How Barmer protects your data

Because security builds trust

Our privacy notice explains everything you need to know about how we use your personal data and about your rights, including:

• how Barmer protects your data and the legal requirements we must follow;
• what data we process when you use our services and benefits, and how we use it;
• the types of data we process and the organisations that support us in doing so;
• your rights and how to contact us.

This privacy notice is current as at XX November 2026.

We are continually developing our services and security standards, so we update this page from time to time. If you have a Barmer user account, we will tell you the next time you log in if we have made changes that affect the nature or extent of the data processing within our services. You can view and print the latest version at any time at barmer.de/datenschutz.

The German version is the authoritative version. The English version is provided for comprehension and translation purposes only.

Data protection at Barmer

Who is responsible for your data and how to contact us

Barmer is the controller responsible for collecting, processing and using personal data in connection with Barmer's digital services and benefits:

Barmer
Axel-Springer-Straße 44
10969 Berlin, Germany
Tel: 0202 568 333 1010
Online: Barmer Email

If you have any questions or concerns about data protection, you can contact Barmer's Data Protection Officer at any time:

Barmer
Datenschutzbeauftragte
42266 Wuppertal, Germany
Email: datenschutz@barmer.de

You can find more information about your rights and further contact details at the end of this page.

Legal framework, key terms and why we process your data

When you use Barmer's digital services and benefits, we process your personal data. We use the following terms on this page:

• Personal data, as defined in Article 4(1) GDPR, means any information relating to an identified or identifiable natural person.
• Health data is one of the special categories of personal data given particular protection under Article 9 GDPR.
• Social data means any personal data processed by social security institutions, such as health insurance funds.

As a public-law corporation, we process your data in order to carry out our statutory responsibilities: maintaining, restoring or improving the health of our insured persons. The main legislation relevant to this is:

• the German Social Code (Sozialgesetzbuch – SGB), in particular SGB V (Book Five), SGB XI (Book Eleven) and SGB I (Book One);
• the General Data Protection Regulation (GDPR);
• the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG);
• the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG)

We may also process personal data if you have explicitly consented to this.

• The lawful basis is Article 6(1)(a) GDPR, where applicable in conjunction with section 67b(2) SGB X. Giving your consent is voluntary and you may withdraw it at any time with effect for the future;
• if the data is needed to carry out tasks under the German Social Code, even where it was originally collected for another purpose;
• if the data is needed for specific research or planning projects relating to social benefits and the requirements of section 75(1) and (2) SGB X are met. 

Health insurance – section 284 SGB V

For health insurance purposes, we process personal data to:

• determine whether an insurance relationship and membership exist, including processing data needed to initiate an insurance relationship;
• issue entitlement certificates and the electronic health insurance card;
• determine whether contributions are payable, the amount of those contributions, who is responsible for paying them and whether they have been paid;
• assess entitlement to benefits and provide benefits to insured persons, including determining whether restrictions on benefits apply, establishing co-payment status and administering procedures relating to reimbursement of costs, refunds of contributions and calculation of the applicable co-payment limit;
• support insured persons in cases involving medical treatment errors;
• cover treatment costs in the cases set out in section 264 SGB V;
• involve the Medical Service (Medizinischer Dienst) or carry out expert assessment procedures under section 87(1c) SGB V;
• settle accounts with healthcare providers, including checking whether claims are lawful and plausible;
• monitor the cost-effectiveness of service provision;
• settle accounts with other social security institutions;
• pursue reimbursement and recovery claims;
• prepare, agree and implement remuneration agreements;
• prepare and run pilot projects, provide care management under section 11(4) SGB V, implement agreements on GP-centred care, special forms of care and the outpatient provision of highly specialised services, including carrying out cost-effectiveness and quality reviews;
• carry out risk structure compensation under sections 266 and 267 SGB V, recruit insured persons for programmes under section 137g SGB V and prepare and run those programmes;
• provide discharge management under section 39(1a) SGB V;
• select insured persons for measures under section 44(4), first sentence, SGB V and section 39b SGB V and carry out those measures;
• monitor whether providers of medical aids comply with their contractual and statutory obligations under section 127(7) SGB V;
• carry out the responsibilities of health insurance funds as rehabilitation providers under SGB IX;
• prepare innovations in healthcare provision, inform insured persons and make offers under section 68b(1) and (2) SGB V;
• make the electronic patient record available for administrative purposes under section 342 SGB V and offer additional applications within the meaning of section 345(1), first sentence, SGB V;
• recruit members;
• reimburse employers' expenditure on continued payment of remuneration under the Expenditure Compensation Act (Aufwendungsausgleichsgesetz – AAG), Continued Remuneration Act (Entgeltfortzahlungsgesetz – EntgFG) and Maternity Protection Act (Mutterschutzgesetz – MuSchG).

Using social data to evaluate services subject to minimum volume requirements

The law sets minimum volumes for certain planned hospital services. The aim is to make sure that complex and elective treatments, such as procedures involving the oesophagus, are carried out often enough for the necessary expertise and experience to be maintained and for a high standard of care to be ensured. The Federal Joint Committee (Gemeinsamer Bundesausschuss – G-BA) sets these minimum volumes and any exceptions on a binding basis in the G-BA Minimum Volume Rules.

We process your social data for scientific evaluations aimed at further developing these minimum volumes. This may also involve processing other information, such as sex and year of birth, or data about services you have received, such as diagnoses or information about hospital stays. The aim is to assess how the minimum volume requirements affect the quality of care. The results are provided to the G-BA so that it can carry out its statutory responsibilities and further develop the minimum volume rules.
The lawful bases for processing your social data are section 9 of the Minimum Volume Rules pursuant to section 136b(1), first sentence, no. 2 SGB V and section 299(1) SGB V.

Long-term care insurance – section 94 SGB XI

For long-term care insurance purposes, we process personal data to:

• determine whether an insurance relationship and membership exist;
• determine whether contributions are payable, the amount of those contributions, who is responsible for paying them and whether they have been paid;
• assess entitlement to benefits, provide benefits to insured persons and pursue reimbursement and recovery claims;
• involve the Medical Service;
• settle accounts with service providers and reimburse costs;
• monitor the cost-effectiveness, billing and quality of service provision;
• conclude and implement care-rate agreements, remuneration agreements and integrated care agreements;
• provide information and respond to enquiries;
• coordinate long-term care support, provide long-term care advice, issue advice vouchers and carry out duties at long-term care support centres;
• settle accounts with other social security institutions;
• carry out statistical work;
• support insured persons in pursuing claims for damages;
• provide information and advice on maintaining, restoring and improving insured persons' health. This also includes helping insured persons develop the knowledge and confidence to manage their own health and take personal responsibility for it (see also section 1 SGB V in conjunction with sections 13 and 14 SGB I).

Data security and safeguards

We follow the applicable data protection and security requirements to keep your data secure and our services stable. The information in this section applies to all Barmer digital services and benefits. Where additional requirements apply to a particular service, we will tell you.

We use state-of-the-art technical and organisational measures to protect your data against unauthorised access, loss or misuse. These include, for example, operating our applications in secure data centres in Germany or other EU or EEA countries, encrypting data in transit using current standards, logging security-relevant access and applying role-based access controls on a need-to-know basis. We review these safeguards regularly and continually develop them further.

Only authorised Barmer employees can access your data, and only where this is legally permitted and necessary for them to carry out their work.

We carefully select our service providers and partners and require them to meet high data protection and security standards as well. You can find more information in the section "Processing personal data in connection with health and long-term care insurance".

You can also help protect your data against unauthorised access and misuse:

• use security features such as automatic device locking, a PIN or biometric authentication on your mobile phone and other devices;
• keep your login details, including your username and password, email address and PIN, secure;
• do not reply to emails from unknown senders;
• use the secure ways of communicating with Barmer that we provide.

When you must provide data

Insured persons are required to provide personal data where it is needed in a particular case or where we are legally required to collect it. This follows from the statutory duties to cooperate under sections 60 et seq. SGB I. We can only carry out our responsibilities fully and conclusively if you provide this data. Providing it can also help avoid delays caused by follow-up queries or disadvantages when we process applications or pay benefits.

This does not apply to information that you provide voluntarily, such as your telephone number or email address. Should you not provide these data, there is no breach of a duty to cooperate, and you will not suffer any disadvantage as a result.

Communicating securely with Barmer

Barmer members and other interested users can contact us in several ways. We follow the National Association of Statutory Health Insurance Funds' "Contact with Insured Persons' guideline" (Richtlinie des GKV-Spitzenverbandes „Kontakt mit Versicherten"), which sets minimum requirements for secure identification and communication. Our aim is to make it easy for you to contact us while also protecting your data. You can always choose whether to contact us by post, telephone or digital channels. 

What data we process 

The personal data we process depends on how you contact us. It may include, for example, your contact details or information used to verify your identity.

• We use secure channels to send sensitive information. Please also avoid sending this type of information through your personal email account or in chats wherever possible.
• For other channels, such as telephone, email or advice at a Barmer Service Point, we have defined minimum standards for identity checks and security.

Purpose of data processing

We process data when communicating with you so that we can:

• verify your identity securely and prevent unauthorised access to your social data;
• deal with your enquiries reliably and in compliance with data protection requirements;
• meet the legal requirements that apply to protecting social data.

