your name nor a file reference, no address and no information about your health. The assignment goes to whoever accepts first; the others only learn that it has been taken. For a video consultation with a personal interpreter, we send requests, regardless of location, to interpreters who offer both your language and the language of the doctor; for this purpose, we compare these two languages with the languages in their profiles. The legal basis is the performance of the contracts with you and with the person providing the service (Art. 6 para. 1 lit. b DSGVO).

Before each video consultation, the patient confirms in which country, in which city and at which address they are currently staying; the postcode is optional. This refers to the place where they are staying, not the registered address.

The information is stored with the appointment and displayed to the doctor of the appointment so that they know where the patient is during the treatment; the audit log contains only the country. The conversation is not blocked on account of the whereabouts.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and the legitimate interest of the doctor and of BGGI in knowing the place of treatment, for example for emergencies and for the applicable professional law (Art. 6 para. 1 lit. f DSGVO).

Doctors, clinics, pharmacies as well as delivery and courier services provide proof of their licensure or permit upon registration. We store the verification number, the uploaded document and, where provided for, the note of the review. For doctors' numbers from countries with a freely accessible official register, currently the Netherlands and the USA, we query the register automatically and transmit only the number for this purpose; in the other countries, the administration checks on the official verification page and notes the name and date of the check. The purpose is to ensure that only licensed bodies become active (Art. 6 para. 1 lit. b and lit. f DSGVO).

For payouts and refunds, we process bank details (account holder, IBAN, BIC, bank) and the desired payout currency, euro or US dollar. The IBAN of BGGI's accounts and of doctors' payout accounts is stored in encrypted form (AES-256-GCM); only an abbreviated form is displayed.

We transfer payouts from a BGGI bank account. Doctors, hospitals, agencies and service providers may instead choose payout to their own account with Stripe Payments Europe Ltd. (Ireland), insofar as Stripe offers this account in their country. They set up the account on Stripe's site; they provide their name, address, identity and bank details to Stripe there, and BGGI does not receive them. Stripe itself is responsible for these details and their verification; Stripe's terms and privacy policy apply. For this purpose we transmit to Stripe the country, the e-mail address of the account, the type and identifier of the recipient and, for each payout, the amount, currency and payout number. We store the identifier of the Stripe account, the chosen payout route and the status of the account as reported by Stripe (set up, payouts possible, number of outstanding details). The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO).

Uploaded documents are kept in our storage in the Frankfurt am Main region. They can only be retrieved via short-lived addresses linked to the signed-in account and are checked for malware before being stored.

Identity verification: if it is switched on, BGGI employees check on the basis of an uploaded passport or identity card whether the details in the account belong to the person, and record the result with the time. If the name in the account changes afterwards, the verification is reset and must be completed again. The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and our legitimate interest in issuing contracts, letters of invitation and visa documents only for verified persons (Art. 6 para. 1 lit. f DSGVO).

If you order a medicinal product via the platform, we transmit to the responsible partner pharmacy the details necessary for processing and make the prescription available to it for a period limited to 30 days. Each access by the pharmacy to a prescription is logged. Whether a prescription is required is decided solely by the pharmacy; if it requires one, it can request it via the platform directly from your treating doctor, who thereby learns which medicinal products you have ordered. We record the course of your order with times: receipt at the pharmacy, first opening, request for and receipt of the prescription, acceptance or refusal with reason, price, payment, packing, handover and delivery. You, the pharmacy and the administration see this history in your portal or in their areas.

We transmit to the engaged delivery or courier service exclusively the delivery data (name, address, means of contact, pick-up and destination, delivery status). It does not receive prescription contents, diagnoses or prices.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and your explicit consent to the processing of health data (Art. 9 para. 2 lit. a DSGVO); a prescription is always health data.

International delivery: if a pharmacy delivers to a country other than its own, we check beforehand whether you attended an on-site appointment with the prescribing doctor in Germany via the platform, whether the delivery address and, where stored, your country of residence lie outside Germany, and whether the prescription was issued by this doctor via the platform and is valid. The parcel bears a label with the delivery number, QR code, destination country and number of parcels, without your name, your address or the content of the prescription. On the way, the stations of the engaged delivery partner scan the parcel; for each scan, the name, city and country of the station, the time and the scanning account are stored, not the location of a person. In your country, handover takes place only if the delivery partner scans the receipt code that your portal displays for this delivery; it applies only to this delivery and to you until it has been delivered. You, the pharmacy and the administration see the tracking. The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and, for checking the prerequisites, additionally your explicit consent to the processing of health data (Art. 9 para. 2 lit. a DSGVO).

For cooperation with our own partner systems, there is a read-only interface. Only a few fields are released via it: for the person, first name, surname, date of birth, nationality, preferred language, telephone number, e-mail address and the file numbers of open cases; for the case, the file number, status, specialist field, creation date, treating doctor and treating hospital, appointments with time, type, status and place, travel data and the information whether payments are outstanding.

Diagnoses, findings, medical summaries, documents, messages, prescriptions, cost estimates, amounts, addresses, passport data and the freely worded subject of a case are not released.

Access requires an allocated key, of which only a hash value is stored. Each access is logged with time, endpoint, response status, sender address and browser identifier; of a search term, only a hash value is stored, never the term itself.

Recipients of this interface are the BGGI AI Hub, BGGI GmbH's own system for receiving enquiries by telephone and e-mail (§ 17a), and the travel portal BGGI Travel, a business unit of BGGI GmbH, exclusively for the transfer of travel data after your consent and for booking confirmations (§ 35). Each key carries only the rights allocated to it.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and our legitimate interest in orderly cooperation between our own systems (Art. 6 para. 1 lit. f DSGVO).

The BGGI AI Hub is BGGI GmbH's own system. It receives calls and e-mails, puts calls through and keeps the management's calendar; it runs on Google Cloud in the European Union.

Contact lists: agencies keep their own contact lists on the platform, in which they include only contacts that they enter themselves; registered users are never entered there automatically, and no agency receives contact data via this list that it has not recorded itself. BGGI's management keeps its own contact list and can read the agencies' lists. In addition, upon the registration of clinics and doctors, the platform creates a profile with country, language, type of institution and services offered (§ 33).

Business contacts in the Hub: the Hub displays the contacts of doctors, clinics, agencies, medical supply stores and pharmacies, partners, service providers and the administration with name, telephone numbers and e-mail address on a read-only basis, like a subscribed calendar; it does not create a copy of them. Contacts of patients never appear in the Hub.

Calls from the platform: next to a contact, including that of a patient, an authorised person can start a call via the Hub. For this purpose, an order is created which can be redeemed for only two minutes and contains the telephone number only in encrypted form; the Hub receives the number only for the ongoing call and notes in the conversation history only “Call from Love Your Life”. The Hub does not store any patient data in the process. We note the call on the contact without the number.

Calendar synchronisation: we transfer appointments in the management's personal calendar and appointments of the administration in which the management itself is a party to the conversation to the Hub under a concealed identifier and with a neutral title such as “Appointment (Love Your Life)”; the Hub reports back only busy times, working hours and absences, no content.

The legal basis is the performance of the contracts with the contacts and with the agencies (Art. 6 para. 1 lit. b DSGVO) and our legitimate interest in orderly availability and appointment scheduling (Art. 6 para. 1 lit. f DSGVO).

If you need follow-up treatment, a medical aid or patient transport by aircraft, we make an enquiry with a verified care partner: a rehabilitation facility, a medical supply store or an air ambulance service.

Only what is necessary for the price information is transmitted: the case number, the request in words and, if a prescription or medical order is involved, its content. The partner receives your name and address only once you have accepted the order and the service is performed. The partner enters the date and place of a handover or fitting; they are visible to you, your agency and the administration.

The legal basis is the performance of the contract with you (Art. 6 para. 1 lit. b DSGVO); if the request contains health data, it is additionally based on Art. 9 para. 2 lit. h DSGVO. These partners also provide proof of their licence upon registration, insofar as one exists for their country.

