Agreement for Employees on Confidentiality and System Use

This summary in plain language is non-binding. It is only meant to provide an overview. Only the following text is binding.

This agreement is not an employment contract. Your salary, your working hours and your holidays are set out in your employment or service contract.

It sets out how you handle confidential data and how you use the systems of Love Your Life.

You do not talk to anyone about patients and internal matters. This also applies after the end of your activity.

You only open health data if you need them for your task. You do not enter them into external AI or translation services.

The platform records your working time and logs accesses. You can view your own times at any time.

You report a suspected data leak immediately. A prompt report will not be held against you.

This agreement does not make your liability stricter, and you pay nothing for it.

This agreement is concluded between BGGI GmbH, Rostocker Straße 43, 53117 Bonn, register court Amtsgericht Bonn, HRB 26753 (“BGGI”), operator of the platform “Love Your Life”, a brand of BGGI GmbH, and the employee who accepts it digitally via the platform (“Employee”).

The agreement applies to all persons who work with an employee account in the administration area of the platform — in administration, case management, medical coordination, accounting and technology, in the head office in Germany as well as in a country office. It does not apply to accounts for the external review of translations; § 7 and the agreement on the external review of translations apply to those accounts.

The subject matter of this agreement is exclusively confidentiality, the handling of data and the use of BGGI's systems.

This agreement is not an employment contract. It governs neither remuneration nor working time as an owed performance, neither holidays nor the termination of the employment or service relationship. The employment or service contract is concluded outside the platform and remains unaffected by this agreement; in the event of contradictions, it takes precedence insofar as it is more favourable to the Employee.

BGGI provides the Employee with a personal account in the administration area, the systems required for their task and, where agreed, devices, and informs them of the rules of this agreement and their changes.

The Employee uses the account, systems and devices exclusively for their official tasks and in accordance with the rules of this agreement.

The Employee complies with the rules of §§ 5 to 17 and with confidentiality under § 22.

BGGI only grants rights to the extent required by the task, takes appropriate technical and organisational measures to protect the data, keeps the time recording and the logs comprehensible for the Employee and receives reports under § 17 without holding a prompt report against the reporting person.

Health data are specially protected data under Art. 9 DSGVO. They are processed exclusively for handling the respective case and only made accessible to persons who need them for their task.

No access takes place out of curiosity, out of personal interest or without reference to one's own task, even if technical access would be possible. Accesses are logged.

Health data are not transferred to private devices, private storage or private mailboxes and are not printed out unless this is necessary for the task.

Health data and other information from cases are not entered into AI services, translation services or other applications outside the platform that BGGI has not expressly approved for this purpose. This also applies to short excerpts and to information that seems harmless in itself.

Employees only receive rights for the areas they need for their task and only at the level required for this: view, edit or approve. Rights are granted exclusively by the owner.

Rights are not extended, not shared and not passed on to others. If it is noticed that a right goes further than the task, this is reported to the administration.

In addition to the rights, the type of employee and the scope determine what a person sees and edits: tasks are only allocated from the areas of the Employee's own type, and anyone restricted to certain countries only sees matters of those countries. If no country is assigned to an account restricted to countries, it sees nothing. Changes to rights and scope are recorded with the person, time and extent.

Accounts of the type “translation review” only see, in the administration area, the “Texts” workspace, their own profile, the security settings and their own notifications. Cases, patient data, tasks, mailboxes, time recording, figures of the platform and information about colleagues are closed to them.

In the “Texts” workspace, correction proposals for interface texts are made. A second person with the right “approve” decides on a proposal; nobody decides on their own proposal. Legal texts are excluded from the workspace.

Employees do not pass on content from other areas of the administration — in particular case and patient data, access data and internal matters — to translation review accounts, not even via messages, comments or screenshots.

For access to the administration area, the second factor can be set up via the method offered on the platform. It is voluntary unless BGGI makes it mandatory under paragraph 2.

BGGI may make the second factor mandatory for all Employees or for individual accounts; there is then no access without an activated second factor. As long as it has not been made mandatory, the platform reminds the Employee to set it up, but only as a notice; a missing second factor then has no consequences for access.

The second factor is personal. Codes, recovery keys and devices are not passed on. The loss of a device or key is reported without undue delay.

