Privacy policy for the app

This is a translation for your convenience. Only the German version is legally binding: Datenschutzerklärung der App (in German).

This privacy policy applies to the “PharmaCare” app by PharmaCare GmbH for Android and iPhone, listed in the stores as “PharmaCare – Meine Versorgung”. It explains which personal data we process when you use the app. Our website has its own privacy policy.

1. Controller and data protection officer

Controller

PharmaCare GmbH
Raiffeisenallee 16
82041 Oberhaching
Germany

Legally represented by the managing directors Werner Bauer and Dirk Bauer

Phone: 089 219 66 88 70
Fax: 089 219 66 88 76
Email: kundenservice@pharmacare.de

Data protection officer

You can reach our data protection officer at datenschutz@pharmacare.de or at our postal address, marked “Datenschutzbeauftragter” (data protection officer).

2. Sending prescriptions and documents

Using “Send prescription”, you send us photos, scans or PDF files of a prescription (Rezept) or another document, for example an exemption certificate (Befreiungsausweis) or a power of attorney (Vollmacht).

What data: the documents themselves, the type of document (prescription or other), your name, your phone number and/or email address and, if you provide them, your order or customer number and your message. We also process the time, the language of the app and the version of the consent text. Prescriptions and many other documents contain health data.

Purpose: processing your supply of medical aids, for example checking the prescription and billing your health insurance fund.

On your device: The app only uses the camera when you scan or take a photo. For scanning, it uses Google’s document scanner on Android (ML Kit, part of Google Play services) and the operating system’s scanner on iPhone; scanning takes place on your device. You choose photos and files using your device’s picker; the app only receives these and has no access to all your photos. Before sending, the app rewrites every photo, removing metadata such as the location where it was taken. Photos, scans and files are kept only temporarily in the app’s own area: they are deleted as soon as they have been sent or removed, and at the latest the next time the app starts. While the app is in the background, it hides its content in the overview of open apps.

Recipients and location: Everything is sent encrypted to our upload service upload.pharmacare.de on Microsoft Azure, in a data centre in Frankfurt am Main, Germany. Your documents are kept there in a protected temporary store and checked for malware. We then combine them into a PDF, store it in an area of Microsoft SharePoint that only our back-office team can access, and notify the team by email with the reference number and a link, without attaching your documents. If you gave an email address, you will receive a confirmation of receipt. Microsoft processes the data on our behalf (see Recipients).

Legal basis: your explicit consent, which you give in the app before sending (Art. 9(2)(a) and Art. 6(1)(a) GDPR), and the provision of your supplies (Art. 6(1)(b) GDPR). You can withdraw your consent at any time with effect for the future, for example by email to kundenservice@pharmacare.de or by phone on 0800 74 222 73.

Retention: We empty the temporary store once the PDF has been filed, usually after a few minutes. If a submission cannot be processed, it is kept in a locked area for no more than 30 days until we have dealt with it. We delete the filed documents once we no longer need them for your supplies, unless statutory retention obligations apply.

3. Requesting a callback

What data: your name, your phone number and your preferred time and, if you provide them, your topic and your customer number, as well as the language of the app and the time.

Purpose: we call you back.

Recipients and location: Your details are sent encrypted to the same upload service on Microsoft Azure in Frankfurt and from there by email to our customer service (Microsoft 365).

Legal basis: Art. 6(1)(b) GDPR insofar as your request concerns or initiates a contract with us, and otherwise our legitimate interest in answering requests quickly (Art. 6(1)(f) GDPR).

Retention: We delete your details from the upload service’s temporary store after sending, usually within less than a minute, and after 30 days at the latest if sending fails. We delete the email once your request has been dealt with, unless retention obligations apply.

4. Proof of the genuine app and protection against misuse

So that only our genuine app can send documents and callback requests and start conversations with the assistant, it identifies itself to our upload service. Before a chat or a conversation, it obtains a ticket there, again identifying itself.

iPhone: The app uses Apple’s App Attest. The first time, it creates a key on your device that Apple confirms; the key never leaves the device. The app keeps the confirmation in your device’s protected storage.