Whether a prescription is required for a service of a medical supply store is decided solely by the medical supply store. If it requires one, it states a price only afterwards; you receive a notification about this without the name of the partner, and the administration attaches a prescription from your case, or you upload it yourself. We record acceptance, price, handover and the other steps of your request with times; you see the history without the partner's price, as do the partner and the administration.

Doctors without their own laboratory or X-ray unit can record in their portal the units with which they cooperate, such as laboratories, X-ray, MRI and CT, nuclear medicine, pathology, physiotherapy, dental laboratories and medical supply stores. For this purpose, we process the name, type, address and e-mail address of the unit; the unit receives an invitation to register with a code that is valid for 30 days.

If the doctor directs you to such a unit, the unit receives the order with your name and date of birth and the service requested. You receive a notification with a link, see the total amount and pay in the portal. The unit uploads values, findings and images; they appear with the doctor and in your case. The unit sees only its own orders and uploads. Notifications and the receipt state the unit and its type, not the service requested.

Clinics can create their own departments, such as laboratory and X-ray. These upload exclusively statements, values and results for cases of their own hospital; no separate billing via the platform arises in this process.

The legal basis is your explicit consent to the processing of health data (Art. 9 para. 2 lit. a DSGVO) in conjunction with the performance of the contract (Art. 6 para. 1 lit. b DSGVO); for the details of the unit at the time of the invitation, our legitimate interest and that of the doctor in cooperation (Art. 6 para. 1 lit. f DSGVO). The units process the data under their own responsibility.

Appointments at a unit are entered by the unit on its order, with start, end and place. You, your doctor, the hospital and the administration see the same appointment; you and the unit receive a reminder before the appointment, and notifications do not name the requested service. The agency that supports you sees in its calendar only that an appointment exists, with date and time, not the unit, the service or the place; if the platform has allocated your account to the agency, only an abbreviation and the month. You can switch off this display for the agency in the portal under “Data protection”; for family members without their own account, the head of the family does so.

If a doctor, a hospital or another provider issues a claim via the platform for a service rendered to you on site (“Direct Payment on Site”), we process the sequential number of the claim, the provider, your name and your account, amount, currency, reason and date, the platform share, the status of payment, credit note and reversal and, in the audit trail, the time and acting person of each step. We also store the reason as a template of the provider; only the provider sees its templates.

The claim appears in your portal and in the provider's area; you receive a notification about it. The payment is processed by our payment service provider (§ 5). If the reason mentions a treatment or other information about your health, it constitutes health data.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO), for invoice and accounting data the statutory retention obligation (Art. 6 para. 1 lit. c DSGVO, § 147 AO, § 257 HGB) and, insofar as the reason contains health information, your explicit consent to the processing of health data (Art. 9 para. 2 lit. a DSGVO).

Claims, payments, credit notes and their audit trail are stored like invoice and accounting data (§ 6); a provider's templates until it deletes them or its account is closed.

So that you do not have to sign in again each time you access the platform, a sign-in remains valid for up to 90 days and is extended with each use. Each sign-in receives its own entry in your device list.

The following are stored for each entry: a name derived from the browser identifier, for example “iPhone · Love Your Life App”, the browser identifier itself in abbreviated form, the application used, the shortened IP address (for IPv4 without the last field, for IPv6 shortened to the first four groups), the time of sign-in and the time of last use.

You can sign out each device individually, including from another device, for example in the event of loss or theft, or all devices at once. The sign-out takes effect no later than five minutes later. Only the device identifier and the name are entered in the audit log, never the browser identifier and never the address.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and our legitimate interest in the security of the accounts (Art. 6 para. 1 lit. f DSGVO).

If, when signing in with the second factor, you have chosen to trust a device, the browser or the app stores the cookie “lyl_vertraut”. It contains a random identifier; we store only a checksum of it. The next time you sign in on this device, the code of the second factor is then not required; the password always is. The trust ends when you withdraw it in the portal, sign the device out, sign out all devices, change your password or switch off the second factor; the cookie is valid for at most 400 days and is renewed with each use. The cookie is strictly necessary for the sign-in method you have chosen (§ 25(2) no. 2 TDDDG).

If you capture documents with the camera, the sheet is detected on your device, straightened and made more legible. In the phone applications, this is done by the device's document scanner, in the browser by our own. Only then are the pages transferred to our server; there they are checked, scanned for malware and combined into a single PDF file. The individual images are not kept separately thereafter.

If your device offers text recognition, the text of the pages is read there, on your device and not by us. It is transferred together with the pages, placed invisibly in the PDF file so that the file can be searched, and extracted: sender, recipient, date, invoice, customer and file reference numbers, amount and currency, bank details as well as e-mail address, telephone number and address, insofar as they appear on the document. Text and extracted details belong to the document and are deleted together with it.

To classify the document, i.e. type, title, date, issuer and language, we transmit information to our processor Anthropic. If text has been recognised on your device, this is exclusively that text; images of the pages are then not transmitted. Otherwise, we transmit no more than four pages as images, always the first and the last. The model makes no medical assessment; it only classifies and describes. The result remains labelled on the document as machine-generated and can be changed.

If the model does not recognise a document, nothing is stored.

If you capture in the application for Android phones, the application hands the pages over to our server with a one-time key that expires after 15 minutes, and the web page collects them there; they are then deleted. This is necessary because the Android application cannot pass the pages directly to the web page.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO); if the document contains health data, the processing is additionally based on your explicit consent (Art. 9 para. 2 lit. a DSGVO).

All values, findings and documents remain stored in the case profile so that you and the treating doctors have the entire course available. You can see at any time all your cases and the cases of your family members for whom you are responsible.

For a new case, you can link earlier cases of your own, when opening the case or later, and remove the link again. The doctor of the new case sees documents of a linked case only if BGGI has released them for disclosure, the case has been paid, is not blocked by the clinic office and is not suspended, and your consent to the processing of health data is valid; each retrieval is logged. BGGI's administration can also link cases of the same person; for a new case, the platform shows it earlier cases of the same person that have not yet been linked as a suggestion.

For each case, the AI creates a summary; for this purpose, our processor Anthropic (USA) analyses each document individually. If a payment is outstanding for the case, this analysis begins only after the payment has been received. Each analysis is stored as a separate version with a checksum and an indication of the model; the same file of the same person is not sent to the AI again. From the summaries of linked cases, the AI creates a summary of the course for the new case. BGGI employees review this summary; the doctor sees it only after the review, you yourself after its release. The AI makes no diagnosis; its results are labelled as machine-generated.

The legal basis is your explicit consent to the processing of health data (Art. 9 para. 2 lit. a DSGVO) in conjunction with the performance of the contract (Art. 6 para. 1 lit. b DSGVO). The storage period is set out in § 6.

In our phone apps, the membership is taken out exclusively via the store from which the app originates, i.e. via the Apple App Store or via Google Play. So that the subscription can be assigned to your account and not to the device, we pass a pseudonymous account identifier to the store. It is calculated from your user identifier and cannot be converted back into it; your name and your e-mail address are not transmitted to the store.

The store notifies us of purchase, renewal, cancellation, payment failure, expiry and refund. For this purpose, we store the transaction or purchase identifier, the product identifier, the start and end of the paid period, the status, the environment and the time of the notification as well as the content of the notification in the event log. We do not receive payment data such as card, billing address and amounts from the store.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO) and our record-keeping obligation under commercial and tax law (Art. 6 para. 1 lit. c DSGVO).

On request, the AI interpreter “Lina” can appear as an artificially generated face (“Digital Human”). The video image is generated by our processor Beyond Presence Inc., established in the USA; it moves the lips to the audio that the platform has previously generated. The image runs via our own video server, which BGGI itself operates in the Frankfurt am Main data centre; the provider of the video consultation is not involved.