Legal basis

Secure communication and identity verification are based in particular on section 217f(4b) SGB V and the associated "Contact with Insured Persons" guideline issued by the National Association of Statutory Health Insurance Funds, which sets out measures for protecting social data.

The processing is also based on Article 6(1)(e) GDPR in conjunction with the relevant provisions of social law. These are listed in the section "Legal framework, key terms and why we process your data". 

Duration of storage

We only keep communication data, such as records, notes or technical log data, for as long as we need it to deal with your enquiry and comply with statutory retention requirements. For messages in Postfach (secure online mailbox) in Meine Barmer, the retention periods set out in the "Meine Barmer" section apply.

Ways to contact us

Chat 

Barmer Chat is available to anyone in the public area of barmer.de. Barmer members can use Barmer Live Chat to chat directly with Barmer employees. You can find more information in the sections "Barmer website – Barmer Chat" and "Meine Barmer – Barmer Live Chat".

Email

Unencrypted email can be read by unauthorised third parties. For this reason:

• Please do not send sensitive social data to us from your personal email account. This includes anything from your health insurance number to a medical report.
• For security reasons, certain attachments may be rejected by our systems. This applies in particular to password-protected files.
• Barmer is not permitted to send sensitive social data by email. If you ask us to send you this type of information, we will reply through your Postfach in Meine Barmer or by post.

For secure digital communication, we recommend using the Postfach in Meine Barmer or our contact form on barmer.de instead of email. 

Online forms and Meine Barmer

Information you enter in contact forms on barmer.de or in the secure Meine Barmer member area is encrypted in transit using current security standards. This helps prevent unauthorised access to personal or sensitive data.

You can use a dedicated contact form to report accessibility issues to us. This feedback mechanism enables us to fulfil our responsibilities as a public-law corporation under direct federal administration in accordance with section 12b(2) no. 2 in conjunction with section 1(2), first sentence, of the German Federal Act on Equal Opportunities for Persons with Disabilities (Behindertengleichstellungsgesetz – BGG). We need your data so that we can respond to you personally.

Response code 

Barmer members can use a response code to submit certain responses and applications directly, even without a user account. To do this, enter the response code that Barmer sent you by post at barmer.de/online-antwort. When you complete the online forms, you will be asked to provide personal data. The data required is shown in the relevant form. The applicable lawful bases are explicitly stated when you start the process. The data you provide to us is used only for the stated purpose and is not disclosed to third parties.

Telephone

If you contact us by telephone with a question or enquiry about your insurance, we will ask you specific questions about your personal data, such as your date of birth or health insurance number (Versichertennummer). This allows us to make sure that we are speaking to the authorised person. ​

Fax

Fax transmissions are not encrypted and involve security risks. As a rule, Barmer therefore does not send sensitive personal data by fax and uses secure communication channels instead.

Barmer Service Point

If you visit a Barmer Service Point for an in-person consultation, we need to be able to verify your identity securely. Please bring an official form of identification, such as your electronic health insurance card or identity card.

Customer satisfaction surveys

From time to time, we ask you for feedback about our communication channels and your interactions with our advisers. For this purpose, we use tools supplied by service providers acting as processors on our behalf under Article 28 GDPR, and we make sure that high data protection and security standards are maintained.

We will usually process: 

• your consent to take part in the survey under Article 6(1)(a) GDPR;
• your feedback on your satisfaction with Barmer and the relevant interaction;
• where applicable, technical information needed to run the survey.

We store your feedback anonymously. Before it is stored, we remove anything that could directly or indirectly identify you or anyone else. Both giving your consent and taking part are voluntary and have no effect on the benefits you receive as an insured person. You may withdraw your consent at any time with effect for the future.

Who we share your data with

We do not share communication data with third parties for their own purposes. Where we use service providers for technical transmission, hosting or communication channels, they act as processors on Barmer's behalf under Article 28 GDPR. They process data only on our instructions and in accordance with our data protection requirements. This applies, for example, to the infrastructure used for Postfach in Meine Barmer and for email. 

Barmer online

Barmer members and other interested users can find extensive information on barmer.de about health topics and Barmer services and benefits. Barmer is also active on a number of social networks.

Barmer website

Our website, barmer.de, provides information about Barmer benefits, contributions and general health topics. You can also access the Meine Barmer member area through the website.​

What data we process

When you visit and browse our website, the browser on your device automatically sends us certain data. This will usually include:

• IP address;
• date and time of the request;
• time-zone difference from Greenwich Mean Time (GMT);
• the content requested – i.e. the page you accessed;
• access status or HTTP status code;
• amount of data transferred;
• HTTP referrer – the page you visited immediately beforehand;
• user agent, including information about your operating system, browser type and version, language settings and similar details;
• type of action or request;
• other data and information used to protect our IT systems against attacks.

This data is stored temporarily in log files. It is not combined with other personal data.

Purpose of data processing

We process this data so that we can make the Barmer website available to you and keep it secure.

We store the data in log files to:

• provide the website and maintain your visit;
• analyse and resolve technical problems;
• monitor and maintain system security and stability.

Legal basis

When you access the website and use it purely for information purposes, we process your data to comply with legal obligations and carry out tasks in the public interest. The lawful bases are, in particular, Article 6(1)(c) and (e) GDPR, section 3 BDSG in conjunction with sections 13 and 14 SGB I, section 1 SGB V and section 25(2) no. 2 TDDDG, where the processing is technically necessary to provide the website.

Duration of storage

Data collected to provide the website is deleted as soon as your session ends. Log files are kept for a maximum of 90 days and are then deleted automatically.

Who we share your data with

We do not share log data generated when providing the Barmer website with third parties unless this is necessary to investigate attacks on our systems or comply with legal obligations. In these cases, we may provide data to the relevant public authorities or to service providers that support us with technical analysis as processors under Article 28 GDPR.

Use of cookies and similar technologies

We use cookies and similar technologies, such as plugins, on the Barmer website. Cookies are small text files stored on your device when you visit our pages. They contain certain information, for example about your settings or how you use the website.

What data we process 

We use both first-party cookies and third-party cookies on the Barmer website. Depending on their purpose, we distinguish between the following types:

• Strictly necessary cookies are needed for our website and key functions, such as access to Meine Barmer, to work properly.
• Analytics cookies create pseudonymous usage profiles showing how our content is used, for example which pages are visited, how often they are viewed and how long users stay on them. This does not allow you to be identified directly.
• Marketing cookies allow us to place advertisements on our advertising partners' websites and measure how effective our campaigns are, for example using remarketing and conversion cookies. Again, this does not allow you to be identified directly.

Purpose of data processing

Cookies and similar technologies allow us to:

• provide the Barmer website and make sure its core functions work properly;
• understand how our content is used and continually improve what we offer;
• show you information and advertising that is as relevant as possible to you.

Strictly necessary cookies are used solely to operate the website. Analytics and marketing cookies help us develop the Barmer offering and tailor it more closely to users' interests.

Legal basis

For strictly necessary cookies, we rely on Article 6(1)(c) and (e) GDPR in conjunction with section 25(2) no. 2 TDDDG because these cookies are essential to the operation of the website.

We use analytics and marketing cookies only if you have given your explicit consent beforehand. The lawful bases are Article 6(1)(a) GDPR and section 25(1) TDDDG.

Duration of storage

Different cookies are stored for different lengths of time. Session cookies remain active only for the duration of your visit and are deleted when you close your browser. We also use persistent cookies, which allow visitors to be recognised when they return after a longer period. You can find the specific retention period for each cookie in the privacy settings.

Who we share your data with

When third-party cookies are used, external providers also receive information about how you use the website. This applies in particular to analytics and marketing providers whose services we have integrated into our website.

You can find detailed information about individual third-party providers, the purposes of processing, the lawful bases and the technologies used in the privacy settings.

Changing your settings or withdrawing consent

You can delete cookies at any time through your browser settings and choose whether cookies may be stored. You can also change your choices or withdraw your consent at any time with effect for the future. To do this, go to the privacy settings.

Barmer Chat

Barmer Chat is an artificial intelligence (AI)-based chatbot and knowledge assistant that draws on content from the public area of our website, barmer.de, and presents it in response to your questions. Using the chatbot is voluntary. You do not need to register or be insured with Barmer.

Barmer members can also use Barmer Live Chat. Once you have logged in to Meine Barmer, you can chat directly with Barmer employees. You can find more information in the "Meine Barmer" section.

What data we process

When you interact with the chatbot, we process:

• everything you enter;
• information about the web page from which you open the chat;
• your IP address;
• log data, such as the time, browser type and device used;
• metadata, such as your language settings and the referring web page.

We use this data to make sure the chatbot works properly. Personal data such as your name, email address or health insurance number is not systematically collected or stored. As a general rule, please do not enter this type of information in Barmer Chat.

Purpose of data processing

The chatbot uses large language models (LLMs) and neural networks to analyze user input and generate responses.

• You can ask questions in natural language and receive relevant, tailored answers without having to search through the website yourself.
• Information from several subject areas can be brought together and presented in a way that fits your question.
• Where useful, we provide links and references to further information and services.

At the end of a conversation, you can choose to provide feedback. We use this feedback solely to improve the chatbot.
Please also read the General Terms of Use for the Barmer website.

