{"locale":"en-DE","entries":{"k1046dwv8a5d":"Screenings","k10awl2mbbss":"Section 9 of the Model Professional Code for physicians practising in Germany. The professional code of the competent state medical association is binding: https://www.bundesaerztekammer.de/themen/recht/berufsrecht","k10oos9tiuyy":"Mobile navigation","k10xxge63xnt":"No aggregate figure for a group below a minimum size","k11bgoemu6tz":"Broken down by health topic: no figure below a minimum size","k11ck7x9perx":"Twelve questions, each with its source reference. The results are calculated in your browser, and nothing is transmitted.","k11repk5uea":"German law","k12981qcbt6h":"Restriction of access to the data","k12blg3swkv":"HEALTH PRIME","k12ja8vtfcua":"a TOM document, structured exactly according to this list","k12xjnegmj2u":"5","k13nyexvemd3":"excluded by contract","k13tj7w2i7c5":"15","k13yp2zcmko8":"Level","k13zkoy87ng":"This is not a legal trick but a description of what actually happens. A medical examination is preventive care, and the data sits with people who are bound by confidentiality.","k14a4l63vyed":"The employer does not learn who took part.","k14djb5d3uzs":"No examination against the will of the employee.","k14uo6ddh49t":"Our commitment:","k14yi1c7tt6f":"Executive Medical Office (for companies)","k1548cilj3zg":"11Co-determination: why your works council has a say, even when participation is voluntary#","k154nywbpt38":"No paragraph numbers. The legal derivation follows further down.","k15eundcqd3x":"Art. 9 GDPR, Section 26 and Section 22 BDSG, Section 203 StGB, GenDG and BetrVG: how a voluntary health programme is built so that the employer receives no individual health data.","k15g0vl8qfa1":"Link to this section: 5.2 Recital 43, read correctly","k1611af9w1me":"none, during working hours","k16b7hwq5o8h":"Bowel cancer screening","k16lpr24i6pl":"What is mandatory and what is optional, works council, occupational physician, health insurance fund, taxes and process, with a readiness check and planner.","k17li2m7iwlo":"Voluntary health screening (workplace health promotion)","k17rvkludqok":"Terms and conditions","k17yx09zojev":"Your data protection officer and your works council should have these documents before the project starts. Ask every provider for them, including us:","k186m5d07tlo":"Thyroid ultrasound","k18dnqfj9hi8":"Section 3(1) EntgFG (six-week limit, as a reference to Section 167(2) SGB IX): https://www.gesetze-im-internet.de/entgfg/__3.html","k18vy5sdkc1m":"Close menu","k195kxbq9pjx":"Registration does not go through HR; only aggregated utilisation figures; no lists of no-shows. Set out in the contract and the works agreement","k19803tm2jcu":"9","k198oike7izc":"22. The short answer for employees","k199h9ldikk4":"Para. 2(b) and (h)","k19nvkmka58s":"1616. Data protection check","k1a4epr0afn2":"Private Medical Office","k1a70ngqh6g2":"Print or save as PDF","k1a9yayz4e06":"https://www.gesetze-im-internet.de/betrvg/__87.html","k1axnarzri6i":"Invitation, information, rooms, logistics, aggregated reporting","k1b8dmzz45ee":"Link to this section: 4.3 The consequence for responsibility","k1bqry5yjx69":"This page is not a privacy policy. The specific terms for a project are set out in its data protection notice and contract documents, not here.","k1briop0vdh0":"Link to this section: Our documents","k1c8h06wo1gv":"For projects in Germany, your point of contact is the Swiss company. Before every project, we clarify the scope, the parties involved and the data protection arrangements in writing.","k1c8pushbwwx":"Medical data is held only by people bound by professional secrecy.","k1cujigjpl08":"Back to home","k1cx9ny6x312":"The route the market usually claims. Open to challenge in the employment relationship, see