Only this audio, the identifier of the face used, the address of our video server and an access authorisation valid only for this video room and for no more than 15 minutes are sent to Beyond Presence. Not transmitted are: image, audio and microphone of the participants, subtitles, texts, names and identifiers of persons, appointments or cases. Beyond Presence processes the transmitted audio in a data centre that may also be located outside the European Union, in particular in the USA or in the Middle East.

No recording takes place; our video server does not record anything either. The video room bears a random name without any information about persons, appointments or cases, closes shortly after no browser is connected any longer and is ended after two hours at the latest. The access keys do not leave our server; each browser receives only a short-lived token for the room.

Lina shows a ready-made face from the range of Beyond Presence; BGGI determines which one in the administration. BGGI uses a custom face based on recordings of a person only with that person's consent; name, date and declaration are then recorded. The face is labelled as AI-generated.

The Digital Human appears only if BGGI has switched it on; in conversations with patients only once the review of the provider has been completed and documented, in particular the data processing agreement, data flow, storage, exclusion of use for training, deletion concept and suitability for health data.

The Digital Human is an addition to the audio. If it is not available or not switched on, the voice continues to interpret.

BGGI currently does not use a digital human with a face: the AI interpreters “Lina” and “Maria” interpret by voice only. No data is transmitted to Beyond Presence. Paragraphs 1 to 6 apply again only when BGGI switches on a digital human; this statement will be adapted beforehand.

BGGI employees do not see all matters. In addition to the role and the department, the scope decides: it is either worldwide or limited to certain countries.

The decisive factor is the country of the matter: for patients, their place of residence, alternatively their nationality; for cases and invoices, the country of the associated patient; for doctors and hospitals, their country.

If no country is assigned to a person, they see nothing. An empty field means “not yet assigned”, not “all”. There is only one data set; the separation is a view, not a second system.

Accesses are logged. Changes to the scope are recorded with person, time and extent.

If employees of a country do not process a matter assigned to them within the set period, responsibility reverts to the administration in Germany.

Employees with country responsibility and offices of a country may also have their place of work outside the European Economic Area. If they access matters of their country from there, this takes place only for matters of the assigned country and on the basis of appropriate safeguards pursuant to Art. 44 et seq. DSGVO.

Forwarding to an office: The administration may forward a case to a Love Your Life office for processing; an agency receives a case only if it has been set up as an office. The office then works in the same case file as the administration, without a copy and without price documents, and not on a suspended case; it sees linked earlier cases only if they have also been forwarded to it. Only the owner account of the agency and the members of its office activated by BGGI may process the case. Every forwarding, its end and every access are logged with time and person.

A new case is reviewed first by employees of the country office in the patient's country under paragraph 2, provided that someone with this task has been set up there; otherwise, it is reviewed by the other employees of the administration, never by employees who are responsible only for another country.

Doctors, clinics and hospitals can consent to being presented on the public home page of Love Your Life with a partner card. The card shows exclusively the approved main image, the name, the specialist field and the country. Telephone number, e-mail address, address and website are never shown publicly; further details are seen only by signed-in users.

The legal basis is the consent of the respective partner (Art. 6 para. 1 lit. a DSGVO), which is given in their own profile and can be revoked there at any time with effect for the future. The time of granting and of revocation is recorded in the audit log. After a revocation, the card disappears the next time the home page is accessed; an image already delivered may persist in caches for up to one hour.

If the administration switches on public reviews, the card additionally shows the average and the number of reviews that signed-in patients have submitted in the portal. The reviews themselves, their authors and free texts are not made public.

Whether partner cards and reviews appear publicly at all is decided by the administration via switches that are switched off by default. Figures on doctors and clinics per country are calculated only from actual, approved entries and are never estimated.

In the programme “Customers invite customers”, registered patients receive a personal promotional code with a promotional link and QR code as soon as they have submitted the declaration under § 25c; the owners of the platform also have their own promotional link. Doctors do not receive a promotional link; links issued to doctors in the past no longer have any effect. If a person registers via a promotional link, we record at the moment of registration who invited them and by which route the code was transmitted, via the link or via the cookie (§ 9). Subsequently, only the administration changes this assignment; each change is logged.

Credit and quota: we book the starting credit of the invited person, the credit of the inviting person, its offsetting against invoices, reversals in the event of cancellation or refund and corrections. In addition, we keep the invitation quota of the inviting person, i.e. the number of invitations available to them, and increase it as soon as a person invited by them has been treated; we notify them of each increase without naming the invited person. Of the persons registered via their link, the inviting person sees only the initial letter and the month of registration.

Agency: if the inviting person is supported by an agency, the invited person is also attached to this agency; the agency bears a share of the credit. The agency surcharge then arises for the cases of the invited person, and this agency receives its share as remuneration for its support services; we therefore also process the attachment for settlement with the agency (§ 25a). We point this out, together with the name of the agency, before registration is completed. The agency receives insight into your cases only if you expressly consent to this upon registration.

Misuse comparison: so that nobody invites themselves, we compare the details of both persons when an invitation is made: account, family membership, first name and surname with date of birth, e-mail address, telephone number and address, in each case also those of the billing contacts, as well as names of payers and invoice recipients. Standardised values are compared, for example the last nine digits of a telephone number. If the comparison reveals a match, the assignment remains in place, the credit is not granted for the time being, and a human being reviews the matter; you can comment before a final decision to your detriment.

Control: agencies can switch off invitations for the persons they support; the administration can do so for individual accounts.

The legal basis is the performance of the Conditions of Participation “Customers invite customers” (Art. 6 para. 1 lit. b DSGVO); the misuse comparison is based on our legitimate interest in protecting the programme against exploitation (Art. 6 para. 1 lit. f DSGVO); the agency's insight into your cases on your explicit consent (Art. 9 para. 2 lit. a DSGVO); § 25c applies to the declaration on healing professions. The storage period is set out in § 6.

Every patient account belongs to exactly one agency. If you register as a patient, we record to which agency your account is attached and by which route: via the promotional link or QR code of an agency, including via the cookie “bggi_ref” (§ 9), via an agency code or an identification tag that you enter in the registration form, via the promotional link of a person attached to an agency (§ 25), via the promotional link of a social media partner (§ 25b), via a link of the owners with which a registration is attached to a specific agency, or as a family member of a family account via the agency of that account. If you come via a link with a code, the code field is not displayed and the agency is fixed.

If you come without a link and do not enter a code, the platform automatically attaches your account to an agency. An agency may operate in several countries; the agencies operating in your country of residence are considered first, and among them the classification that the administration sets for each agency decides and, within the same level, the proximity to your place of residence, i.e. same town, same postcode region, same country, same world region. For this purpose, we use the country of residence, place of residence and postcode from your account. If there is no suitable agency in your country of residence or no country of residence has yet been stated, the platform allocates your account to the fallback agency that BGGI designates for this purpose; if you enter your country of residence later, the platform chooses once more. Family members of a family account follow the agency of the head of the family. It is noted with the agency that the platform allocated your account.

We process the attached agency, the route of attachment, the promotional or agency code used, in the case of automatic allocation the classification and proximity according to which the allocation was made, the time and subsequent changes by the administration with acting person, time and reason.

The purposes are support by the agency, the calculation of the agency surcharge and of the agency's share and proof of the attachment vis-à-vis you and the agency. The legal basis is the performance of the contract on the use of the platform (Art. 6 para. 1 lit. b DSGVO); for retention as a basis for billing, our legal obligation (Art. 6 para. 1 lit. c DSGVO).

The attached agency receives the details of your account that it needs for support, such as name and contact details, and the information that you are attached to it. It receives insight into your cases with health data only with your explicit consent (Art. 9 para. 2 lit. a DSGVO). If the platform has allocated your account to the agency, its calendar shows only an abbreviation and the month for your appointments. Agencies process the data under their own responsibility and may be established outside the European Economic Area (§ 5). In its overview of attached persons, the agency sees only figures, no names. Of your documents, the agency sees only the page count and date, not the content or file names, as long as your case has not been forwarded to it as an office for processing (§ 23); § 18a applies to appointments at external diagnostic and service units.