Legal basis

The chatbot processes data on the basis of Article 6(1)(c) and (e) GDPR, section 3 BDSG in conjunction with sections 13 and 14 SGB I and section 1 SGB V, as well as section 25(2) no. 2 TDDDG, because the chatbot forms part of the services available on our website and is technically necessary to provide this service.

Duration of storage

We delete the contents of the conversation – your questions, the chatbot's answers and any feedback – after 12 months. Log data and metadata needed to operate the chatbot are deleted as soon as they are no longer needed for the purpose for which they were collected, and no later than four weeks after collection.

You can stop using Barmer Chat at any time by closing the chat window. We will not process any further input from you after that point. Data already stored will be deleted in accordance with the periods set out above.

Who we share your data with

We do not share data processed in connection with your use of Barmer Chat with third parties. Your input is not used to train external AI models.

Third-party services

We integrate services from third-party providers, such as YouTube and Google Maps, into the Barmer website so that we can provide additional content and functions. This external content is disabled by default and is loaded only if you actively choose to enable it.

What data we process

If you enable external content, the relevant third-party provider may receive information transmitted by your device. This will typically include:

• your IP address;
• basic technical information such as your browser and device type;
• the page you accessed on barmer.de;
• the time of access and, where applicable, other technical log data.

Third-party providers may also place cookies or use similar technologies on your device to process usage data or personalise content.

Purpose of data processing 

We use third-party services so that we can show videos or provide map functions. This makes our services easier to use and can make our information easier to understand.

The third-party providers use the data to provide their services and, depending on the provider and its own privacy notice, may also use it for analytics or marketing.

Legal basis

We integrate external services only if you have first given your consent in the privacy settings or directly in relation to the relevant content. The lawful basis is Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw your consent to the processing at any time with effect for the future.

Where the processing is necessary for us to carry out our tasks in the public interest, Article 6(1)(e) GDPR in conjunction with section 3 BDSG, sections 13 and 14 SGB I and section 1 SGB V may also apply.

Duration of storage

Retention periods are determined by the relevant third-party providers. You can find more information in the privacy notice for the relevant service, for example Google or YouTube.
Information about retention periods for individual services and the technologies used is also available in our privacy settings.

Data security

Third-party providers are responsible for the security of the data they process. Please be aware that these providers may be based outside the European Union, where the level of data protection may be lower than in the EU.

Who we share your data with

If you enable external content, your data – in particular your IP address and usage data – may be transferred to and processed by the relevant provider. Where a provider is based in the United States, it cannot be ruled out that public authorities may gain access to the data without you having any legal means of challenging that access.

You can find more information about how third-party providers process data in their privacy notices and in our privacy settings.

Disabling third-party content

You can stop third-party content from being integrated at any time by disabling the relevant categories in our privacy settings and thereby withdrawing your consent. You can also delete cookies and other information already stored through your browser settings. 

Social media channels

Barmer has profiles on a number of social networks, including Facebook and Instagram (Meta), YouTube, TikTok, Xing and LinkedIn. We use them to communicate with users and share information. Our website contains links to these platforms through the relevant icons.

What data we process

If you click on a social network icon, your browser establishes a direct connection with the relevant service provider. In particular, the provider may be able to tell that you have visited a particular page on barmer.de or used a particular service.

We have no control over the exact amount of data that the provider collects and processes as a result of the link.

Purpose of data processing

We use our social media profiles to provide information about Barmer services and health topics and to engage with interested users. Posts and comments help us improve the advice and service we provide.

The social media providers themselves use the data, among other things, to provide their services, produce statistics and improve their own offerings.

Legal basis

Where we communicate with you or provide content through our social media profiles, the processing is based on Article 6(1)(e) GDPR in conjunction with Barmer's statutory social insurance responsibilities.

Any processing carried out by the platform operators is governed by their own privacy notices and any other applicable lawful bases, in particular consent you have given to them.

Duration of storage

The length of time your posts and interactions remain stored on social networks is determined by the relevant provider. We do not store personal data relating to individual visitors to our social media profiles in our own systems. We use comments and other feedback only to improve what we offer.

Data security

Please do not post sensitive or confidential information in public comments. As a statutory health insurance fund, we have a particular duty to protect insured persons' data and cannot deal with personal matters through public channels.

We recommend checking the privacy settings on your social media profiles regularly and sharing only content that you want to be publicly visible.

Who we share your data with

Most of the data processing is carried out by the relevant social media platforms. Where we have access to statistical analyses such as Facebook Insights, we receive only aggregated and anonymised data that cannot be used to identify individuals.

Please be aware that when you visit social media channels, personal data is transferred to the relevant social networks. These services process personal data in accordance with their business models. Processing may also take place outside the European Union. We have no control over how these companies process data, particularly how they use it, disclose it to third parties or how long they keep it.

Leaving our social media channels

You can leave our social media pages at any time and delete your own posts or comments using the options provided by the relevant platform. If you have a specific enquiry about your insurance, please use one of our secure contact channels, such as Meine Barmer or Barmer Email. You can find an overview in the section "Communicating securely with Barmer".

Information and communications by email

We contact Barmer members and other interested users by email in a number of situations, for example to send information that is particularly relevant and tailored to them. We do this only where we have explicit consent.

Newsletter

You can subscribe to email newsletters through our website and social media platforms. These contain information about health topics as well as Barmer services and benefits. All newsletters are sent by Barmer. 

What data we process

When you subscribe to a newsletter, we need a valid email address. To make sure that the subscription request really came from you, we use a double opt-in (DOI) process:

1. You enter your email address in the subscription form.
2. We send a confirmation email containing a link to that address.
3. You click the confirmation link. Your subscription to the newsletter then becomes active.

To keep a record of your consent, we log the subscription request, the sending of the confirmation email and the time you confirmed your subscription, including your IP address.

Depending on the subject of the newsletter, we may ask for additional information that we need to send you the newsletter you have chosen, such as your due date for a pregnancy newsletter.

If you complete a Barmer form on Instagram, we ask for your name and email address. We need this personal data so that we can contact you to send newsletters. Meta transfers the data to Barmer. We use it only to contact you and send you information about Barmer services and offers.

Purpose of data processing

We process your data so that we can email you newsletters on the topics you have chosen. We may also contact you if we make changes to our newsletter offering or need to send you technical information. The double opt-in process helps make sure that you receive only information that you have requested and that is relevant to you.

Legal basis 

We process your data for newsletter distribution on the basis of your consent under Article 6(1)(a) GDPR. Giving your consent is voluntary. You may withdraw it at any time with effect for the future.

Duration of storage

We keep data relating to a newsletter for as long as you remain subscribed. Your subscription begins when you click the confirmation link in the email and thereby complete the double opt-in process. If you do not click the link, we keep your subscription data for up to six months. The link then expires and can no longer be used to complete the subscription.

If you unsubscribe, your data is transferred to a suppression list. It remains there for statistical purposes for up to six months and is then deleted automatically. You can subscribe to a newsletter again at any time.

Who we share your data with

We use a service provider to distribute and manage our newsletters. The provider acts as a processor on our behalf in accordance with section 28 GDPR. All data processing takes place in Germany. We only disclose data to other third parties where we are legally required to do so.

Unsubscribing

You can withdraw your consent to receive a newsletter at any time using the unsubscribe link at the end of the relevant newsletter. Unsubscribing applies only to that newsletter. You will continue to receive any other newsletters to which you are subscribed. If you receive another issue after unsubscribing, this will be for technical reasons and happens only in exceptional cases.

If you unsubscribe from all newsletters and offers to which you are subscribed, any consent you have given to personalisation will also cease to apply. 

Personalisation and prospect profiles 

We want our communications to be more relevant and better tailored to you. In various situations – for example when you subscribe to a newsletter or register for an online seminar – we therefore ask for your consent to send you personalised information about Barmer services and offers. If you explicitly agree, we create a prospect profile for you and use it to send you information that is relevant to your circumstances.

What data we process

Depending on the consent you have given, we may process the following information in your prospect profile:

• Personal details – title, first name and surname, telephone number, email address, date of birth, sex, address, information about children and employment status, your due date where applicable, and interests you tell us about;
• Insurance information – whether you are a Barmer member and your insurance status;
• Newsletter usage data – which newsletters you subscribe to, whether you open them and which links you click;
• Information you provide voluntarily elsewhere – for example participation in online surveys, online seminars or prize draws. 

We combine this information in a single profile only if you have explicitly consented to this.

Purpose of data processing

We want to tailor our information more closely to your interests. Your prospect profile enables us to send you targeted information about Barmer services and offers that fit your circumstances – for example depending on whether you are pregnant or at a particular stage of family life, studying or starting your career. 

Legal basis

We create the profile only on the basis of your consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.

Duration of storage

We process your data for as long as your consent to personalisation remains in place. For statistical purposes, the data is kept for up to six months after your consent ends. It is then deleted automatically.​

Who we share your data with

To provide personalised information, we use a campaign management system supplied by a service provider based in Germany. The provider acts as a processor on Barmer's behalf under Article 28 GDPR and uses data from your prospect profile only on Barmer's instructions to send newsletters or information materials and carry out related statistical analysis. All data processing takes place in Germany. The service provider does not use the data for its own purposes or for the purposes of other third parties. 

