Data protection and IT security
Data security with bookingtime
When introducing online appointment booking in a company subject to GDPR and professional secrecy under Section 203 of the German Criminal Code (StGB), such as a health insurance provider, numerous aspects must be considered to meet legal requirements. Compliance with these requirements is a core component of both bookingtime's corporate structure and software. The following points are essential in this process.
Legal basis
General Data Protection Regulation (GDPR)
Art. 6 GDPR
Lawfulness of processing.
Art. 13 & 14 GDPR
Transparency and information obligations.
Art. 35 GDPR
Data protection impact assessment (DPIA).
§ 203 StGB
For customers bound by professional secrecy, e.g. medical practices, psychotherapy, or insurers, we additionally oblige our employees and service providers to maintain confidentiality.
Technical and organizational measures (TOMs)
To ensure data security, the technical and organizational measures are geared towards special requirements and are regularly checked for effectiveness through pen tests.
For sensitive data, you can enable two-factor authentication for customers. Your customers then see their appointment data only after entering a code they receive by SMS or email.
Pseudonymization and anonymization are applied wherever possible to ensure data privacy.
Access rights and authentication are managed according to your internal policies, such as via OAuth 2.0.
Contract design with bookingtime
For appointment booking, bookingtime processes personal data on your behalf.
For this, we conclude a data processing agreement (DPA) with you in accordance with Article 28 GDPR.