Persons with reach in social media can register as social media partners. For this purpose, we process name and display name, e-mail address, country, the stated channels with platform, channel name, address and number of followers, the approval status with time and acting person, the agency that takes on or has recruited the partner, the personal promotional code with promotional link and QR code, the quota of registrations, the credit and payout bookings, the bank details for payouts and the status of the contract. § 25c describes the declaration on healing professions.

If a person registers via the promotional link of a social media partner, including via the cookie “bggi_smp” (§ 9), we record via which partner they came, whether they were treated and which amounts are booked as a result for them, for the partner and for the agency; their account is attached to the partner's agency (§ 25a). About the invited persons, the partner sees only figures and the status of their amounts, no names and no information on cases or treatments. The agency that takes on the partner sees name, channels, status of the channel verification and status of the partner, not their bank details.

Channel verification: the partner verifies each channel by entering a confirmation code of the platform in the profile or description of the channel; the owners of the platform check the channel and the number of followers and note name, date and result. If the query is switched on, we read the number of subscribers of YouTube channels via Google's official interface. A channel can be assigned to only one partner account.

The purposes are checking the requirements for approval, in particular the minimum number of followers and channels stated more than once, performance of the contract with the partner, the attachment of invited persons, the calculation and payout of the remuneration for the promotional service and settlement with the agency. The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO), for the retention of booking and payout records our legal obligation (Art. 6 para. 1 lit. c DSGVO) and for the cookie consent (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a DSGVO).

We store the partner's details until their account is deleted; credit, payout and settlement bookings for as long as invoice and accounting data, and the attachment of an invited person for as long as the agency attachment (§ 6).

Doctors, dentists, pharmacists, psychotherapists and members of other healing professions and health professions cannot be an agency, active agent, social media partner or inviting person in “Customers invite customers”; the same applies to persons acting on behalf of a clinic, a practice or a pharmacy. Anyone who registers as an agency, active agent or social media partner or wishes to receive a promotional link in “Customers invite customers” therefore declares in the platform that none of these cases applies, in the case of an agency also for its owners, shareholders and managing directors. Without this declaration, no registration is approved and no promotional link is issued; a promotional link issued previously only takes effect again once the declaration has been submitted.

The time of the declaration, the version of the declaration text, the language in which it was displayed, as well as the IP address and the browser identifier with which the declaration was submitted are stored with the account.

In addition, the platform compares the account and the e-mail address with the accounts and addresses registered as a doctor, clinic, pharmacy, healthcare professional or care partner. If the comparison reveals a match, the platform rejects the registration or refuses approval; it does not issue a promotional link, and one already issued has no effect. § 7 para. 3 applies to this decision.

The purpose is to ensure that members of the healing professions do not receive any advantage for the registration, treatment or choice of a patient. The legal basis is our legal obligation (Art. 6 para. 1 lit. c DSGVO) and our legitimate interest in compliance with §§ 299a and 299b of the German Criminal Code (Strafgesetzbuch), which make corruptibility and bribery in the healthcare sector a criminal offence (Art. 6 para. 1 lit. f DSGVO).

We store the declaration and the result of the comparison for as long as the role as agency, active agent, social media partner or inviting person exists and thereafter for three years, calculated from the end of the year in which the role ends. If they are needed in ongoing proceedings, we store them until those proceedings are concluded.

If an account is closed, this always takes place with a reason being stated. In doing so, we create an archive entry: reason, time, the acting person and the e-mail address as it was at the time of closure. The account is blocked; ongoing sign-ins are terminated.

The account's entry remains in place because invoices, contracts, records of consent and audit logs relate to it. Closing an account is not a deletion of your data; you can request deletion separately (§ 7). In that case, content is deleted or rendered unrecognisable, unless a retention obligation precludes this.

E-mail address: depending on the reason, the address is released or remains blocked. Released means: a new, empty account can be created with the same address; the earlier file is not attached. The address remains blocked if the account was closed because of misuse, deception or breach of contract; a new registration with this address is then not possible for the period stated in § 6. The administration determines which reasons lead to a block.

The legal basis is the fulfilment of legal retention and documentation obligations (Art. 6 para. 1 lit. c DSGVO) and our legitimate interest in preventing misuse of the platform through re-registration (Art. 6 para. 1 lit. f DSGVO).

One account per person and role: Before an account is created, the platform checks whether the same person already has an account in the same role. The standardised e-mail address and, for very similar addresses, the name are compared, in each case with the accounts of the same role; accounts in other roles do not count. If such an account exists, the creation is rejected without confirming which address is stored; signing in and resetting the password are offered. The platform submits conspicuous cases to the administration for review with a shortened e-mail address. The legal basis is our legitimate interest in one account per person and role and in preventing misuse (Art. 6 para. 1 lit. f DSGVO).

We may amend the wording of the terms and contracts to which you have agreed. An amended version is displayed to you in the platform before it applies; in addition, we send a notice to the e-mail address stored in your account. You make your decision expressly; silence does not constitute consent. You have 30 days from the first display to make your decision; within this period, we remind you of an open decision.

The following are processed: your account, the type of contract or terms and the designation of the version, the time of display, your decision (agreed, rejected or postponed) with its time, a checksum of the wording to which you agreed, the reminders and warnings we displayed to you, and the sending of the notice by e-mail with time and delivery result. We keep the content of each version in such a way that it remains legible in your file.

The purpose is proof of which version was effectively incorporated into the contract and when, performance of the contract in the version applicable at the time and the reminder of an open decision within the period of 30 days. The checksum serves solely to be able to prove the agreed wording later in unchanged form.

The legal basis is the performance of the contract or pre-contractual measures (Art. 6 para. 1 lit. b DSGVO); for the retention of the proof, our legal obligation (Art. 6 para. 1 lit. c DSGVO) and our legitimate interest in reliable proof of incorporation and in the defence against unjustified claims (Art. 6 para. 1 lit. f DSGVO). If a declaration is based on consent, for example to the processing of health data, we obtain it separately; a contract amendment does not replace it.

Storage period: we keep the log and the agreed versions for as long as the contract runs and thereafter for three years, calculated from the end of the year in which the contract ends (regular limitation period, §§ 195, 199 BGB). If a version forms part of a record that must be retained under commercial or tax law, or if it is needed in ongoing proceedings, we keep it for as long as the retention obligation or the proceedings last and delete it thereafter. If your account is closed or deleted, the log entry remains in place because it documents the contract status (§ 26); content going beyond this is deleted or rendered unrecognisable.

We do not pass this log on to third parties. Access is granted only to employees who need it for contract administration, the providers that operate the platform and the e-mail dispatch for us (§ 5) and, in the event of a dispute or for review, the legal and tax advisers engaged by us.

Instead of using an e-mail address and password, patients can also register and sign in with their Apple or Google account. The buttons appear only if we have set up the respective route; in our iPhone app, the system's sign-in window opens for this.

After the click, you are forwarded to Apple or Google and sign in there. In the process, the provider receives the usual connection data of your browser, in particular IP address and browser identifier, as well as the information that you wish to sign in to Love Your Life. The providers are Apple Distribution International Ltd., Ireland, together with Apple Inc., USA, and Google Ireland Ltd., Ireland, together with Google LLC, USA. They process these data under their own responsibility in accordance with their own privacy notices; a transfer to the USA is possible in the process.

From the provider, we receive the permanent identifier of your account with the provider, your e-mail address and the information whether the provider has verified it and, where transmitted, first name and surname; Apple transmits the name only at the first sign-in. If you have chosen at Apple to hide your e-mail address, we receive a private relay address; Apple forwards e-mails to this address to you. We do not receive your password at Apple or Google.