When we stop using your profile

We use your prospect profile for as long as your consent to personalisation remains in place and you are subscribed to at least one of our newsletters or are taking part in one of our offers.

Digital information material

You can order digital information materials and brochures from various parts of the Barmer website. We send a download link to the email address you give us when placing the order. The sender is always Barmer.

What data we process

We need a valid email address to process your order. To make sure that the order really came from you, we use a double opt-in (DOI) process:

1. You enter your email address in the order form.
2. We send a confirmation email containing a link to that address.
3. You click the confirmation link. Your order is then confirmed and we send you the download link for the digital information material you requested.

For each step, we log the time and your device's IP address to help prevent misuse and technical attacks, such as large numbers of automated orders.

If you complete a Barmer form on Instagram, we ask for your name and email address. We need this personal data so that we can contact you to send digital information materials. Meta transfers the data to Barmer. We use it only to contact you and send you information about Barmer services and offers.

Purpose of data processing

We process your data so that we can provide the digital information material you requested by download link and make sure that the order was authorised by you. The process also helps us identify and prevent technical attacks and misuse that could, for example, overload our servers.

Legal basis 

The lawful basis for sending the download link and processing your email address as part of the double opt-in process is your consent under Article 6(1)(a) GDPR. You give this consent by clicking the confirmation link in the email.

Duration of storage

We keep data relating to your order for digital information materials for up to 49 days. It is then deleted automatically. If you do not complete the double opt-in process, your email address remains stored in the technical log of the mailing system to the extent necessary to comply with obligations to provide information.

You may withdraw your consent to the processing of your data at any time with effect for the future.

Who we share your data with 

We do not disclose your data to third parties for their own purposes. Where we use service providers for distribution and logging, they act as processors on Barmer's behalf under Article 28 GDPR. They process data only on our instructions and in accordance with our data protection requirements.

Information and advice via email

If you are insured with Barmer, we regularly email you information about health matters and about your rights and responsibilities as an insured person. This allows us to fulfil our statutory duty under the German Social Code (SGB) to provide information and advice.

What data we process

We use only the data that is strictly necessary to send this information to our insured persons. This will usually be:

• the email address that you have voluntarily provided as part of your insurance relationship with Barmer;
• other personal details, such as your name, so that we can address you personally.

We do not create any further profile of you for marketing purposes in this context.

Purpose of data processing

Our aim is to give you clear information about relevant benefits, preventive healthcare and support services, as well as changes in the law. This helps you make informed decisions and take personal responsibility for matters relating to your health and insurance.

Legal basis

The lawful basis for this processing is our duty to provide information and support for self-help under section 13 SGB I in conjunction with section 1(1) SGB I and section 1 SGB V. The processing is necessary for Barmer, as a public-law corporation, to carry out the tasks entrusted to it under the German Social Code (SGB), in accordance with Article 6(1)(e) GDPR. 

Duration of storage

We use your email address only for as long as we need it to fulfil our statutory duty to provide information and advice or until you object to its use. After that, we will no longer use your email address for this purpose. General retention requirements, for example under social law, remain unaffected.

Who we share your data with

We do not share your data with third parties for their own purposes. Where we use service providers to distribute or technically manage mailings, they act as processors on our behalf under Article 28 GDPR.

Opting out

You can object at any time, with effect for the future, to the storage and use of your personal data for this purpose. Every mailing contains an opt-out link at the end of the email. If you use this link, you will be unsubscribed from all customer mailings within 24 hours.

This does not affect newsletters to which you have subscribed separately. You will continue to receive those unless you unsubscribe from them separately.

Online prize draws

Barmer runs online prize draws and is responsible for administering them. You can find detailed information about each prize draw in the relevant terms and conditions of entry. Details such as retention periods and the service providers involved may differ from one prize draw to another.

What data we process

If you enter a prize draw, Barmer processes the personal data needed for you to take part, for us to run the prize draw and for us to administer any prizes. Without this information, you cannot enter and we cannot administer the prize draw. Depending on the particular prize draw, we may collect:

• your postal address or email address, so that we can contact you if you win and send you the prize or make it available to you digitally;
• your telephone number, so that we can contact you if there is an error in the other details you have provided;
• your date of birth, so that we can check your age where there is an age restriction.

For online prize draws, we often collect and process data using a double opt-in process. This allows us to make sure that the email address provided really belongs to you. Emails may be sent and the double opt-in process may be technically managed by our email service provider based in Germany.

If you complete a Barmer form on Instagram, we ask for your name and email address. We need this personal data so that we can contact you in connection with the prize draw. Meta transfers the data to Barmer. We use it only to contact you in connection with the prize draw and send you information about Barmer services and offers.

Purpose of data processing

We process your data so that:

• you can enter the prize draw;
• we can run the prize draw and select the winners;
• we can notify you if you win and send you the prize or make it available to you digitally;
• we can check that you meet the entry requirements, such as a minimum age.

Legal basis

We process your data to allow you to enter and to administer the prize draw on the basis of Article 6(1)(b) GDPR, because the processing is necessary for the performance of the prize draw contract.

If you also consent to receiving information about Barmer services and offers, this additional processing is based on Article 6(1)(a) GDPR. You can withdraw your consent to the processing of your data at any time with effect for the future. We do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR. Winners may be selected automatically at random. This does not constitute automated decision-making within the meaning of the GDPR.

Duration of storage

We keep your data for the duration of the prize draw and while it is being administered, including while prizes are being sent out. After that, we retain it for the applicable statutory retention periods and then delete it, unless you have given further consent, for example to receive information about Barmer services and offers.

You can find more information about the specific retention period in the terms and conditions of entry for the relevant prize draw.

Who we share your data with

Depending on the type of prize, we may need to share your data with service providers that provide services on our behalf. These could include, for example, specialist retailers that supply and dispatch physical prizes or tour operators.

These providers act as processors under Article 28 GDPR and may use your data only on our instructions and for the purposes set out above. You can find further details in the terms and conditions of entry for the relevant prize draw. 

When the prize draw ends

Once the prize draw has ended and been fully administered – for example once all prizes have been sent out – your participation in the prize draw ends. Your data will then be deleted in accordance with the retention periods described above, unless we are required by law to keep it or you have given consent for us to continue processing it.

Email communications about the online membership application

If you would like to become a Barmer member, you can complete the online membership application. Barmer may contact you by email as part of this process.

What data we process

We collect your email address in the online membership application so that we can contact you quickly and easily if we have any questions.

You can also consent to receiving a one-off personalised email containing information about the services and benefits of Barmer membership. For this purpose, we also process the information you provide about your employment situation. You will receive this information email only if you do not complete and submit the online membership application to Barmer.

Purpose of data processing

We process your email address so that we can clarify any outstanding questions about your online membership application and – if you have consented – send you one email about relevant services and benefits of membership. This helps us make sure that your application can be processed correctly and, if you stop before completing it, allows us to provide additional information to help you make your decision if you want us to.

Legal basis

We use your email address to contact you about your online membership application and to send the one-off information email on the basis of your consent under Article 6(1)(a) GDPR.

Giving your consent is voluntary. You may withdraw it at any time with effect for the future.

Duration of storage

We keep your email address for as long as we need it to process your online membership application and, where applicable, send the one-off information email. We keep it for up to 49 days, after which it is deleted automatically.

Who we share your data with

We do not share your email address with third parties for advertising purposes. Where service providers support us with the technical delivery of emails, they process your data only as processors on Barmer's behalf under Article 28 GDPR and are required to meet high data protection and security standards. 

Withdrawing your consent

You may withdraw your consent to the use of your email address for the one-off information email at any time with effect for the future. Once you have withdrawn your consent, we will no longer use your email address for this purpose. This does not affect the processing of your online membership application.

Barmer digital services offered with partners

Barmer members and other interested users can use various digital services, such as apps and online programmes, that Barmer develops and provides together with partners.

What data we process

If you choose to use one of these services, we collect the personal data needed to provide it. This may typically include:

• your name;
• your email address;
• information needed to use or bill for the service, such as your insurance status and participation or usage data.

Exactly what data is required depends on the service concerned and will be explained when you start using it. We collect and store personal data only for the specific digital service you have chosen.

Purpose of data processing

We process your data so that we can: 

• provide and operate the digital service you have chosen;
• manage your participation and record your use of the service;
• support you while you are using it, for example if you have questions or there is important information about the service;
• ask for your feedback after the service ends, if you choose to provide it, so that we can improve what we offer.

You can also give separate consent to receive information about other relevant Barmer services and offers.

Legal basis

As a rule, we process your data in connection with a particular digital service on the basis of Article 6(1)(b) GDPR because the processing is necessary to provide that service.

If you also consent to receiving information about Barmer services and offers beyond the specific service concerned, this additional processing is based on your consent under Article 6(1)(a) GDPR. Giving this consent is voluntary and is not a condition of using the service. You may withdraw your consent to the processing of your data at any time with effect for the future.

Duration of storage

We process and keep your data for as long as you use the digital service – normally from the time you actively register or enter an access code until the agreed period of use ends or you end your participation yourself.

Specific information about how long the service runs and any subsequent retention periods will be provided when you start using it.

Who we share your data with

Where we provide digital services together with partners or service providers, we may need to send data to those partners so that they can carry out their responsibilities.