For Employees whose role is subject to time recording, the platform records working time while they are logged in to the administration area. The platform visibly indicates that recording is taking place.

The start and end of the session are recorded, and, every minute, the area or case accessed — only its identifier, no content — whether an input was made in the last minute, and the browser identifier. Keyboard inputs, texts, click targets and the content of cases, messages or documents are not stored.

Short inactivity up to the short break specified in the settings, currently five minutes, counts as working time. If every signal is absent for longer than the specified session gap, currently thirty minutes, the session ends automatically. The applicable values can be viewed on the platform.

The purposes are proof of working time under the Working Hours Act (Arbeitszeitgesetz), the allocation of working time to cases for billing, and planning. Management evaluates the times by day, week and month. There is no covert monitoring; individual persons are not evaluated by speed or number of their inputs, and measures under employment law are not based solely on evaluations of the time recording.

Employees can view their own times at any time under “My times” and request a correction. The data are deleted automatically after the period specified in the settings, currently 400 days, unless there is a longer statutory retention obligation. Participation rights of the employee representation remain unaffected.

Tasks on the platform have a deadline. If a task is overdue, the platform reminds the responsible person at regular intervals, currently every 24 hours, additionally after currently three days the head of their country office and after currently seven days the administration. The reminders serve to complete the matter and not to evaluate the person.

Employees of a country office handle the cases of their country within the deadlines of case management: first processing, reminder and completion each in working days according to the office's calendar, currently 3, 5 and 7 working days from assignment. The applicable deadlines are fixed upon assignment and displayed on the platform.

If a deadline under paragraph 2 is not met, responsibility for the case passes automatically to the head office in Germany. This transfer is a rule of case management to protect patients and not a measure against the individual person.

Devices, access data and keys provided are kept carefully and only used for the task. Access data are personal and are not passed on.

Screens are locked when leaving the workplace. From open networks, access only takes place via a secure connection.

Any suspicion of loss or unauthorised use of devices or access is reported without undue delay.

Information about patients is not disclosed privately, not mentioned in private messaging services or social networks and not photographed or recorded.

Even descriptions that appear anonymous can make a person identifiable; they are therefore also not made.

The mailboxes of the platform serve exclusively official purposes. Private use is not permitted.

In the mailbox, the platform offers AI correction of spelling and grammar as well as AI suggestions for messages from keywords, suggestions only for recipients stored in the system. An AI suggestion is never sent on its own. Employees read and check every suggestion in full before sending it; by sending it, they are responsible for the content as for a text they wrote themselves.

No health data and no information that is not necessary for the suggestion are included in keywords for an AI suggestion.

If BGGI switches on the automatic e-mail reply, each person determines for their own mailbox whether it is used and at which level: level 1 only sends an acknowledgement of receipt without AI; at level 2, the AI creates a suggestion that a human approves; at level 3, replies are sent independently, but exclusively with the wording of the knowledge base approved by the owner.

Messages with a personal or health reference only receive an acknowledgement of receipt and are submitted to a human; they do not go to the AI. Suspicious messages are never answered. Appointment requests always become a suggestion; confirmation is only given by a human. Automatically sent messages are labelled as such.

Automatic replies and approved suggestions go out in the name of the respective mailbox and with its signature. Employees do not approve any suggestion containing commitments on prices, deadlines, appointments, refunds or medical questions that go beyond their authority. Only a mailbox of the platform can be designated as a substitute during absence.

Classification, suggestion, approval and dispatch are recorded with the time and the acting person. The log serves the traceability of the replies sent, not the evaluation of individual persons.

Results of AI functions of the platform — correction, suggestion, translation, summary and chat answers — are aids. They may be incomplete or wrong and do not replace a medical, legal or other professional check. Employees only use them with patients, partners or authorities after checking them themselves; paragraph 4 applies to automatic replies at level 3.

From the workspace of a case, Employees write to the patient and to the drivers, interpreters and service providers of the case only via the platform's mailbox, in accordance with the platform's writing rights and using the fixed templates that the platform sends in the recipient's language. The templates state at most the time and place of the appointment and, towards the patient, the name of the person deployed, never health information, telephone numbers or file references. A service provider is written to only about its own assignments. Each message is stored in the case history.