We store the identifier with the provider together with your account. We link an existing patient account only if the provider has verified the e-mail address and the account has already been confirmed. If no account exists yet, you complete the registration with the same mandatory details and consents as for registration with an e-mail address; we adopt names only in Latin script.

To protect against foisted sign-ins, your browser stores a random value in local storage during sign-in (“lyl-sozial-bindung”, alternatively in session storage). It contains no information about your person, is transmitted to our server at the beginning and at the end of the sign-in and is then removed. The interim state of the sign-in process is transmitted in encrypted form and is valid for no more than 15 minutes, the verified interim state until completion of the registration for no more than 30 minutes.

The legal basis is the performance of the contract on the use of the platform (Art. 6 para. 1 lit. b DSGVO); the random value in the browser is strictly necessary for the sign-in route you have chosen (§ 25 para. 2 no. 2 TDDDG). We store the link until your account is deleted.

A chat “Love Your Life KI Assistant” is available on the pages of the platform, which answers questions about the platform with the help of AI. The answers are generated by our processor Anthropic (USA); they may contain errors. The chat does not provide medical or legal advice and does not ask for health data.

The chat is strictly limited to the area in which you are signed in: patient portal, agency portal, doctor portal, provider portal or administration. It does not retrieve any data from accounts, cases, documents or invoices. Your question, the previous course of this conversation as well as area and language are transmitted to Anthropic. Please do not enter any health information or other personal information in the chat.

The chat in the administration area can be used only by the accounts with the owner role approved for this purpose. There, the chat can propose a change to approved settings; it only takes effect once the signed-in person confirms it. Proposal and confirmation are logged with person and time.

Conversation history: the history is retained when you change pages and after reloading because it is held in the session storage of your browser tab. It ends when the tab is closed and is discarded when you sign out or sign in with another account. On our servers, we do not store your questions and the answers, except for general questions in the answer cache.

Voice: if the voice function is switched on, signed-in persons can speak their question and have answers read aloud. The recording is sent for speech recognition to our processor ElevenLabs (USA), the answer for speech output to Google Cloud Text-to-Speech via the endpoint of the European Union, for Persian to ElevenLabs. Audio and recognised text are not stored; only counters and the booking of consumption on your voice credit are stored. You purchase voice credit via our payment service provider Stripe (§ 5).

Answer cache: to reduce computing effort and costs, we store answers to general questions, separately for each area and language, and then answer the same question in the same area without a new AI call. Only the first, self-contained question of a conversation and the answer to it are stored, if neither indicates any reference to a person or a case. Before storage, our server checks the question and answer for names, contact details, case, invoice and identity document numbers, dates, addresses, health information in the first person and references to one's own data such as “my case” or “my invoice”; in case of doubt, nothing is stored. Questions with such information are never stored and never answered from the cache. A stored entry is not assigned to any account.

In forms of the platform, an AI form-filling aid can make suggestions: it adopts details already stored in your account, your profile or the case in question and suggests wording for your own entries. You decide whether to accept a suggestion; nothing is stored or submitted without your involvement.

Details from the system are suggested by our server itself; they are not sent to the AI model. Only details that the acting person is permitted to see anyway, and only those provided for by the form, are loaded. For wording suggestions, we transmit the texts entered in the form to our processor Anthropic (USA). The model never suggests names, e-mail addresses or telephone numbers; contact details and links are removed from every suggestion.

Medical information, such as complaints, diagnoses or medication, is only sent to the model if valid consent to the processing of health data exists for the patient concerned; without reference to a patient, for example during registration, never. For medical fields, the aid only makes suggestions on what has been entered by the person themselves; suggestions with terms or values that appear neither in the entry nor in the stored details are discarded.

Entries and suggestions are not stored; only a consumption counter is stored. The legal basis is the performance of the contract on the use of the platform (Art. 6 para. 1 lit. b DSGVO), for public forms without an account our legitimate interest in comprehensible form guidance (Art. 6 para. 1 lit. f DSGVO) and for medical information explicit consent (Art. 9 para. 2 lit. a DSGVO).

Incoming e-mails to mailboxes of the platform, i.e. of the administration, of employees and of agencies, can be processed automatically if the automatic reply is switched on. One of three levels applies to each mailbox: only an acknowledgement of receipt without AI; a suggested reply by the AI that a human being checks and approves; or an independent reply that exclusively uses a text from our knowledge base approved by us.

Before any AI processing, our server checks the message without AI: suspicious messages are not answered, automatic senders are skipped. If the message indicates a reference to a person or to health information, it receives only an acknowledgement of receipt and is submitted to a human being; it is then not sent to the AI model.

Otherwise, we transmit the subject and text of the message, shortened and with contact details rendered unrecognisable, together with the approved entries of the knowledge base to our processor Anthropic (USA) in order to recognise the language and the request and, insofar as the level of the mailbox provides for this, to create a suggested reply. The model does not receive data from cases, accounts or price lists. Whether a reply is sent is decided not by the model but by the rule of the mailbox.

The legal basis is our legitimate interest in fast and orderly processing of incoming enquiries (Art. 6 para. 1 lit. f DSGVO) or the implementation of pre-contractual measures and contracts (Art. 6 para. 1 lit. b DSGVO). The storage period is set out in § 6.

If an agency sends an e-mail from its mailbox on the platform, it first selects the type of recipient, i.e. patient, agency, social media partner, doctor or clinic, and the platform adds the matching promotional link and QR code of this agency. Link and QR code contain only the agency's promotional code, no information about the recipient. If someone registers via them as a patient, § 25a applies to the attachment and § 9 to the cookie “bggi_ref”. If a doctor, a clinic, a beauty centre, a service provider, a delivery service or a care partner registers via an agency's promotional link, we record the agency on the account, but only from the code in the link, not from the cookie, and only in the case of an approved agency; before submission, it is displayed via which agency the registration is made and that the agency receives no remuneration for it. The same applies if an agency submits a provider itself. Only BGGI's management sees the overview of this; the agency itself sees only figures about registrations via its link. If a hospital registers via an agency's link or the agency submits it, BGGI separately engages this agency to support the hospital (§ 25a).

For acquiring new customers, the platform provides agencies with ready-made text templates. The agency selects a template, enters the recipient and sends the e-mail itself. Before sending, the agency confirms that it is permitted to write to the recipient and, in the case of advertising, in particular that the recipient's prior express consent has been obtained. The templates contain no promises regarding costs, appointments or treatment success.

The platform can compose the text of the e-mail with the help of AI in the recipient's language; the agency can additionally enter a short sentence of its own, which the AI formulates properly. For this purpose, we transmit to our processor Anthropic (USA) only the type of recipient, the language, the template text with the amounts and the agency's sentence, no name, no e-mail address and no health information; if the sentence contains health information, it is not sent to the AI. The agency sees and changes the text before sending.

The sending agency decides whom it writes to; it is responsible for the origin of the contact data, the existence of consent and the lawfulness of the approach. BGGI provides templates, mailbox and dispatch route, adds the promotional link and QR code and logs the dispatch.

The following are processed when sending: name and e-mail address of the recipient, the selected template and language, the content of the e-mail, the sending agency and the acting person, the time, the agency's confirmation under paragraph 2 and the delivery status. The dispatch is carried out by our processor Resend (USA) (§ 5).

In the platform's mailbox, the writing person can have the AI check a text for spelling and grammar or formulate it from keywords; for this purpose, we transmit the entered text to our processor Anthropic (USA). The writing person sees the result and decides whether to adopt it.

Messages written in the portal to the administration, the technical team or the lawyer of Love Your Life are delivered in the language of the receiving person; for this purpose, Anthropic (USA) translates the text. The original wording is retained alongside, and replies are returned in the language of the writing person.

E-mails sent from a mailbox of the platform to addresses outside the platform, including the automatic replies under § 30, are checked by an AI before sending. Private messages without reference to the platform and messages with patient or health data that may not be sent externally are held back; an e-mail to a body already involved in the case, such as the treating doctor or clinic, may contain the information required for this purpose. For this, we transmit the subject, text and the addresses of the external recipients to Anthropic (USA). Platform notifications from fixed templates, for example about appointments and invoices, are exempt from the check.