These organisations may act either as processors on our behalf under Article 28 GDPR or as controllers in their own right. Please also read the privacy notices of the partners whose services you use.

Ending your participation

Using digital services provided with partners is voluntary. You can stop taking part at any time with effect for the future. You can do this using the option provided within the relevant service, or contact Barmer directly by telephone, email or post.

Once you withdraw your consent or the service ends, we will no longer process your data for that service. The data will be deleted in accordance with the retention periods that apply to the service, unless we are required by law to keep it or another lawful basis applies.

Barmer user account

You need a Barmer user account to use Barmer's secure digital services for members. Your user account allows you to manage your personal details and control permissions and access rights for Meine Barmer, Barmer eCare and Barmer Teledoktor.

What data we process

We process personal data when you set up your user account and when you use our digital services through this secure access.

Registration

When you set up a Barmer user account, we process:

• surname, first name;
• date of birth;
• health insurance number;
• email address;
• telephone number;
• verification data relating to your email address and telephone number;
• your consent to data processing and to the Terms of Use for the Barmer user account

If you use passkey, we process a public key and the type of device you are using. A passkey is always linked to a particular device and is offered automatically as a login method the next time you log in.

When you register and authenticate via the app, you set your app PIN. In addition, you store information about device binding and identify yourself at standard or high protection level. If you identify yourself at high protection level, a GesundheitsID is automatically created for you. You can use it for things like the electronic patient record (ePA) and other specialist Telematics services.

Method in the app for the standard protection level

• Verification of your mobile phone number (MSIDSN) with your mobile network operator, if the number is already securely stored in the user account and you consent to its use.

Method in the app for the high protection level

• identity card with PIN;
• elctronic health insurance card with PIN;
• Nect ePass process;
• in-person identification at a Barmer Service Point.

When you use Barmer services

When you use Barmer services, we process data including:

• user ID;
• display name – consisting of your title, name prefix, name suffix, first name and surname;
• date of birth;
• place of birth;
• sex;
• password for web login, where used;
• app PIN;
• health insurance number;
• email address;
• mobile or landline number;
• information about your electronic health insurance card, where this is used for identification;
• activation code;
• one-time password (TAN) for a single login if you have forgotten your password.

When you use connected services

If you use other services with your Barmer user account, we transfer the data needed by those services. This allows us to authenticate you and make sure that insured persons can use only the benefits to which they are legally entitled.

For Barmer eCare, the following information in particular is transferred and stored there:

• user ID;
• health insurance number;
• display name – consisting of your title, name prefix, name suffix, first name and surname, so that we can address you personally in Barmer eCare;
• email address for notifications.

For Barmer Teledoktor, the following information in particular is transferred and stored there:

• user ID;
• health insurance number;
• display name – consisting of your title, name prefix, name suffix, first name and surname, so that we can address you personally in Barmer Teledoktor;
• email address for notifications;
• telephone number;
• sex;
• date of birth;
• address.

​Separate privacy notices and terms of use apply to both services.

Login logs

To keep your user account secure and prevent unauthorised use of Barmer services, we log:

• successful logins;
• failed login attempts, for example if an incorrect password or PIN is entered;
• processes that you initiate, such as changing your password.

For this purpose, we process:

• user ID;
• date and time of the request;
• method of identification;
• transaction ID;
• IP address in the event of a failed login attempt.

Usage logs

To manage your user account, we record the date and time of your most recent login. We also keep a record of which version of the Terms of Use you accepted and when you consented to the processing of your data. 

Purpose of data processing

We process data in connection with your user account to:

• set up, manage and operate your Barmer user account;
• provide the personal Meine Barmer member area;
• manage the data stored in your user account;
• identify and authenticate you when you use Barmer digital services that require a user account, in particular Meine Barmer, Barmer eCare and Barmer Teledoktor;
• apply the standard and high protection levels, particularly for applications that process health data, such as Barmer eCare;​
• provide secure access through device binding and strong authentication methods.

We log sign-ins and access so that we can prevent misuse of our services and your access credentials, investigate and deal with security incidents and, where necessary, help investigate criminal offences.

We log usage data so that we can check when you accepted the Terms of Use and consented to data processing and can draw your attention to changes when you next log in.

Legal basis

We process your personal data in connection with the Barmer user account on the following lawful bases:

• We process data for registration and use of the Barmer user account and to provide the connected services on the basis of your consent under Article 6(1)(a) GDPR.
• Where processing is necessary to fulfil the Terms of Use and provide services connected with the user account, we rely on Article 6(1)(b) GDPR for the performance of a contract or steps taken before entering into a contract.​
• We log login events, failed login attempts and transactions, and store IP addresses in the event of failed attempts, to prevent misuse and help investigate criminal offences. The lawful basis is Article 6(1)(e) GDPR in conjunction with section 3 BDSG and section 25(2) no. 2 TDDDG.
• For certain additional services, in particular Barmer eCare and Barmer Teledoktor, we process further data on the basis of separate consent under Article 6(1)(a) GDPR and the relevant provisions of social law, such as section 140a SGB V. The relevant service-specific privacy notice provides more information.

You can withdraw your consent to the processing of your data for the Barmer user account at any time with effect for the future.

If you withdraw your consent, you will be logged out of Meine Barmer and all connected services. Your user account will be permanently deleted after 14 days. If you do not want this to happen, you can consent again within those 14 days to the processing of your personal data and to the Terms of Use for the Barmer user account.

How long we keep your data

We only keep your personal data for as long as we need it for the relevant purpose or are required to retain it by law.

• Data linked to your Barmer user account is kept for as long as the account remains active or suspended.
• If you delete your user account, the data linked to it will also be deleted unless different retention requirements apply.
• If you create a new user account but do not activate it within 63 days, it will be deleted automatically.
• If your insurance with Barmer ends, your user account will be deleted. We will notify you 10 days before it is deleted and again immediately afterwards.
• If the insurance relationship ends because the insured person has died, the user account will initially be suspended. We will send a notification 10 days before the account is permanently deleted.

Logs of successful and failed login attempts are deleted once they are no longer needed to prevent misuse or investigate possible criminal offences.

Who we share your data with

As a rule, Barmer does not share your data with third parties unless there is a legal basis for doing so or you have given your consent. For these purposes, third parties are other companies, public authorities or other organisations outside Barmer.

Data processors are not treated as third parties for these purposes. They carry out certain tasks relating to the user account on Barmer's behalf, such as operating data centres, providing technical support and system maintenance, and delivering support and other services. We enter into agreements with these processors in accordance with Article 28 GDPR and make sure that they:

• act only on our documented instructions;
• have appropriate technical and organisational measures in place to protect your data;
• are regularly reviewed and assessed to make sure they remain suitable.

For connected services such as Barmer eCare and Barmer Teledoktor, data is transferred to the relevant systems where this is necessary for you to use those services. The relevant privacy notices also apply.

Deleting your Barmer user account

Barmer members can delete their Barmer user account themselves at any time in the Meine Barmer member area.

Once your user account has been deleted, you will no longer be able to access secure services such as Meine Barmer, Barmer eCare and Barmer Teledoktor. All data held in the user account will be permanently deleted. Applications and information that you have already sent us through the account, for example so that we can process a benefit claim, will of course remain stored in the relevant Barmer systems for the applicable retention periods.

Deleting your Barmer user account also means that your consent to the associated processing of your data is withdrawn with effect for the future.

You can find more information in the Terms of Use for the Barmer user account.

Meine Barmer

Meine Barmer gives Barmer members a quick and secure way to manage their dealings with Barmer. You can:

• submit applications, download certificates and submit invoices;
• manage and update your personal details and settings;
• use Postfach (secure online mailbox) to communicate securely with Barmer;
• use Kompass to keep track of applications and payments;
• take part in bonus programmes that reward members for activities and health-conscious behaviour.

You need an activated Barmer user account to access the secure Meine Barmer member area. Meine Barmer is available as an app and via the Barmer website. Privacy information specific to the app can be found in the section "Meine Barmer app".

What data we process

When you use Meine Barmer, we process personal data from your Barmer user account, data relating to your insurance with Barmer and information you provide through forms or communication channels.

You can find information about the user account in the section "Barmer user account".

Data used to access Meine Barmer

To give you access to Meine Barmer, we use data stored in your Barmer user account, in particular:

• email address;
• telephone number for notifications;
• user ID.

Data processed when you use Meine Barmer 

When you use Meine Barmer, we process personal data. Depending on the service you use, this may include:

• information you enter in applications and data relating to the services you use;
• information about your Barmer membership or family insurance cover through a family member;
• the contents of documents, such as certificates or supporting evidence, that you upload to Meine Barmer;
• the contents of your communications with us through Postfach and Barmer Live Chat within Meine Barmer.

For forms that you may need to complete more than once, we can save the information you enter for use in future applications if you give us your consent. This applies, for example, to the family insurance questionnaire or an application for child sickness benefit.

Where necessary, we will give you specific privacy information when you start a service or application, for example about the applicable lawful basis or how long the data will be kept.

Data processed when you upload documents

Meine Barmer allows you to upload documents such as certificates, application documents and supporting evidence. We process both the files themselves and associated metadata, such as the time of upload or the application to which a document relates. We use this data only to deal with the matter concerned. For legal reasons, we ask you to keep original documents for at least one year.