Android: The app uses Google’s Play Integrity API. Google Play confirms that the app comes from Google Play and runs on an unmodified device; we have this token checked by Google.

Apple and Google receive none of the content of your submission and none of your details such as your name, phone number or documents; we do not pass your IP address to Google. When you talk to the assistant on Android, Google also receives the app’s installation ID (see Installation ID on Android). Apple’s and Google’s own processing of device and app data is governed by their privacy policies.

Rate limit: We also count requests per internet connection. For this purpose the upload service keeps a non-reversible checksum of your IP address, not the address itself, in memory for no more than one hour.

Legal basis: our legitimate interest in preventing misuse and protecting your documents (Art. 6(1)(f) GDPR). Storing the proof on your device is strictly necessary for the function you request (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

5. Installation ID on Android

We limit conversations with the assistant per device (see Talking to the assistant). On iPhone, we derive a code from the identifier of the App Attest key for this purpose. On Android, Google’s proof does not include a device identifier. Instead, the app creates a random installation ID when you first start a conversation and stores it securely on your device.

The installation ID is not derived from anything, neither from your device nor from your details. The app only sends it when obtaining the ticket for a conversation, bound into Google’s proof. To do so, it passes the ID to Google Play, and Google reports it back to us when checking the proof; Google therefore also receives the ID, without your name or any other details from you. The upload service derives a code from it, a non-reversible checksum, and does not store the ID itself. It is used only for the limit per device.

Legal basis: our legitimate interest in limiting the use of the AI and preventing misuse (Art. 6(1)(f) GDPR); storing the ID on your device is strictly necessary for this (Section 25(2) no. 2 TDDDG).

Retention: The ID stays on your device until you delete the app or its data; a newly installed app creates a new one. We delete the counters for the code after 7 days.

6. Chat with the PharmaCare assistant

In the chat, the PharmaCare assistant answers your questions. It is an artificial intelligence (AI), not a person, and answers using the public content of our website. On request, it hands the chat over to our customer service; a member of staff (by first name) then replies in the same window. It is the same service as the chat on our website.

What data: your messages, the answers, the language and the time. We derive a code (a checksum) from your IP address that changes daily, to limit misuse; we do not store the address itself. We delete the code together with the chat history after 7 days. Before the handover to customer service, on request, the name by which we should address you and, if you provide it, your customer number; for a callback, also your name and phone number. Please do not share details of illnesses, insurance numbers or your address in the chat; we discuss personal matters on the phone.

Purpose: answering your questions and, on request, putting you in touch with our customer service.

Recipients and location: The chat runs on Microsoft Azure in Frankfurt (Germany West Central region). The answers are generated by a language model from OpenAI that Microsoft operates in Azure (Azure OpenAI); processing takes place exclusively in data centres in the EU (Azure “Data Zone EU”). OpenAI does not receive your messages, and they are not used to train AI models. If you hand the chat over to customer service or ask for a callback, the conversation is also passed to our staff in Microsoft Teams. Before the app opens a chat, it obtains a ticket from the upload service (see Proof of the genuine app).

Legal basis: Art. 6(1)(b) GDPR insofar as it concerns initiating or providing your supplies, and otherwise our legitimate interest in answering your questions quickly (Art. 6(1)(f) GDPR).

Retention: We delete the chat history after 7 days. We file chats with our staff in Microsoft Teams after they end (quality assurance, follow-up questions) and delete them there after 30 days. To detect misuse, Microsoft may keep inputs to the AI in the EU for up to 30 days.

7. Talking to the assistant (beta)

Under “Contact”, you can also talk to the PharmaCare assistant, as you would on the phone. The assistant is an AI, not a person; this feature is new (beta). The app only uses the microphone once you start the conversation and only until you hang up. It also hangs up when you leave the screen or the app goes into the background. A conversation lasts no more than 5 minutes; no more than 3 conversations per device and day are possible.