section 5","k1ddpffklbsn":"none; working time treated as set out in the works agreement","k1dlaal2gsc5":"Training of the staff deployed, with proof","k1dul0gte2ix":"Link to this section: Art. 9 GDPR: health data are prohibited unless","k1duwabw1m5i":"Art. 7(3) GDPR","k1e0g0x0f9g8":"99. The risk assessment: what happens to this data","k1ef6qd188nv":"Court of Justice of the European Union, judgment of 30 March 2023, C-34/21 (Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium)","k1evsco8q5m0":"Section 6(1) ArbMedVV as the benchmark; ours is voluntary anyway","k1evxpzenjl2":"Link to this section: The boundary: occupational health checks versus voluntary screening","k1f7bvtn8tkt":"Para. 2(h), plus (a) for anything beyond that","k1fh2lbau5h7":"Melanoma screening","k1fstccyxsb0":"Introducing a health programme","k1fvbtxs3oom":"Mandatory check: compulsory for the activity. Offered and on-request checks: offered","k1fx5ypin7fo":"Almost every German corporate health management page begins with 'we obtain consent'. The right starting point is a different one.","k1fxjfjoarh3":"Art. 6 GDPR, works agreement as a collective agreement under Art. 88(1) GDPR","k1g0616ybskw":"Section 87(1) nos. 1, 6 and 7 BetrVG. See section 11","k1gyi3mjpdgv":"These thresholds are set out in the works agreement","k1gz9csbqpz7":"This page explains the publicly available evidence and legal position for educational purposes. It is not legal, tax or medical advice. In any individual case, the linked legal texts and your professional advisers are authoritative.","k1ha6oburtxv":"likewise agreed before the project starts, usually higher than the general threshold","k1hedw8ud2t":"Anonymisation must be demonstrated to the employee representatives","k1hgom5j48uf":"20","k1hl7qqp3vm8":"Section 3(3) ArbMedVV","k1hveoe1vsll":"4.1 The four exceptions that matter in corporate health management#","k1hzw6io5edi":"15Our documents#","k1ihm4ag7wrm":"9The risk assessment: what happens to this data#","k1il8w5iiddm":"© 2013 - 2026 Health Prime AG","k1irwhyud2xo":"We say two things about this, and both matter:","k1itj9gtenpj":"Germany","k1j4g9jxck2a":"Employer, statutory obligation","k1jeqwr1hxfb":"Introducing a health programme in Germany","k1jg2e3eehp7":"Reset answers","k1jgvbwxjonl":"7.2 The professional code of conduct#","k1joo2fjd6yc":"Section 203(4) StGB","k1k8w2q10e35":"Link to this section: 4.2 Why we build on point (h) and not on consent","k1kald21ecob":"Sanction","k1ktlr0ctit9":"Controller","k1kywg4iffl8":"Registration, appointment management, examination, findings, advice, medical records","k1l5idq63wa4":"Vein screening","k1lb2r8jv2pq":"Skip to content","k1ltgixz2nlx":"Contents","k1ly5i7am24h":"10BEM is something different#","k1mbryimm61j":"The full account and its practical consequences are on our page Introducing a health programme. Here is the short version for data protection.","k1mcyypngyne":"Sections 3 and 6 ArbMedVV: https://www.gesetze-im-internet.de/arbmedvv/__3.html · https://www.gesetze-im-internet.de/arbmedvv/__6.html","k1mgdl5zooc4":"Recital 43 GDPR: https://dsgvo-gesetz.de/erwaegungsgruende/nr-43/","k1mjgx8qdp26":"6","k1mme3xe9fxg":"Entirely voluntary","k1n927q29qg6":"Legal notice","k1n9g5f48c7p":"Is there a deletion plan that separates the physician's duty to document from data minimisation?","k1n9wenxo43u":"'for the purpose of preventive care, for the assessment of the working capacity of the employee, for medical diagnosis, the provision of health or social care or treatment or for the management of health or social care systems and services'","k1nffu73yxii":"5.1 What Section 26(2) BDSG says, and it is more favourable to us than often portrayed#","k1nfgdegcwhz":"Section 203(3) StGB permits disclosure to 'assistants working