Purpose of data processing 

We process data through Meine Barmer so that we can carry out our statutory duties, such as providing benefits and giving our members advice and information, efficiently and digitally. In particular, we use the data to:

• verify your identity when you access Meine Barmer and confirm your Barmer membership or family insurance status;
• provide you, as a Barmer member, with services, content and offers in a secure area;
• give you secure ways of communicating with us and sending us documents that comply with data protection requirements.

Legal basis

The following lawful bases apply to the processing of your data through Meine Barmer:

• Your consent to the processing of personal data under Article 6(1)(a) GDPR. Barmer members give this consent when they set up a Barmer user account. You can find information about this and about withdrawing your consent in the section "Barmer user account".
• Article 6(1)(c) and (e) GDPR in conjunction with section 3 BDSG, sections 13 and 14 SGB I, section 1 SGB V and section 25(2) no. 2 TDDDG, where we are carrying out the statutory functions of a statutory health insurance fund, such as processing benefit claims or providing advice and information.

Additional specific statutory provisions or consents may apply to individual services and certain processing under social law. Where this is the case, we will tell you explicitly, for example before you start an application. 

How long we keep your data

We only keep data processed through Meine Barmer for as long as we need it for the relevant purpose or are required to retain it by law:

• Data directly linked to your Barmer user account is subject to the deletion rules described in the section on the user account.
• Data generated through your use of Meine Barmer is deleted once it is no longer needed for the relevant tasks and there is no legal requirement for us to keep it.​
• Applications saved as drafts are kept for 120 days and then deleted.
• Data saved for pre-filling future applications is kept for four years.

Who we share your data with

We do not share personal data processed through Meine Barmer with third parties unless there is a legal basis for doing so or you have given us your consent.

This does not include:

• data processors that provide technical or organisational services such as hosting or support on Barmer's behalf in accordance with Article 28 GDPR;
• disclosures required for us to carry out our statutory duties, for example in connection with benefit payments or reporting requirements under the German Social Code.

If you stop using Meine Barmer

You can switch off or unsubscribe from individual services within Meine Barmer separately. Data held for those services will be deleted in accordance with the applicable statutory requirements.

If you delete your Barmer user account or your insurance with Barmer ends, you will no longer be able to use Meine Barmer or any of the services it contains. Data processed through Meine Barmer, in particular data stored there, will be deleted in accordance with the principles set out in the section "Barmer user account".

Services in Meine Barmer

The following services form part of Meine Barmer. The terms described above generally apply to all of them. Some services are also subject to specific rules, for example on how long data is kept, when it is deleted, or how the service can be activated or deactivated.

Postfach (secure online mailbox)

Postfach is an integral part of Meine Barmer and provides a secure way for Barmer and its members to communicate. It is technically linked to the Barmer user account and cannot be switched off separately.

We process the following data in Postfach: 

• identification data from your Barmer user account, such as your name or health insurance number;
• messages from Barmer to you, such as queries, decisions or information;
• messages you send to Barmer;
• documents you upload to Postfach as part of these communications.

All messages in Postfach – whether sent by Barmer to you or by you to Barmer – are kept for a maximum of six years. Messages in the bin and drafts are kept for 90 days. They are deleted automatically once these periods have expired. Each message shows the date on which it will be automatically deleted. You can also delete messages yourself at any time.

Notifications 

You can choose to be notified about new messages in Postfach and new digital letters by email, SMS or push notification in the app or on the web. For this purpose, we use the email address or telephone number stored in your user account.

You decide how we may notify you and can change these settings at any time: 

• Email and SMS: go to "Profile", then "User account" and then "Notifications and Postfach".
• Push notifications in the app: go to "Profile" and then "Settings". You can find more information in the section "Meine Barmer app".
• Browser push notifications: change the settings in your browser. Meine Barmer uses Google's Firebase Cloud Messaging (FCM) service for push notifications.

If you allow push notifications on your devices, the connection is used solely to enable this feature; no additional attributes are transmitted for analytics purposes. If you decline push notifications, a one-off connection is made to the servers mentioned above so that the data used to deliver notifications can be deleted.

Push notifications may contain detailed information and may appear on your screen. Please make sure your devices and web browser are protected against unauthorised access.

Health Manager

If you use the Health Manager in Meine Barmer, we also process the following data:

• member and billing data, such as billed services or treatment data;
• data used to generate personalised recommendations for preventive care and vaccinations;
• any additional information you choose to enter in the Health Manager.

We use this data to provide you with personalised preventive care and vaccination recommendations and give you an overview of billing information, for example for doctors or pharmacies. We use the data solely for health management purposes and do not share it with third parties.

​Kompass

Barmer members can use Kompass to see up-to-date information about applications and payments.

The information shown is based on data held by Barmer, in particular: 

• applications for Barmer benefits made within the last 10 years and information about how they were processed;
• information about the status of current applications;
• information about certificates and supporting documents we have received in connection with your applications, such as sick notes, prescriptions or birth certificates;
• information about income-replacement benefits such as sickness benefit or injury benefit, including the basis on which the amount was calculated, the amount payable and the date of payment.

Additional data may be processed to provide optional features, such as calculating an estimated co-payment for approved follow-on rehabilitation. This data is used solely for Kompass features and is not shared with third parties.​

Barmer Live Chat (web only) 

Barmer members with an activated user account can use Barmer Live Chat to discuss questions and enquiries directly with our staff. To use it, log in to Meine Barmer via the Barmer website and select the contact button. Once the chat has ended, a transcript will be available in your Postfach.

We process the following data in Barmer Live Chat:

• name;
• health insurance number;
• the contents of your chat messages;
• technical information about the chat, such as its date, time and duration.

Barmer staff can see this information so that they can understand and respond to your enquiry. We also process personal data from Barmer Live Chat in order to operate and administer the service.

We delete chat data after 12 months unless it is still needed, for example to carry out statutory social-security functions such as providing benefits or calculating contributions. Where we need the data for statutory purposes, the relevant specific retention requirements apply, including section 110a SGB IV, section 304 SGB V, section 107 SGB XI and the SRVwV (General Administrative Regulation on Accounting in Social Insurance).

Barmer bonus programmes

Barmer bonus programmes allow you to earn rewards by taking part in certain activities. The Barmer bonus programmes comprise Barmer Bonus, Barmer Move and Barmer MovePlus.

It is entirely up to you whether you take part in a bonus programme and consent to the data processing required for your participation.

What data we process

To run and administer the Barmer bonus programmes, we process the following personal data: 

• first name and surname;
• address;
• health insurance number;
• date of birth;
• bank details;
• information about activities that qualify for a bonus;
• the contents of supporting evidence you submit;
• information about the bonus or reward you would like to receive.

For Barmer Move and Barmer MovePlus, we may also process health-related information that you provide yourself, such as your body mass index, as well as contact details such as your email address or telephone number. Where required for the bonus programme, this may include special categories of personal data, in particular health data.

To upload supporting evidence for bonus programmes through Meine Barmer, you need to grant access to your device's camera or give the necessary read and write permissions for the photo and media libraries on your mobile phone or computer.

Purpose of data processing

We process your personal data through the Barmer bonus programmes solely to:

• register you for and enable you to take part in the Barmer bonus programmes;
• check, assess and process the supporting evidence you submit;
• calculate, award and pay bonuses or rewards;
• communicate with you about the bonus programmes.

We also process the data to administer the programmes and arrange the delivery of rewards. We do not use the data for any other purpose.

Legal basis

We process data in connection with the Barmer bonus programmes on the basis of section 65a SGB V, the relevant provisions of our statutes (in particular sections 37 and 38) together with the associated annexes, and your consent under Article 6(1)(a) GDPR. Where health data is processed, Article 9(2) GDPR also applies.

You cannot take part in the Barmer bonus programmes without consenting to the data processing described above. You may withdraw your consent at any time with effect for the future.

Duration of storage 

We keep data processed for the Barmer bonus programmes for the duration of your participation and for no more than 10 years afterwards.

Irrespective of the above, we delete the data no later than five years after your participation or membership ends, unless we are required by law to keep it for longer. Following an extended period of inactivity, we may restrict the processing of the data before these periods have expired, which means that access to it is blocked.

Who we share your data with

We work with external service providers to run the Barmer bonus programmes. These providers act as data processors on behalf of Barmer in accordance with Article 28 GDPR. They process data solely on our behalf and in accordance with our data protection requirements. As part of this processing, we may provide them with personal data including bank details, information about activities and any supporting evidence or invoices you have submitted. We do not otherwise disclose your data to third parties unless we are legally required to do so. 

Ending your participation

You can stop taking part in the Barmer bonus programmes at any time with effect for the future by withdrawing your consent.

• For Barmer Bonus, go to the settings in Meine Barmer.
• For Barmer Move, use the following link: extrabonus.barmer.de/widerruf.

Participation in Barmer MovePlus always ends automatically on 31 December of the following year. You can claim any remaining credit until 31 March of the year after that.

Once your participation has ended and you have claimed any remaining credit, we will stop processing your data for bonus purposes. Any existing bonus accounts will be closed and your data will be deleted in accordance with the retention periods described above. 

Meine Barmer app

The Meine Barmer app gives you access to Barmer services for members wherever you are. To use it, you need to set up a Barmer user account and install Meine Barmer on a compatible device. You can find the minimum technical requirements in the app stores.