If the check holds back an e-mail or if the check is not possible, the e-mail is not sent; the sending person receives a notice in the portal. After its own review, the administration can release a held-back e-mail unchanged or discard it; anyone who opens the text of a held-back e-mail is logged. Only identifiers and reasons, not the content, are entered in the audit log.

The legal basis is our legitimate interest in error-free, comprehensible and secure communication and in protection against the unauthorised disclosure of health data (Art. 6 para. 1 lit. f, Art. 32 DSGVO); if a message contains health information, additionally the explicit consent of the data subject (Art. 9 para. 2 lit. a DSGVO).

In the mailboxes of doctors and clinics, AI assistance in reading and writing is switched off: no draft, no summary, no reply suggestion and no filling aid by the AI. BGGI can switch it on there insofar as this is legally permissible. The check of outgoing e-mails under paragraph 3 applies to all mailboxes.

In the questionnaire of the field of beauty, you can upload photos, for example of the body region concerned, as well as images or documents relating to earlier procedures. Photos help the doctor to assess your wishes. They may show very personal, including intimate, body regions and are health data.

Uploaded photos are treated like other documents of your case: checked for malware before storage, stored in our storage in the Frankfurt am Main region and retrievable only via short-lived addresses linked to the signed-in account. They can be seen only by the persons handling your case, i.e. the doctor and the hospital to which your case is allocated, as well as the responsible Love Your Life employees. Your photos are not shown publicly or used for advertising.

If you have agreed to the AI-supported preliminary analysis, photos may be included in this preliminary analysis and transmitted to Anthropic (USA) for this purpose.

If your case is moved between the medical field and the field of beauty, doctors and hospitals of the new field obtain access to the documents insofar as your case is allocated to them. We inform you about the move.

The legal basis is your explicit consent to the processing of health data (Art. 9 para. 2 lit. a DSGVO) in conjunction with the performance of the contract (Art. 6 para. 1 lit. b DSGVO). The storage period corresponds to that of case data (§ 6).

Doctors, clinics, beauty centres and other providers can upload images to their profile. The images are also maintained by authorised employees of provider support in the administration area, in the case of country responsibility only for providers of their country.

Before storage, we remove the embedded metadata from each image, such as GPS coordinates, camera serial number and time of capture. Each image is checked and approved before being displayed. Anyone who uploads an image confirms that they hold the rights to it and have obtained the consent of the persons depicted.

Approved images are seen by signed-in users in the profile; on the public home page, an image appears only in accordance with § 24. If a provider replaces an image, we keep the superseded version as proof (§ 6); if it removes a current image, we delete its files immediately.

The legal basis is the performance of the contract with the provider (Art. 6 para. 1 lit. b DSGVO) and our legitimate interest in verified and lawful profiles (Art. 6 para. 1 lit. f DSGVO); for persons depicted, their consent vis-à-vis the provider (Art. 6 para. 1 lit. a DSGVO).

We also publish images and videos that providers have uploaded and that we have approved on Love Your Life's own social media channels in order to present the platform and the providers; for this purpose, we may crop, shorten and subtitle them and translate texts and subtitles. The operators of the social networks process published posts under their own responsibility, in some cases also outside the European Union. The legal basis is the contract with the provider (Art. 6 para. 1 lit. b DSGVO) and, for persons depicted, their consent (Art. 6 para. 1 lit. a DSGVO), which the provider obtains and proves to us on request; we publish images and videos showing patients only with their express written consent (Art. 9 para. 2 lit. a DSGVO). After a withdrawal, we remove posts with recordings of the person concerned; after the end of the contract with the provider, we no longer publish any new posts and remove existing posts at the provider's request.

The administration can itself create doctors, clinics via their International Office and delivery services before they register, and then invite them. For this purpose, we process the details also required for self-registration, such as name, specialist fields, address, country, e-mail address and telephone number, as well as the language of the invitation. The details come from the invited body itself or from publicly accessible sources such as websites and directories.

The invitation is sent by e-mail in the selected language and contains a link that is valid for the set period. Until acceptance, it is not possible to sign in to the account; consents and agreement to the contract are given only by the invited person themselves. With the invitation, we provide information about this processing, the origin of the details and the right to object to it. A withdrawn invitation renders the link unusable immediately.

If a clinic or a doctor registers, the platform creates a profile from the details already recorded with country, language, type of institution and services offered. The profiles are grouped by country and searchable for the administration.

The legal basis is our legitimate interest in acquiring and finding suitable partners for the treatment of our patients (Art. 6 para. 1 lit. f DSGVO) and the initiation and performance of a contract (Art. 6 para. 1 lit. b DSGVO). The storage period is set out in § 6.

At your request, Love Your Life obtains a quotation from an insurer for you or a companion, for example for travel health insurance. For this purpose, we transmit to the insurer the details required for the quotation: name, date of birth and nationality of the person to be insured, for companions their relationship to the patient, travel period and destination country.

We collect the insurer's premium together with our processing fee and forward it to the insurer; we show both amounts separately. The insurer issues the policy; we file it as a document in your case file. We receive no remuneration from the insurance company.

Health information is not part of the details we transmit for a quotation. If an insurer requires it for an application, we transmit it only with your explicit consent. The insurer processes the data under its own responsibility. Employees of an insurance partner see only the requests assigned to them.

The legal basis is the performance of the contract with you (Art. 6 para. 1 lit. b DSGVO); for details of a companion, our legitimate interest in carrying out the order you requested (Art. 6 para. 1 lit. f DSGVO).

Your request is processed by the administration of Love Your Life in the insurance area for your country; if it is assigned to an employee of an insurance partner, that person also receives reminders about it. Reminders are sent upon receipt, after a period set by BGGI and before the start of the journey; reminders and internal messages do not name the person to be insured, and after the end of the journey we no longer send reminders. The legal basis is the performance of the contract with you (Art. 6 para. 1 lit. b DSGVO).

If a service provider has registered a trade but has not stored any liability insurance cover in the portal, we show a notice in the service provider portal with a link to the website of an insurance partner.

If the link is accessed, we record who accessed it (name and identifier of the account), when it was accessed and to which partner it pointed. We do not store the IP address or identifiers of the browser or device for this purpose, and we do not use cookies or third-party tracking pixels for this.

The sole purpose is an overview of how often and by whom the notice is used. The legal basis is our legitimate interest in evaluating and improving our own notices in the portal (Art. 6 para. 1 lit. f DSGVO). We receive no remuneration for the notice, and we do not transmit these details to the partner.

Storage period: 24 months from access; thereafter, we delete the details or aggregate them into a count without personal reference.

By accessing the link, you leave our platform. The partner's own privacy notices apply to the partner's website; we have no influence on the processing there and bear no responsibility for it. An insurance contract is concluded exclusively between you and the insurer.

You book flights and hotels on the platform (§ 35b). If BGGI offers the travel portal BGGI Travel for the booking, the following applies: BGGI Travel is a separate business unit of BGGI GmbH; the platform “Love Your Life” and BGGI Travel are separate systems with separate purposes. Only if you separately consent to the transfer of your travel data do we pass on the travel data of your case when you switch to BGGI Travel: case number, first name and surname, destination city and destination country of the treatment, arrival and departure date, number of travellers including companions, country and city of origin, your language and the desired service, i.e. flight or accommodation. Without consent, BGGI Travel opens without these details.

The address with which you switch to BGGI Travel contains no information about your person, only a random identifier; BGGI Travel uses it to retrieve the data from the platform via a secure connection. The data can be retrieved for 24 hours and are deleted on the platform thereafter, or immediately after a revocation. It is recorded which details were transferred and when.