The AI chat in the administration area is only available to owner accounts that have been expressly approved for it. Employees have no access. The chats in the other areas of the platform only answer questions relating to their respective area.

The chat can only propose a change of settings. It does not switch anything itself: a setting only changes when the owner account accepts the proposal via the “Confirm” button; a typed or spoken “yes” is not sufficient. A proposal expires after ten minutes.

Proposal, confirmation, cancellation and rejection are logged with the account and time; the change itself appears in the audit trail of the respective setting under the confirming owner account.

Employees do not use an owner account or a logged-in session of an owner account, do not operate the chat for an owner account and do not cause a confirmation in its name.

If a country office has been activated as a unit for calls via the central number of the platform and Employees are registered there as members, they use the platform's office telephone exclusively for official purposes. Outgoing calls go out with the central number of the platform as the sender and are possible only to Germany and to states of the European Union; calls to other countries are blocked, including to the unit's own country if it is outside the European Union.

Employees only see the calls and contacts of their unit. For each call, the platform logs the time, direction, status, participating member and duration; the other party's number is only stored in encrypted form. The log is deleted after the period specified in the administration, currently 90 days. The platform does not store conversation content.

If messages are sent via WhatsApp to the unit through the central number, Employees answer them only in the unit's mailbox. They can write freely only within 24 hours of the customer's last message; after that, the platform blocks sending, except for an appointment confirmation in accordance with the platform's rules. Employees cannot start calls via WhatsApp.

Via the platform, BGGI provides services of organisation and support. Employees act within this framework: they organise, coordinate, inform and forward concerns to those responsible. The medical, nursing, therapeutic, pharmaceutical and any other professional service is provided solely by the respective service providers; medical decisions are made exclusively by the treating doctors and facilities.

Employees do not give medical, legal or tax advice, do not make diagnoses, do not assess the prospects of success of a treatment and do not give commitments on treatment success, appointments, costs, deadlines or refunds that go beyond their authority and the information shown on the platform. This also applies in medical coordination; its task is organisation, not treatment. Employees forward medical questions to the responsible doctor or facility and legal questions to the administration.

Employees to whom BGGI has granted the right to process payments may, in the “Collect payment” area of the platform, create an amount for a case within their scope and collect payment for BGGI in the presence of the patient; the maximum per transaction stored on the platform applies. Card payments go directly to BGGI. They accept cash only via the platform, against its receipt and in the name of BGGI; they keep it separate from their own money and hand it over in full in accordance with BGGI's instructions. If the cash payments for a case together reach the amount set on the platform (currently 5,000 euros), they accept cash only once the paying person has made the declaration on the source of funds, their identity card or passport has been recorded and the declaration has been confirmed.

Any suspicion of a personal data breach — lost documents, a wrongly addressed message, access by an unauthorised person, a lost device — is reported without undue delay to the administration and to the data protection officer.

The report is made even if the incident was caused by oneself. A prompt report is not held against the reporting person; BGGI's statutory deadlines depend on it.

No fee is owed for this agreement; it is free of charge for both parties. The remuneration for the work performed and its due date result solely from the employment or service contract. Compliance with this agreement forms part of the performance owed under that contract and does not give rise to a separate claim to remuneration.

The agreement begins with the digital acceptance and applies as long as the person works for BGGI with an employee account. It ends with the end of the activity without the need for termination; separate termination of this agreement alone is not provided for. The obligations under §§ 21 and 22 continue to apply.

Upon the end of the activity, all devices, documents, data carriers and keys are handed over without undue delay; access is blocked and ongoing sessions are ended. Copies of business data are not retained.

An employee account is closed via the uniform procedure of the platform. The reason, acting person, time and e-mail address are recorded in the archive, all ongoing sessions are ended and the account is blocked. The entries to which invoices, the audit trail and messages relate are retained as evidence; the deletion of personal data is governed by the Privacy Policy.

If an account is closed due to abuse, deception or breach of contract, the e-mail address remains blocked for a new registration; for other reasons, it is released. The administration specifies which reasons lead to a block.

