Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Amberis DIGITAL GmbH
[Street and house number]
[Postal code] [City]
Germany

Email: info@amberis-digital.com
Phone: [Phone number]

2. Data Protection Officer

You can reach our data protection officer at:

[Name of the data protection officer]
Email: dsb@amberis-digital.com

3. Purposes of processing and legal bases

Amberis Care is a software-as-a-service solution for managing care organizations. We process personal data solely for the purposes listed below and on the basis of the respective legal bases set out in the GDPR.

3.1 Providing the application (contract customers)

To perform the contract with the respective business customer (care organization), we process data of the employees and patients recorded in the system. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and, where health data is concerned, Art. 9(2)(h) GDPR (health and social care) in conjunction with Sec. 22(1) No. 1(b) BDSG (German Federal Data Protection Act).

3.2 Business inquiries (public form)

If you fill out the form to request a business account, we process the contact and company data you provide in order to process your inquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) as well as your consent under Art. 6(1)(a) GDPR for any voluntary consents you give (e.g. product information). Technically necessary processing steps (storing your inquiry, contacting you) are carried out on the basis of Art. 6(1)(b) GDPR.

3.3 User account management and authentication

To provide secure login and session management, we process your email address, hashed password, and technical session data. The legal basis is Art. 6(1)(b) GDPR.

3.4 Security and abuse prevention

To protect against unauthorized access and abuse (e.g. brute-force attacks), we temporarily store IP addresses in a block list. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in system security).

4. Categories of data processed

Depending on the function, we process the following categories of personal data:

• Master data: Name, address, date of birth, contact details
• Employee data: Personnel number, job title, contract data, qualifications, driving licence categories, availability, absences
• Health data (Art. 9 GDPR): Patient diagnoses, physical findings, care plans
• Technical data: IP addresses, session IDs, log data, timestamps
• Communication data: Email addresses, phone numbers

5. Processing on behalf of controllers

Amberis Care is used by care organizations as software-as-a-service. In this relationship, Amberis DIGITAL GmbH acts as a processor under Art. 28 GDPR; the respective business customer is the controller under data protection law for the patient and employee data recorded in the system.

Processing takes place exclusively on the basis of a data processing agreement (DPA) and according to the controller's documented instructions.

6. Recipients and transfers to third countries

Personal data is not sold to third parties. Data is only shared where necessary to perform a contract or where there is a legal obligation to do so. Processors we engage (e.g. hosting providers) are contractually obliged to comply with the GDPR.

Personal data is not transferred to countries outside the European Economic Area (EEA). Servers and data are hosted exclusively in Germany.

7. Retention period

We only store personal data for as long as necessary for the respective processing purpose or as required by statutory retention periods:

• Business inquiries: After an inquiry is completed or withdrawn, the data is deleted after [X] months, unless further processing (conclusion of a contract) has taken place.
• Health data: In accordance with the statutory retention periods applicable in healthcare (at least 10 years, Sec. 630f German Civil Code, medical professional regulations).
• Employee data: In accordance with tax- and social-law retention periods (generally 6–10 years).
• IP block lists: Entries are automatically deleted after [24 hours / X days].
• Log data: Automatically deleted after [30 days].

8. Cookies and session management

Amberis Care uses only technically necessary cookies. No tracking, analytics, or marketing cookies are used.

Technically necessary cookies do not require consent (Sec. 25(2) No. 2 TTDSG, German Telecommunications-Telemedia Data Protection Act).

9. Your rights as a data subject

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): You may request information about the data we process about you.
• Rectification (Art. 16 GDPR): You may have inaccurate data corrected.
• Erasure (Art. 17 GDPR): You may request the deletion of your data, unless retention obligations apply.
• Restriction of processing (Art. 18 GDPR): Under certain conditions, you may request a restriction of processing.
• Data portability (Art. 20 GDPR): You may receive your data in a structured, machine-readable format.
• Objection (Art. 21 GDPR): You may object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR): You may withdraw consent you have given at any time, with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact: info@amberis-digital.com

10. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The competent authority is the supervisory authority of the German federal state in which we are based:

[Name of the competent authority]
[Address]
Website: [Authority's URL]

11. Currency and changes to this privacy policy

This privacy policy is currently valid and dated September 2026 . Further development of our application or changes to legal requirements may make it necessary to update this privacy policy. The current version is always available at this address.