If booking confirmation is switched on, BGGI Travel reports bookings made back, i.e. service, status, booking number, date, time and place, for flights the place of departure, and we display them in your portal. We do not receive prices in the process.

The legal basis is your consent (Art. 6 para. 1 lit. a DSGVO) and, insofar as the details indicate that treatment is planned, your explicit consent (Art. 9 para. 2 lit. a DSGVO). The use of the travel data at BGGI Travel is a different purpose from the organisation of your treatment; it is based solely on your consent. The wording, use at BGGI Travel and revocation are set out in the consent to the transfer of travel data to BGGI Travel.

At your request, Love Your Life transfers your appointments, i.e. treatments, video appointments, journeys, interpreting assignments, delivery windows, trips, appointments for handover or fitting with care partners and appointments at external diagnostic and service units, to a separate calendar “Love Your Life – your appointments” in your Google account and keeps it up to date. This takes place only with your consent to the transfer of your appointments to your Google Calendar and after your authorisation at Google.

For each appointment, the following are transferred: a title that names only the type of appointment and, for doctor appointments, the name of the doctor, start and end, the place, a description with the name of the doctor, name of the institution, case number and status of the appointment, for appointments involving travel the travel time, a link to your portal (for video appointments to the video room, for deliveries to shipment tracking), as well as reminders. Diagnoses, findings, documents, messages, invoices and payment data are not transferred. From Google, we receive an access authorisation, which we store in encrypted form, as well as the identifier and e-mail address of your Google account; we can neither read nor change your other calendars and data at Google.

Google processes the appointments as your own provider in accordance with your contract with Google; the provider for users in the European Economic Area is Google Ireland Limited, Ireland. Google may also process data outside the European Union, in particular in the USA.

The legal basis is your consent (Art. 6 para. 1 lit. a DSGVO) and, insofar as the details indicate that you are receiving medical treatment, your explicit consent (Art. 9 para. 2 lit. a DSGVO); insofar as data reach a country outside the European Union, also Art. 49 para. 1 lit. a DSGVO. If you disconnect the connection, revoke the consent or have your account deleted, we delete the calendar “Love Your Life – your appointments” in your Google account, revoke the authorisation at Google and delete the stored access authorisation.

Patients, agencies and providers can search for and book flights and hotels on the platform, for themselves and for other persons, with or without reference to a case. Searching is possible without signing in; in that case we process only the search details and limit the number of requests per connection. Bookings are made with an account.

For a booking, we process the travellers' details that the airline or the hotel requires: first name and surname, date of birth, gender, e-mail address and telephone number, passport details only if the airline requires them, as well as the connection or hotel, period, seat, baggage, price, booking code and status of the booking. We store the travellers' details in encrypted form. Payment is made first to BGGI via Stripe (§ 5); only then is the booking sent via Duffel to the airline or the hotel. We send the confirmation and booking code to the e-mail address stated and a copy to the person making the booking. Duffel notifies us of changes made by the airline; we pass them on to the person making the booking, to the e-mail address stated and to the agency that made the booking.

If you book for another person, you are responsible for ensuring that this person agrees to the booking and to the disclosure of their details; with the confirmation, the travelling person receives our data protection notice (Art. 14 DSGVO). An agency sees only the bookings of its own accounts.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO), for bookings for other persons also our legitimate interest in carrying out the desired journey (Art. 6 para. 1 lit. f DSGVO), and for billing documents the statutory retention obligation (Art. 6 para. 1 lit. c DSGVO). We delete passport details and date of birth after the period set by BGGI (currently seven months) after the end of the journey; names, contact details, the booking and billing documents remain stored like billing data (§ 6).

Doctors can connect their own calendar at Google, at Microsoft (Outlook, Microsoft 365) or at another provider with CalDAV access, for example Apple, to the platform; this happens only if they release it themselves. We create a separate calendar “Love Your Life – Praxistermine” there and enter the doctor's appointments from the platform: type of appointment with case number, start and end — without names, diagnosis, location and description. From the rest of their calendar we read only when they are busy, i.e. start and end, no content; these times block appointment planning on the platform.

We store the access only in encrypted form. We keep busy times only for the next 60 days in each case and replace them with every synchronisation. If the doctor disconnects the calendar, we delete the calendar “Love Your Life – Praxistermine” at the provider, the access, the transferred entries and the busy times. The provider of the calendar processes the entries under its contract with the doctor; Google and Microsoft may also process data in the USA.

The legal basis for the doctor is their consent (Art. 6 para. 1 lit. a DSGVO) and the performance of the contract (Art. 6 para. 1 lit. b DSGVO); for patients whose case number appears in the title, our legitimate interest and that of the doctor in reliable appointment planning (Art. 6 para. 1 lit. f DSGVO).

Via the platform, we bring healthcare institutions together with skilled workers as well as with self-employed doctors and skilled workers. For this purpose, we process the profiles and documents of the skilled workers, such as contact details with address, qualifications, professional experience, CV, preferred countries, working model and information on the recognition of foreign qualifications, as well as the requirements of the institutions.

Institutions initially see applicant lists without names. They receive documents only after a confirmed proposal and your consent, and contact details only after they have been released. An institution's access to documents ends 30 days after completion of the process.

Please do not upload any information on health, religion or other special categories that is not necessary for the application. We keep applicant data after completion of a process for the period set by us (default 180 days) and delete them thereafter, unless you have consented to a longer inclusion.

The legal basis is the performance of the contract with you or with the institution (Art. 6 para. 1 lit. b DSGVO) and, for the disclosure of documents to an institution, your consent (Art. 6 para. 1 lit. a DSGVO).

Until an institution receives your name and contact details, messages and video calls between you and the institution take place only via the platform; we record the time and the participants, and for video calls also the duration. The platform detects contact details transmitted in messages until then and withholds them. If you report that you have found a position or close your profile, we compare your information on this with the institutions to which your profile was shown via the platform, and inform the management if there is a match. The sole purpose is to check whether a remuneration for our services arises vis-à-vis an institution within the protection period of twelve months; for this, we use exclusively data from the platform and your own information, no other sources, and this does not cost you anything. The legal basis is our legitimate interest in enforcing the remuneration agreed with the institutions (Art. 6 para. 1 lit. f DSGVO).

After completed treatment, a video consultation or a finished assignment, patients can rate doctors, clinics, interpreters and drivers with one to five stars; there are no free texts. Only the average and number are displayed, without the names of the raters; publicly only in accordance with § 24.

The administration can declare reviews that violate the rules invalid, stating reasons; this is logged. Reviews remain stored until your data are deleted in accordance with § 7.

The legal basis is our legitimate interest and the interest of users in reliable empirical values (Art. 6 para. 1 lit. f DSGVO).

In the portal, you may receive reminders and service notices. We always indicate who they come from: notice from your doctor, automatic reminder, notice from Love Your Life or advertising from Love Your Life. You receive advertising only if you have switched it on.

Delivery takes place in the portal and, according to your settings, by push notification or e-mail. For every e-mail that expects a reaction, a notification additionally appears in the portal, which remains open until you react. You can deselect service notices and reminders in the settings; notices on security, appointments and payments cannot be deselected.

The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO); if reminders are based on health information, your explicit consent (Art. 9 para. 2 lit. a DSGVO); you receive advertising only with your consent (Art. 6 para. 1 lit. a DSGVO).

Storage space: if the storage of your own documents reaches 75, 90 or 100 percent of the limit applicable to you, you receive a notice once per threshold and billing period in the portal, according to your settings by e-mail and, if you have allowed them, as a push notification; for family members without their own account, the head of the family receives it. In the portal and in the e-mail, the notice leads to the booking of further storage on our website, in the apps it does not. For this purpose, we process the occupancy in percent, the threshold reached and the period; the marker of a threshold is deleted when the occupancy falls below it again or a new period begins. The legal basis is the performance of the contract (Art. 6 para. 1 lit. b DSGVO).