What data we process

The terms described in the "Meine Barmer" section also apply when you use the Meine Barmer app. The app also processes some additional data.

When you download and install the app

When you download Meine Barmer from Google Play or the Apple App Store, the relevant store operator processes data including:

• the username, email address and customer number associated with your store account;
• the time of the download;
• your device's unique identifier.

Barmer has no control over this processing. The app-store operators are responsible for it. Please refer to their privacy notices for further information.

App permissions and device features 

The Meine Barmer app needs access to certain functions and interfaces on your device for particular activities.

• Camera access is required if you want to photograph and upload documents.
• The app needs access to your gallery or files stored on your device if you want to save images or documents or send them to Barmer.

We will ask you to grant access when it is needed. You can change these permissions at any time in your device or app settings.

Data stored locally on your device

The Meine Barmer app stores certain information locally on your device. A distinction is made between volatile working memory (RAM) and local app storage. Data held in RAM is kept only while it is actively being used and is then discarded automatically. Data in local app storage may be kept for a limited period where this is needed to provide particular app functions. 

• Configuration information is stored using local system APIs or interfaces. If you uninstall the app, your device's operating system automatically deletes this data.
• Documents transferred to Postfach through the app, for example, are stored temporarily in the encrypted app container. They are deleted when you log out or the next time the app is launched.
• Files displayed in the document viewer are held unencrypted in RAM only for as long as you are viewing them.
• Certain technical tokens are required to operate individual functions securely. These are stored in the app container, which is protected by the operating system. Technical tokens are deleted as soon as they are no longer needed, for example if you withdraw your consent or uninstall the app. In some cases, the app may need to be restarted after a change.

If you save files outside the app, you are solely responsible for keeping that data secure.

Biometric login

The "Barmer user account" section explains how to log in using your app PIN. You can also choose to log in to the app using Touch ID or Face ID instead. These options are available if automatic screen locking is enabled on your device. You can change your biometric login settings at any time in the app. For your own security, you should register only your own biometric details.

Barmer never has access to your biometric data. It is processed solely by your device's security features.

If you lose your device, we strongly recommend that you:

• ask Barmer to block your user account, for example by calling Barmer English Service on 0202 568 333 0060;
• ask your mobile network provider to block your SIM card;
• make sure that email can no longer be accessed from the device;
• if you have set up the app on multiple devices: Remove the lost device from your profile in the user account. More on this in the Terms of Use for the Barmer user account.

Push notifications in the app

In Meine Barmer, you can choose to receive push notifications about new activity, for example in Postfach. 

Meine Barmer uses Google's Firebase Cloud Messaging (FCM) service for push notifications. A device-specific Firebase Cloud Messaging token is generated and stored locally on your device. Firebase also generates a unique identifier (Firebase ID), which is processed on Google servers. On Apple devices (iOS), an Apple Push Notification Service token (APNs token) is also always technically required to deliver push notifications; this is integrated into Google FCM.

You will only receive push notifications on your mobile phone if you enable push notifications for Meine Barmer in your device settings and allow the app to transfer data to Google or Apple. If you do this when installing the app or at a later date, the identifiers generated and your IP address will be transferred. No other information is transferred for analytics purposes.

You can switch off Barmer push notifications on your mobile phone at any time with effect for the future. To do this, go to your phone or app settings. When you switch them off, a final connection is made to the Google or Apple servers. The next time you start the app, the data previously needed to deliver notifications is deleted: the Firebase Cloud Messaging token stored locally is deleted, the Firebase ID is reset and you will no longer receive push notifications.

Logging and error analysis

To keep the Meine Barmer app stable, secure and free from errors, we automatically process technical data, in particular:​

• mobile device model;
• operating system and version;
• app version;
• device ID generated during installation;
• session ID
• network status and connection type;
• total and available storage and memory;
• number and frequency of CPU cores;
• battery level;
• time zone and language;
• date and time;
• screen resolution and orientation;
• app content and functions used.

These data can be transferred to Barmer as crash and error reports via the provider Sentry's error tracking tool. In addition, by logging the session ID in the app's backend, we can specifically identify errors in user account functions, especially in the registration process, without any data being personally linked to you. For these purposes, we ask for your consent in advance. The data is not shared with third parties. You can change your choice at any time in the app settings. Go to "App analytics" and select the options you want.

Security check when starting the app

When you start the Meine Barmer app on your mobile device (iOS or Android), a security check (Mobile Device Attestation) is run automatically. This is to ensure the device is intact and has not been tampered with. For Android devices, the check also includes other apps you have installed. On devices with an increased security risk, e.g. due to Root/Jailbreak, an unlocked Bootloader, or untrusted system modifications (custom ROMs), Meine Barmer cannot be launched. This check is required for Barmer under the specifications of gematik and the Federal Office for Information Security (BSI), so that we can provide services of the Telematik-Infrastruktur such as the e-prescription and the ePA. The aim of the security check is to protect sensitive health data and to comply with the statutory security requirements under Art. 32 GDPR.

Usage analytics – web tracking and tag management

To help us improve the Meine Barmer app, we may analyse how it is used using anonymised or pseudonymised data. This helps us understand how often particular areas are used and which content is particularly relevant to our members.

We use the following technologies for this purpose: 

• User tracking using cookies to recognise users. For web tracking, we use technologies provided by econda GmbH, which holds the TÜV Saarland "Certified Data Protection" certificate for web controlling.
• The Tealium iQ tag management system. A cookie is used to collect some non-personal information, such as a timestamp, session ID and visitor ID, as well as page views. The Tealium cookie expires after no more than 12 months.

We use service providers that act as processors on Barmer's behalf under Article 28 GDPR and require them to meet high data protection and security standards.

You decide whether to consent to this analysis when you first start the app. You can change your choice at any time in the app settings. Go to "App analytics" and select the options you want.

Reporting a problem with the app

Your app profile includes a "Report a problem with the app" feedback feature. If you send us a message using this feature, we process technical context information as well as your first name, surname and health insurance number. If you would like us to reply by email or telephone, we also process the relevant contact details. We use all of this data solely to identify the matter you are contacting us about, resolve errors and continue developing the app around users' needs. 

Cookies and IP addresses

The Meine Barmer app uses cookies to provide important user functions and maintain session information while you are using the app. These cookies do not contain personal data, only an identification number. They are deleted when they expire or when the session ends. You can find more information about cookies in the "Barmer website" section.

We may briefly log your IP address in order to detect and prevent IT security threats such as spam or attacks on our systems. In doing so, we comply with the requirements of the Telecommunications Digital Services Data Protection Act (TDDDG).

Purpose of data processing

We process personal data in the Meine Barmer app to:

• provide the personal Meine Barmer member area as an app;
• enable you to use Meine Barmer functions on mobile devices;
• authenticate you securely, including through biometric methods;
• provide push notifications about important events;
• analyse errors and improve the app;
• prevent misuse and maintain IT security.

Legal basis

The processing of data in the Meine Barmer app is based on your consent to the processing of personal data under Article 6(1)(a) GDPR and section 25(1) TDDDG. This also applies to analytics functions (web tracking and tag management), error tracking (crash reports) and push notifications.

Barmer members give this consent when they set up a Barmer user account. You can find more information about this and about withdrawing your consent in the "Barmer user account" section. If you withdraw your consent, you will be logged out of Meine Barmer and all connected services. Your user account will be permanently deleted after 14 days. If you do not want this to happen, you can consent again within this period to the processing of your personal data and to the Terms of Use for the Barmer user account.

The following lawful bases also apply:

• Article 6(1)(b) GDPR for processing that is necessary to use Meine Barmer through the app and to fulfil the Terms of Use.
• Article 6(1)(c) and (e) GDPR in conjunction with section 3 BDSG, sections 13 and 14 SGB I, section 1 SGB V and section 25(2) no. 2 TDDDG where we are carrying out the statutory functions of a statutory health insurance fund, such as processing benefits, providing advice and providing information.

Duration of storage

Technical and log data is deleted as soon as it is no longer needed for the purposes described above:

• Log and technical data used to maintain stability and security is generally deleted after no more than 90 days, unless it needs to be kept for longer.​
• Cookies such as the Tealium cookie and similar technologies expire after no more than 12 months or are disabled earlier in accordance with your settings.
• Feedback and error data is deleted once we have finished dealing with your enquiry and there is no other reason to keep it.

Otherwise, the deletion periods set out in the sections on the Barmer user account and Meine Barmer apply. Statutory retention periods remain unaffected.

Who we share your data with

The following also applies to data generated when you use the Meine Barmer app:

• We do not share the data with third parties unless we are legally required to do so or you have given your consent.
• Where we use service providers for operation, hosting, analytics or error tracking, they act as processors on Barmer's behalf under Article 28 GDPR and are required to meet high data protection and security standards.

If you stop using the Meine Barmer app

If you delete the Meine Barmer app from your mobile phone, the data and settings stored in the app are deleted by the relevant operating system. As long as your Barmer user account remains active, you can continue to use Meine Barmer on the web.

You will only lose access to Meine Barmer and all of its services, both on the web and in the app, if you delete your Barmer user account or your insurance with Barmer ends. Data processed through Meine Barmer, in particular data stored there, will be deleted in accordance with the principles described in the "Barmer user account" section. In these cases, please delete the app from your mobile phone manually – it will not be uninstalled automatically.