Audio: The audio is sent encrypted (WebRTC) directly from your device to the language model on Microsoft Azure (Azure OpenAI, Sweden Central data centre, Azure “Data Zone EU”) and back. It is only processed to respond in real time. We do not record the conversation and do not create a transcript. To detect misuse, Microsoft may keep inputs to the AI in the EU for up to 30 days.

Details of the conversation: The conversation is managed by our AI phone service, also on Microsoft Azure in Sweden (Sweden Central). It stores the time, duration, platform (iPhone or Android) and language, not the audio and no transcript. If you ask for a callback or give an order request, it also stores your name, your callback number, the request and its topic and, for an order request, the products, quantities and, if you give it, your customer number. For the limit per device it counts conversations using a code (see Installation ID). Before a conversation starts, the app obtains a ticket from the upload service (see Proof of the genuine app).

Callback and order request: If you would like a callback, tell the assistant your name and phone number; the app itself does not know your number. The assistant only takes down an order request (product and quantity, your name, your callback number and, if you wish, your customer number); nothing is ordered until we have called you back. These details are sent by email to our team (Microsoft 365) and, where set up, as a message in Microsoft Teams.

Summary: The AI also writes two to three sentences on what the conversation was about. Our system automatically removes sentences containing health information and masks personal numbers. The summary only appears in this email and is not stored. Even without a callback request, it may reach us by email after a conversation so that we can see what it was about. Please discuss personal matters, such as details of your order or your health, with us on the phone.

Legal basis: our legitimate interest in answering your questions quickly and around the clock (Art. 6(1)(f) GDPR); for callbacks and order requests Art. 6(1)(b) GDPR.

Retention: We do not store the audio. We delete the details of the conversation, including name, callback number and order request, and the counters after 7 days. We delete the email once your request has been dealt with, unless retention obligations apply.

8. Product search

When you search for products, the app sends your search term and the selected area to our website www.pharmacare.de. The response contains products only (name, manufacturer, PZN and whether the product is in stock). Your name, contact details or an identifier of your device are not sent.

As with any visit to our website, our host IONOS and Cloudflare process your IP address and technical details. The search term appears in the server log like any requested address; we delete the log after 7 days. Beyond that, we do not store or analyse search terms. Details are in the website’s privacy policy, section Visiting our website.

Legal basis: our legitimate interest in offering you the search and operating the website securely (Art. 6(1)(f) GDPR).

9. Contact options and links

If you tap phone (0800 74 222 73), WhatsApp, Signal or email, the app opens your phone app, WhatsApp, Signal or your email app. The app itself does not transmit anything. These channels are covered by our website’s privacy policy (sections Contacting us, WhatsApp and Signal).

Our phone service is in German. If you need English, just let us know – we will bring in a colleague who speaks English.

The app opens the guide and other pages of our website in your browser. The website’s privacy policy applies there.

10. Recipients and processors

At PharmaCare, only those employees who need your data for their tasks can see it. We also use these service providers:

• Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): Azure for the upload service and the chat (Frankfurt) and for the AI phone service and Azure OpenAI (Sweden Central, Data Zone EU); Microsoft 365 for SharePoint, email and Teams. We have concluded a data processing agreement with Microsoft pursuant to Art. 28 GDPR.
• IONOS (IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany) and Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) for our website and therefore the product search, each as a processor, as described in the website’s privacy policy.
• Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for the Play Integrity API and the document scanner on Android.
• Apple (Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA) for App Attest on iPhone.

Data may be transferred to the USA by Apple, Google and Cloudflare. These companies are certified under the EU-US Data Privacy Framework, for which there is an adequacy decision by the European Commission (Art. 45 GDPR).

When you download the app from the App Store or Google Play, Apple and Google process data under their own responsibility, for example relating to your account there. We have no influence on this.

11. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR), and
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Please contact datenschutz@pharmacare.de or our postal address. As the app has no account, please tell us your name and your phone number or email address so that we can find your data. Details of your rights are in the website’s privacy policy, section Your rights.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority, www.lda.bayern.de).

Using the app is voluntary. Without your name and a phone number or email address, however, we cannot assign documents to you or call you back.

As of: November 2026