DATA PROCESSING AGREEMENT (DPA)

according to Art. 28 GDPR — Version 1.6, October 2026

between

[Therapist - Name inserted at signup]
[Address inserted at signup]
- hereinafter "Controller" or "Client" -

and

Intermac systems
Sendnicher Str. 58a
56072 Koblenz
Germany
Email: nd@intermac.de
- hereinafter "Processor" or "Service Provider" -

Preamble

The Controller is a psychotherapist, psychologist or non-medical practitioner for psychotherapy ("Heilpraktiker für Psychotherapie") using the Processor's therapy documentation and AI assistance platform for managing therapy sessions, creating reports and applications.
The Controller is solely responsible for compliance with data protection regulations towards their patients, particularly for obtaining required consents.
The Processor processes personal data exclusively on behalf of and according to the instructions of the Controller.

§ 1 Subject Matter and Duration

(1) Subject Matter

The Processor provides a web-based platform for:

Transcription of therapy sessions
Storage of session notes and patient data
AI-assisted creation of therapy reports
AI-assisted creation of reimbursement applications
Management of patient data
Video consultations between the Controller and patients, where the Controller uses this function

(2) Duration

This DPA applies for the duration of the Controller's use of the platform.

§ 2 Nature and Purpose of Data Processing

(1) Processing Purpose

Processing serves exclusively to provide the platform functions for therapy documentation.

(2) Types of Data

Patient data (name, first name, optionally additional data entered by the Controller)
Therapy session notes and transcriptions
Diagnoses and treatment contents
AI-generated reports and applications
Therapist data (account management)
Patients' contact details for notifications (email address for invitations and appointment reminders, mobile number for appointment reminders by text message)
For video consultations: picture and sound in real time (not stored), connection and device data, records of consent to recording

(3) Categories of Data Subjects

Patients of the Controller, and for minors also their legal guardians
The Controller themselves (as user)

(4) Video Consultation

Picture and sound of a video consultation pass through a media server that the Processor operates itself at Hetzner Online GmbH in Germany (LiveKit software). The maker of the software receives no data. Picture and sound are encrypted between the browsers with one key per call. The Processor's application server creates this key when the call starts; it is stored encrypted with the Controller's key and deleted when the call ends. The media server cannot decrypt picture or sound. Because the key is created on the application server, this is not end-to-end encryption in the strict sense.

Nothing is recorded on the server. A sound recording is made only in the Controller's browser and only after the patient has agreed in their own browser; § 9 (4) applies to it like to any recording. To operate the service and find faults, the Processor processes for each call the times, coarse device and browser details, connection values and error types of both sides, without IP address, device names or the content of the conversation. For technical reasons the media server logs the participants' IP addresses.

§ 3 Controller's Right to Issue Instructions

(1) The Processor processes personal data exclusively according to documented instructions from the Controller, unless required by EU or German law to process.

(2) Instructions are issued through:

This agreement
Use of platform functions by the Controller
Written or electronic individual instructions

(3) If the Processor considers an instruction to be unlawful, they will inform the Controller immediately.

§ 4 Controller's Responsibilities

(1) Legal Basis and Consent

The Controller is responsible for the lawfulness of the processing. The creation and storage of treatment documentation, and its processing by the Processor acting as a processor, take place on the basis of the treatment contract. Where the Controller records conversations with patients, they obtain the necessary consent of the persons concerned for this.

(2) Lawfulness

The Controller is solely responsible for:

The lawfulness of data collection
Compliance with therapeutic confidentiality obligations
Informing patients about data processing
Fulfilling data subject rights (access, deletion, etc.)

(3) Data Accuracy

The Controller is responsible for the accuracy and currency of entered data.

§ 5 Processor's Obligations

(1) Confidentiality

The Processor commits all persons involved in processing to confidentiality.

(2) Technical and Organizational Measures

The Processor implements appropriate technical and organizational measures according to Art. 32 GDPR, in particular:

AES-256 encryption of all patient data (at rest)
Encryption keys derived per user
TLS/SSL encryption for data transmission
IP-restricted server access with 2FA
Regular security updates
Audit logging of all accesses
Firewall-protected servers in German data centers

A detailed description of TOMs is provided in Annex 1.

(3) Data Breaches

The Processor reports data breaches immediately (within 24h at the latest) to the Controller with all relevant information according to Art. 33 GDPR.

(4) Data Protection Contact

The Controller sends questions about data protection to info@intermac.de.

§ 6 Professional Secrecy under § 203 German Criminal Code (StGB)

(1) The Processor is aware that the Controller is bound by the criminally sanctioned professional secrecy obligation under § 203(1) of the German Criminal Code (StGB) as a member of a profession subject to professional confidentiality.

(2) The Processor undertakes to maintain secrecy regarding all information accessible to them in the course of the data processing that qualifies as a secret under § 203 StGB. The Processor has been informed pursuant to § 203(4) StGB that unauthorized disclosure of such secrets constitutes a criminal offense.