Content of push notifications: a push notification carries the title and text of the associated notification in the portal and, for requests to driving services and interpreters, additionally the buttons under § 14 paragraph 6. Depending on the settings of your device, it may also appear on the lock screen; whether and how is determined by you in the settings of your device or browser, where you can switch off push notifications at any time.

The voices of our AI personas are generated by Google Cloud Text-to-Speech (Chirp 3 HD) via the endpoint of the European Union and, for languages for which no voice is available there, currently Persian, by our processor ElevenLabs (USA). If the voice of a real person is replicated for this purpose, this takes place only with that person's consent; we record name, date and wording of the declaration. With ElevenLabs, the voice sample is transmitted to ElevenLabs for this purpose.

Custom voices via Google: for a custom voice, the person speaks a short reference recording and their consent in the wording specified by Google; from this, Google generates a voice key in the endpoint of the European Union. We keep the recording of the spoken consent and the signed declaration as proof; we do not store the reference recording. A revocation blocks the voice immediately; before each use, it is checked whether it has been released. Details are set out in the consent to the creation and use of a synthetic voice.

A live assistance is available in the administration, with which employees speak. The voice and text of the employees are sent to ElevenLabs for speech recognition, to Google Cloud, for Persian to ElevenLabs, for speech output and to Anthropic (USA) for answering. The assistance identifies itself as AI.

The legal basis for replicating a voice is the person's consent (Art. 6 para. 1 lit. a DSGVO, insofar as biometric data are processed Art. 9 para. 2 lit. a DSGVO), and for the live assistance the performance of the employment or contractual relationship (Art. 6 para. 1 lit. b DSGVO). Consent to the replication of the voice can be revoked at any time with effect for the future; the voice is then no longer used and is deleted at the provider.

The AI assistant Fabian answers calls to the platform's telephone number. He answers questions about the platform, helps with registration, takes down a health concern for opening a case on request and accepts callback requests and appointment requests. Conversations with the AI appointment assistant Laura are conducted only by persons who identify themselves with a PIN (§ 40c); Fabian handles all other calls. Both introduce themselves as AI at the beginning.

Process: the call is delivered by the telecommunications provider sipgate GmbH (Germany). Our own system BGGI AI Hub (§ 17a) converts the spoken words into text and generates the voice of the answer, both with Google Cloud in the European Union. Love Your Life receives only the recognised text from the Hub, never the audio. The answer is generated by our processor Anthropic (USA) from the text; fixed sentences come from the platform. The voice does not speak Kurdish or Persian; these calls are conducted in Arabic or English, and e-mails afterwards are sent in your language.

The following are stored: a shortened telephone number that cannot be dialled, the telephone number as an irreversible hash value for recognition, the language, the account if the identity has been confirmed, identifiers of the concerns from a fixed list and, in encrypted form, the memory of the ongoing conversation. Fabian assigns a call to an account only when the caller states the telephone identification number of their account and confirms a code that we send to the e-mail address stored in the account; the identification number and code never appear in the conversation history. If the caller does not yet have an account, Fabian asks for their e-mail address in order to send them the link for registration. We store the address in encrypted form in the caller memory so that, on the next call, Fabian only asks whether the same address applies, without reading it out.

Recording a concern: patients with confirmed identity can describe their health concern on the phone. Beforehand, Fabian expressly asks for consent; without a clear yes, he records nothing. With consent, he asks the questions of the specialist field that the case opening on the website also asks, as well as the place of treatment and place of residence, and stores the answers as a prepared case opening in your account. A case is only created when you complete the case opening yourself. We record the consent with version, language and time. In the case of emergency words, Fabian first points out the emergency number; we count the words only as a number, without reference to the call or account.

The platform's telephone number is also the WhatsApp number for customers. If you write to us via WhatsApp, the AI assistant Fabian answers, or an office in your country takes over according to the same country rule as on the telephone (§ 40a). The management is answered by the appointment assistant Laura (§ 40c).

The messages are processed by the operator of the WhatsApp Business Platform from the Meta group, for users in the European Economic Area Meta Platforms Ireland Limited, Ireland, as the provider of the service. For our number, Meta stores the content of messages at rest in Germany; for delivery, Meta may also process data in the USA. On the platform, we store your WhatsApp identifier in encrypted form and as an irreversible hash value, the country derived from the country code, your language and the text of the messages in encrypted form; in conversations with Fabian or Laura, we store messages before identification and messages with a sequence of four or more digits or with health information without their content. We do not download images, voice messages and files; we only note their type.

Via WhatsApp, Fabian provides information only once you have identified yourself: with the telephone identification number of your account and the PIN that you have set in the portal or, as long as no PIN has been set, with a code that we send to the e-mail address stored in the account; an agency identifies itself with the stored telephone number, its code and its PIN. Before that, Fabian points out the emergency number in the case of emergency words, asks for identification and, on request, sends the registration link that matches your role; he passes on requests from agencies and pharmacies, which cannot register themselves, to the management. The identification number, PIN and code never appear in an answer or in the stored history. After identification, Fabian helps within the scope of your account: for each ongoing case, the AI model receives only the identifier, status and next step and, for open invoices, only how many there are; on request, Fabian sends a payment link. To an agency, he states only its own figures, without names. The authorisation ends 30 minutes after the last message (default set by BGGI). If you would like to be called back, a task goes to the agency that supports you, otherwise to the administration. Please do not send any health information or documents via WhatsApp; your portal is available for this.

More than 24 hours after your last message, we no longer write to you via WhatsApp; the only exception is the confirmation of a paid appointment or a paid booking with a template approved by Meta, once per appointment. We do not call customers via WhatsApp.

The AI appointment assistant Laura of Love Your Life accepts appointments, enters them and confirms them. She provides information about open and due processes of the platform and about disruptions only to the authorised persons of the management, after they have identified themselves with a PIN; for this purpose, she reads tasks, e-mails and notifications in their portal as well as the contact lists under § 17a and the profiles under § 33. She gives no information to callers without this identification; their calls are handled by Fabian (§ 40a). Identification by PIN applies on the telephone and via WhatsApp only as long as the BGGI AI Hub reports the management access as enabled; if it is blocked or the report cannot be obtained, Laura gives no information, and an ongoing conversation with this identification ends.

Laura sends e-mails on behalf of the management only after its express confirmation; for every action, the management receives a confirmation by e-mail, which is recorded in the audit log. The answers are generated by Anthropic (USA). Laura passes appointments on to the BGGI AI Hub only under a concealed identifier and without health information (§ 17a). Laura reminds the management of appointments with a call via WhatsApp set up by the BGGI AI Hub, never via the landline; we report to the Hub whether the call permission required for this by WhatsApp exists, with status and time, without telephone number and without content.

The legal basis is our legitimate interest in the orderly management of appointments and processes (Art. 6 para. 1 lit. f DSGVO). If e-mails or processes contain health information, Laura processes it only within the scope of the tasks for which the data subject has given consent and passes it on only to the authorised persons of the management. The storage period is set out in § 6.

We handle complaints about a person or body, for example a doctor, a clinic or a service provider, in up to three stages. We process the complaint with number, description, case concerned, named person or body, status and deadlines. The person or body concerned receives the details necessary for a statement. If a stage is not completed on time, the complaint is automatically submitted to the next stage.

The legal basis is the performance of the contract and our legitimate interest in the quality of the services organised via the platform (Art. 6 para. 1 lit. b and f DSGVO); if the complaint contains health information, your explicit consent (Art. 9 para. 2 lit. a DSGVO). We keep complaints for three years after their conclusion.

We adapt this Policy when processing operations change or new ones are added. We inform registered users of material changes in the portal before they take effect. If processing is based on your consent, we obtain new consent for new purposes.

Number 37 is vacant; it belonged to a deleted section. The other numbers remain unchanged so that cross-references from other texts of the platform remain correct.

This document is available in 24 languages. Only the German version is binding; the other language versions serve comprehension purposes.