This agreement does not extend the liability of the Employee. For employees of BGGI, the principles of limited liability in the employment relationship apply; for staff of a country office, the contractual relationship with the Office Partner applies.

BGGI is liable to the Employee in accordance with the statutory rules; this agreement does not limit this liability.

Employees process personal data exclusively on BGGI's instructions and for their official tasks; by accepting this agreement, they are bound to the confidentiality of personal data. This obligation continues after the end of the activity.

BGGI processes the Employee's data arising from the use of the systems — in particular account data, rights, time recording, access and dispatch logs and the call log under § 15 — for the performance of the employment relationship, to protect the data of third parties and to fulfil statutory obligations. Details are set out in the Privacy Policy.

Employees maintain secrecy about all matters that have become known to them in the course of their work. This applies to data of patients, to information from doctors, clinics, agencies and service providers and to BGGI's trade secrets and conditions.

The duty of confidentiality applies towards everyone, including relatives, and continues after the end of the activity insofar as the matters have not become generally known.

Insofar as Employees assist in the professional activity of a doctor or another person who is subject to a professional duty of confidentiality, they are bound to confidentiality as assisting persons; a breach may be punishable under § 203 para. 4 StGB.

Statutory, professional and criminal law duties of confidentiality as well as statutory information obligations remain unaffected. Reports under the Whistleblower Protection Act (Hinweisgeberschutzgesetz) and disclosures permitted under the Trade Secrets Act (Gesetz zum Schutz von Geschäftsgeheimnissen) remain permissible.

BGGI may amend the text of this agreement, in particular to adapt it to a change in the legal situation, to changed systems of the platform or to changed requirements of data protection and information security. The amended version is displayed in the administration area of the platform before it applies. The amended passages are displayed; the unchanged parts continue to apply unchanged.

Consent is given electronically on the platform. The time of consent and a checksum of the version consented to are recorded. Each version remains readable in the account file and can be retrieved there at any time; consent can thus be proven.

In addition, an e-mail about an amendment is sent to the address stored in the account. Irrespective of this, the amendment appears at the next login. The decision can be postponed; the notice then appears again.

Silence does not constitute consent. Without express consent, the version last consented to continues to apply.

If consent is not given, BGGI sends a reminder. If an amendment is urgent or legally mandatory, in particular for reasons of data protection or information security, attention is additionally drawn clearly to it and to the consequences of not consenting. The reminders are sent within 30 days of the first display of the amended version. An amendment is urgent if, without it, the secure operation of the platform, the protection of data or the fulfilment of contractual obligations would be jeopardised; it is legally mandatory if a legal rule, an official or court decision or a binding requirement of a payment service, an app store or a supervisory body requires it and BGGI has no discretion of its own in this respect. The notice states the reason, the passage concerned and the consequence of not consenting. Even an urgent or legally mandatory amendment does not become effective without consent.

Essential terms of the employment or service relationship are not changed by this agreement. Such terms are not changed unilaterally; they are only changed by mutual agreement through an amendment agreement or in accordance with the statutory rules on termination with an offer of altered terms. Failure to consent to an amended version of this agreement does not end the employment or service relationship.

If an amended version is a prerequisite for access to individual systems or areas, access may be restricted until consent is given. The consequences for the activity are clarified outside the platform. Co-determination rights of an employee representation remain unaffected. A restriction can be considered at the earliest after the expiry of 30 days from the first display of the amended version.

The digital acceptance of this agreement and the electronic consent to an amended version via the platform satisfy the text form requirement. Amendments and additions require text form. Individual agreements between the parties take precedence over this agreement.

This agreement is governed by the law of the Federal Republic of Germany. The choice of law does not deprive Employees of the protection of the mandatory rules of the law that would apply in its absence, in particular the law of the state in which they habitually work.

The statutory places of jurisdiction apply to disputes arising from this agreement. The labour courts have jurisdiction for disputes with employees.

Should any clause of this agreement be or become invalid or unenforceable in whole or in part, the validity of the remaining clauses shall remain unaffected. The invalid or unenforceable clause shall be replaced by the statutory rule.

This document is available in 24 languages. Only the German version is binding; the other language versions serve comprehension purposes.

In the event of discrepancies between the German version and a translation, only the German wording applies. Each translation contains this notice in its own language.