(3) The Processor obligates all persons involved in the processing as well as any engaged sub-processors to the same secrecy and informs them of the criminal liability under § 203(4) StGB.

(4) This obligation continues beyond the termination of the contract.

§ 7 Sub-processors

(1) Approved Sub-processors

The Controller hereby consents to the engagement of the following sub-processors:

Sub-processor	Service	Location	Note
Hetzner Online GmbH	Server hosting, data center, media server for video consultations	Germany (EU)	DPA in place, BSI C5 Type 2, ISO 27001:2022
Microsoft Ireland Operations Ltd.	Key management (Azure Key Vault)	Germany (Frankfurt, Germany West Central)	Microsoft Products and Services DPA per Art. 28 GDPR
OpenAI Ireland Ltd.	AI processing (transcription, documentation)	EU (Data Residency, Zero Data Retention)	DPA per Art. 28 GDPR in place, additional BAA
Stripe Payments Europe Ltd.	Payment processing	Ireland (EU)	DPA in place, PCI DSS Level 1
Resend	Transactional emails, video consultation invitations and appointment reminders to patients	EU	DPA in place, SOC 2
BunnyWay d.o.o. (bunny.net)	File storage: interim storage of session recordings until transcription, users' profile pictures, proof documents	Slovenia (EU), storage location Frankfurt (Germany)	DPA in place. Recordings can only be retrieved through signed addresses valid for 15 minutes. No transfer to third countries intended
ONLINECITY.IO ApS (GatewayAPI)	Appointment reminders to patients by text message (mobile number, date, time and place of the appointment, practice name)	Denmark (EU), EU platform with data center in Germany	DPA per Art. 28 GDPR in place. No transfer to third countries by the provider. For a foreign mobile number, the recipient's mobile operator delivers the message; Switzerland and the United Kingdom are covered by adequacy decisions (Art. 45 GDPR), delivery to other third countries is based on Art. 49 (1) (b) GDPR

(2) Changes

When planning to add or change sub-processors, the Processor will inform the Controller at least 14 days in advance via email. The Controller may object within 14 days for data protection reasons.

(3) Sub-processor Obligations

The Processor obligates sub-processors to the same data protection obligations as themselves.

§ 8 Data Subject Rights

(1) Support

The Processor appropriately supports the Controller in fulfilling data subject rights (access, rectification, deletion, etc.).

(2) Direct Requests

If a data subject contacts the Processor directly, they will be referred to the Controller without delay.

(3) Technical Support

The platform offers the following functions to fulfill data subject rights:

Data export (Art. 20 GDPR - Data portability)
Data deletion (Art. 17 GDPR - Right to erasure)

§ 9 Data Deletion and Return

(1) Upon Contract Termination

The end of a paid subscription is not a deletion. The account continues on the free plan and the data remains stored unchanged, because the Controller still needs it. To that extent it continues to be stored on the Controller's instructions. The Controller keeps access to the data and to the export function.

Deletion happens when the Controller triggers it, and then immediately. Using the "delete account" function, the Processor removes the Controller's data at once and without any waiting period: sessions, transcripts, recordings, patient records, findings, appointments, documents and the account itself.

Excluded is data subject to statutory retention, in particular billing data under § 147 of the German Fiscal Code (AO) for ten years. Access logs remain necessary under Art. 32 GDPR and are therefore retained, but stripped of the entries that point back to a person.

Deleting the account does not shorten the retention period for support correspondence between Controller and Processor. As business correspondence it is deleted three years after the last message.

(2) Data Export

The Controller can download all data via the export function before contract termination.

(3) Backups

Data in encrypted backups will be deleted after the regular backup cycle (max. 90 days).

(4) Session Audio Recordings

Audio recordings are deleted from storage immediately after complete transcription. No separate instruction from the Controller is required for this.

Where the automatic check finds that the transcript does not cover the entire recording, the recording is retained for error analysis. In that case it is given a deletion deadline of 24 hours, counted from the transcription attempt and not from the upload. An automated run deletes the recording once that deadline has passed.

The audio segments created for processing are held only temporarily on the processing server and are deleted at the end of every transcription run, including runs that terminate early. They are not stored permanently.

Irrespective of the above deadlines, the Controller can delete a recording at any time.

In a video consultation the recording contains the Controller's voice and the other side's voice from the transmission, in two separate channels; the picture is not recorded. The patient's consent is obtained in the patient's browser. Consent and withdrawal are stored encrypted with the session, with time and version of the consent text. A withdrawal stops the recording at once; the part recorded until then is kept and subject to the deadlines above.