Barmer Teledoktor

A separate privacy notice applies to Barmer Teledoktor.

Barmer eCare

A separate privacy notice applies to Barmer eCare and the electronic patient record (ePA).

Processing data for health and long-term care insurance

As a health and long-term care insurer, we are both permitted and required to process a wide range of personal data so that we can carry out our statutory responsibilities. This data is subject to specific social-data protection rules, which strictly govern how it may be handled.

Social data of members and insured persons

We process personal data relating to our members and insured persons only in accordance with the law. You can find a list of the relevant legal provisions in the section "Legal framework, key terms and why we process your data".

We keep your data only for as long as required by law or needed for us to carry out our responsibilities. Once the data is no longer needed and there is no legal requirement for us to retain it, we delete it. This ensures that we comply with the GDPR and social law, under which social data must not be kept indefinitely.

Retention periods for social data are governed in particular by section 110a SGB IV, section 304 SGB V, section 107 SGB XI and the SRVwV (General Administrative Regulation on Accounting in Social Insurance).

Personal details

• identifiers such as your health insurance number;
• surname, first name;
• address;
• photograph;
• date of birth;
• place of birth;
• telephone number;
• email address;
• information relating to family members;
• bank details;
• marital status;
• sex;
• nationality;
• membership of the health insurance fund's governing bodies;
• German social security number (Sozialversicherungsnummer).

Membership data

• previous insurance periods:
• start and end dates;
• responsible offices;
• information relating to the provision of benefits, such as reimbursement of costs or participation in special forms of care;
• indicators for additional insurance cover.

Insurance data

• type of insurance;
• start and end dates;
• reasons for notifications;
• employment details;
• contribution groups;
• pay, income and pension or similar payments;
• information about exemptions from contributions or insurance;
• information about pension applications and receipt of a pension;
• employer or paying body.

Contribution data for members who pay their own contributions

• contributions due;
• contributions paid;
• person liable to pay;
• information required to collect contributions;
• information relating to debt recovery procedures;
• tax identification number (tax ID).

Benefit data

• type of benefit;
• diagnosis;
• healthcare professional prescribing or ordering the service;
• healthcare provider;
• period during which the benefit was received;
• expected due date or date of birth of a child;
• costs;
• information about the suspension, interruption, refusal or cessation of benefits;
• information about other social security institutions;
• information about services provided on behalf of other bodies;
• information about recovery claims;
• information about entitlements to benefits;
• personal contributions and co-payments;
• information relating to structured treatment programmes, integrated care, pilot projects and care management;
• information relating to bonus programmes;
• information relating to optional tariffs;
• tax identification number (tax ID);
• information used to calculate income-replacement benefits, including the amount and payments made;
• information about the progress of matters such as applications or invoices you have submitted.

Data relating to carers

• personal details as listed above;
• start and end of the caring activity;
• reasons for notifications and relevant periods;
• information used to determine whether pension insurance is compulsory;
• information relating to the collection and payment of contributions to the pension insurance institution;
• information about qualifications;
• data required for statistical reports.

Data relating to authorised representatives and legal representatives

• surname, first name;
• address;
• telephone number;
• email address.

Social data relating to corporate customers

• identifiers such as employer number or establishment number;
• name;
• address;
• telephone number;
• email address;
• bank details;
• contributions due;
• contributions paid;
• person liable to pay;
• information required to collect contributions;
• information relating to debt recovery procedures;
• responsible offices;
• information required for employer audits;
• information relating to billing methods;
• information needed to administer the Expenditure Compensation Act (Aufwendungsausgleichsgesetz – AAG).

Data relating to healthcare providers

• identifiers such as doctor number;
• name;
• address;
• telephone number;
• email address;
• information about professional qualifications.

Data relating to contractual partners and suppliers

• identifiers such as institutional identification numbers;
• name;
• address;
• telephone number;
• email address;
• bank details;
• billing and payment data.

Data relating to recipients of information materials

• identifiers such as type or edition;
• surname, first name;
• address;
• email address;

Data relating to interested individuals

• identifiers;
• surname, first name;
• address;
• telephone number;
• email address.

Automated decision-making and profiling

We may use automated individual decision-making in certain business processes in accordance with Article 22 GDPR and section 31a SGB X. These provisions govern decisions based solely on the automated processing of personal data. Applications may be decided automatically after a fully automated assessment of whether the statutory requirements are met. Any decision that would put you at a disadvantage is always reviewed by Barmer staff. We will explain the main reasons for a decision to you clearly and transparently. You have the right at any time to ask for an automated decision to be reviewed by a member of our staff. You can also give us your point of view and challenge the decision.

We do use profiling, but only to a limited extent permitted by law and not in relation to insurance benefits or your insurance relationship with Barmer. Profiling helps us provide you with information and advice about Barmer products that is relevant to your needs, as described, for example, in the section "Information and communications by email". You can object to the processing of your data for these purposes at any time with effect for the future. We therefore do not use profiling to administer your membership, provide benefits or calculate contributions under the German Social Code (SGB). 

Who receives your data and the processors we use

Within Barmer and among external organisations, access to your social data is limited to those people and organisations that need it to meet legal or contractual obligations. This applies in particular to our specialist departments and employees responsible for administering membership, processing benefits, collecting contributions, managing contractual partners or operating our IT systems.

We also disclose social data to external organisations where the German Social Code or other legislation requires or permits us to do so. These may include other social security institutions, doctors, healthcare providers or auditing and review bodies.

We also use service providers that act on our instructions to support us in carrying out our responsibilities, for example in IT operations, data centres, printing and distribution. These providers process personal data solely on our behalf and in accordance with our instructions and are therefore processors under Article 28 GDPR. We select our service providers carefully and require them to meet high data protection and security standards.

We use the following categories of service provider:

• IT service providers
  • providing IT infrastructure such as hardware and software;
  • providing IT and telecommunications services such as cloud applications, telecommunications, consultancy and assistance, maintenance and support;
  • verifying people's identities for substantial or higher protection levels;
• service providers that check invoices from healthcare providers;
• service providers that securely destroy files and data storage media;
• address completion service providers;
• service providers for customer satisfaction surveys, market research and marketing activities;
• translation service providers;
• printing and distribution service providers for information materials;
• service providers for sending newsletters by email;
• providers of digital products, including digital health services such as apps or the electronic health insurance card;
• service providers that archive records.

Transfers of data to third countries

Third countries are countries outside the European Union (EU) and the European Economic Area (EEA). The legal framework for ensuring an adequate level of protection when data is transferred to third countries is provided by an adequacy decision of the European Commission under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, such as the European Commission's Standard Contractual Clauses. Additional technical or organisational measures may also be used to protect the data. Social data requiring particular protection may not be transferred to third countries on the basis of Standard Contractual Clauses.

We transfer personal data to third countries only where this is necessary for us to meet our legal or contractual obligations or where you have explicitly consented to the transfer.

Please be aware that the level of data protection in third countries may not always be equivalent to that in the EU and that, in particular, public authorities may have more extensive powers to access personal data. 

Your rights

Where Barmer processes your personal data, you may exercise the following rights if the legal requirements are met:

• Right to withdraw your consent (Article 7(3) GDPR) – You can withdraw consent you have given at any time. From that point onwards, we will no longer process your data on the basis of that consent.
• Right of access (Article 15 GDPR) – You can ask us what personal data we process about you and obtain information such as the purposes of processing, recipients, how long the data is kept and your other rights.
• Right to rectification (Article 16 GDPR) – You can ask us to correct inaccurate data or complete data we hold about you.
• Right to erasure (Article 17 GDPR) – You can ask us to delete your data unless there is a legal reason why it must be retained.
• Right to restriction of processing (Article 18 GDPR) – You can ask us to restrict how we process your data, for example if you dispute its accuracy or have objected to the processing.
• Right to data portability (Article 20 GDPR) – You can ask to receive your data in a commonly used, machine-readable format or have it transferred to another controller.
• Right to complain (Article 77 GDPR) – You have the right to lodge a complaint with a data protection supervisory authority, usually in the place where you live or work or where our organisation is based.
• Right to object (Article 21 GDPR) – You have the right to object to the processing of your personal data at any time.

We can only act on these rights if the data concerned can be clearly linked to you.

You can find contact details for Barmer, our Data Protection Officer and the supervisory authorities with which you can exercise your rights in the next section.

Contact details and supervisory authorities

Questions about data protection

If you have technical questions or questions about how Barmer uses your personal data, it is best to contact us first:

• Online via Barmer Email
• By telephone on 0202 568 333 0060
• By post at Barmer, 42266 Wuppertal, Germany

Barmer Data Protection Officer

Barmer
Datenschutzbeauftragte
42266 Wuppertal, Germany
Email: datenschutz@barmer.de

Supervisory authorities

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (Federal Commissioner for Data Protection and Freedom of Information – Germany)
Graurheindorfer Str. 153, 53117 Bonn, Germany
Email: poststelle@bfdi.bund.de

Bundesamt für Soziale Sicherung (Federal Office for Social Security – Germany)
Friedrich-Ebert-Allee 38, 53113 Bonn, Germany
Email: poststelle@bas.bund.de