(5) Video Consultation Data

Call data (times, reason for ending, times of consent): 30 days after the call ends
Connection and device data for operation: 13 months after the call, earlier when the session, the patient or the account is deleted
Media server logs including IP addresses: 7 days
Records of consent with the session: as long as the session

§ 10 Audit and Inspection Rights

(1) Evidence

The Processor provides the Controller with information demonstrating compliance with obligations upon request:

Current TOMs (technical and organizational measures)
Copies of sub-processor DPAs
Security certificates (if available)

(2) Audits

The Controller has the right to conduct an audit once a year or have it conducted by an independent third party bound to confidentiality. Costs are borne by the Controller.

(3) Event-driven Audits

Additional audits are permissible in case of concrete suspicion of data protection violations.

§ 11 Liability and Damages

(1) Liability is governed by the statutory provisions of the GDPR, in particular Art. 82 GDPR.

(2) The Processor is only liable for damages arising from breach of their obligations under this DPA.

(3) The Controller is liable for all damages arising from unlawful instructions or from a lack of patient consent to the recording of conversations.

§ 12 Confidentiality

Both parties commit to treating all information obtained in the course of this agreement as confidential.

§ 13 Final Provisions

(1) Amendments

Amendments and supplements to this agreement require written form (electronic form also permissible).

(2) Severability Clause

Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.

(3) Applicable Law

German law applies.

(4) Jurisdiction

Place of jurisdiction is Koblenz, Germany.

Consent

☐

I have read and accept the Data Processing Agreement (DPA) and Privacy Policy.

Date: [Automatic at signup]

Therapist: [Name at signup]

Accepted by: Electronic consent at account creation

ANNEX 1: Technical and Organizational Measures (TOMs)

1. Confidentiality (Art. 32(1)(b) GDPR)

Physical Access Control:

Hetzner data center: High-security fence, video surveillance, access control system
2FA for administrative server access
IP whitelist for administrators

System Access Control:

Password requirement with minimum standards (min. 8 characters, upper/lowercase, numbers)
Optional: 2FA for therapist accounts
Automatic sign-out in the browser after 30 minutes without interaction, with prior warning; recordings and processing in progress count as activity. Users can sign out manually at any time

Data Access Control:

Role-based permissions
Per-user data separation (a therapist only sees their own data)
Audit logging of all data accesses

2. Integrity (Art. 32(1)(b) GDPR)

Transfer Control:

TLS 1.3 encryption for all data transmissions
No automatic data forwarding to third parties
Sub-processors only via encrypted connections

Input Control:

Logging of all data changes with timestamp and user ID
Versioning for important documents
Logging of deletion and modification operations

3. Availability and Resilience (Art. 32(1)(b) GDPR)

Availability Control:

Daily encrypted backups
Redundant server infrastructure at Hetzner
99.9% uptime guarantee through Hetzner SLA
Emergency recovery plan (max. 24h)

Separation Control:

Logical tenant separation at row level
Encryption keys derived per user
Query-level isolation (automatic userId filtering)

4. Encryption

At Rest (stored data):

AES-256 encryption for all sensitive fields
One Data Encryption Key per installation, managed via Azure Key Vault (Germany West Central, Frankfurt). The keys used per user are derived from it
Key management separated from data storage
The master key in Azure Key Vault is rotated automatically every 90 days. The Data Encryption Key is then re-wrapped under the new master key version.
Encrypted: Patient names, session notes, AI reports, diagnoses

In Transit (data transmission):

TLS 1.3 for all client-server connections
HTTPS-only (automatic redirect from HTTP)
Encrypted API calls to OpenAI

Video consultation:

Picture and sound encrypted between the browsers (AES-GCM) with one key per call; the media server cannot decrypt them
The key is created on the application server, stored encrypted with the user key and deleted when the call ends; the patient receives it only once the Controller has started the call
Separate media server at Hetzner in Germany, apart from the application server, without database and without user keys; signalling over TLS
Own TURN server, no public STUN servers of third parties
No recording on the server; recording of sound only, only in the Controller's browser, only after the patient's consent, with a visible indicator on both sides
Access tokens valid for 2 minutes, for camera and microphone only, at most two participants per room
Random room names and participant identifiers, without names or identifiers from Psynex
Invitation link with limited validity; the access code sits in the part of the address that the browser does not send to servers
No web analytics on the patient's page

5. Regular Review

Review Procedures:

Annual security review of TOMs
Automated vulnerability scans of dependencies
Monitoring of security incidents
Update management for all system components

Incident Response:

Defined notification process for data breaches
Notification of affected therapists within 24h
Documentation of all security incidents

6. Data Protection Impact Assessment

The Processor has prepared a data protection impact assessment for the processing under Art. 35 GDPR (as of 30 September 2026, updated on 19 October 2026 for the video consultation and the sub-processors bunny.net and GatewayAPI), covering audio recordings, health data and the processing by the sub-processors engaged. A summary will be made available to the Controller on request.

Note: This agreement is concluded electronically during registration. Consent is given by activating the checkboxes during the signup process.