for them professionally' and to persons in training, where necessary.","k1nl063gi4a8":"Supervisory authorities","k1nwzsyrprgp":"What must be defined and documented before the project starts","k1oly4kh2add":"Service navigation","k1ooqfku1w1b":"Link to this section: Co-determination: why your works council has a say, even when participation is voluntary","k1oqedm1zrgc":"No","k1oyc6dze5pi":"12","k1ph9tqkdp3j":"The figure is agreed before the project starts and recorded in the works agreement","k1pims7t7ppa":"Genetic Sciences overview","k1pohdc0blqr":"Link to this section: Disclaimer","k1ppcoghdhkn":"Art. 5(1)(b) GDPR, works agreement","k1pqin4htz5s":"8The boundary: occupational health checks versus voluntary screening#","k1q039dusi20":"Section 22 BDSG (special categories, list of measures in subsection (2)): https://www.gesetze-im-internet.de/bdsg_2018/__22.html","k1q86tmvxy5f":"Table, scrolls horizontally","k1q9q6675dz":"For orientation only, not a legal assessment of your individual case. Your answers never leave your browser.","k1qf849zlkly":"16Data protection check#","k1qhv3s0hqkr":"Legal basis under Art. 9 GDPR","k1rd2ykjy8q5":"Reports only at or above the agreed minimum group size, no cross-tabulations that allow reconstruction, anonymisation that can be demonstrated to the works council.","k1rhwg43cgha":"13Aggregated reporting and the minimum group size#","k1salxq0d2hm":"yes, on request","k1sdyylsrv3h":"Obligation","k1stl9cx0gkg":"Link to this section: 7.2 The professional code","k1t04wpnkvp7":"77. Medical confidentiality: Section 203 StGB and the professional code of conduct","k1t7pa36zkd0":"Link to this section: BEM is something different","k1tlzt3y2sof":"The comparison:","k1toapcsnpjw":"All screenings","k1tochokg1id":"Meaning in corporate health management","k1ukb2dj5tsg":"7.3 And the independence of the occupational physician's role#","k1unyvsao393":"Kiesche, E.: Betriebliches Gesundheitsmanagement. Betriebs- und Dienstvereinbarungen. Analyse und Handlungsempfehlungen, Hans-Böckler-Stiftung und Bund-Verlag, Frankfurt am Main 2013, ISBN 978-3-7663-6274-2. 125 agreements analysed; the analysis predates the GDPR","k1v0anl47fyb":"Link to this section: Section 22 BDSG: the German opening clause and our list of measures","k1vni7cf95r6":"Yes","k1vuvj9frmtm":"This is the most useful section of the page for an HR buyer, because German law spells out the answer in a single sentence.","k1w6dyfocbgd":"Company","k1waf48nc054":"Services","k1wd0sxrvmm5":"8","k1wubzd3wh2n":"Medical Family Office","k1wux06mgzzv":"Name and contact details in the project's data protection information","k1wvkpwkl7vl":"Regular review of effectiveness","k1x9b2n7f7d9":"Further provisions of the same ordinance:","k1xky1e40k6w":"An explanation of the legal position, not legal advice and not a privacy policy. Terms specific to a project are set out in that project's data protection notice.","k1xlcx5ixn6x":"Provision","k1xwy3sb3t2l":"Open menu","k1yc1erqtt4b":"New screenings for 2026","k1yciwgyxis4":"55. Consent in employment: the problem others do not mention","k1ytv0nl9x6c":"Medical Family Office submenu","k1z5npueb55g":"YesNo","k1z842habbck":"Nobody. The employee decides","k1za00o4z17y":"1111. Co-determination: why your works council has a say even though participation is voluntary","k1zbw7km3f8x":"Nutrition coaching","k201dihoypwf":"Facts & Figures submenu","k202qpgmiygh":"More facts on workplace health","k20cy4x5zudl":"5Consent in employment: the problem others do not mention#","k20fztmlnouj":"Data protection, confidentiality and co-determination in corporate health management","k20gjnccbj2m":"European law","k217me0g8k7x":"Raising employee awareness","k21kjj7isdcs":"12Genetic data: the Genetic Diagnostics Act#","k2224qm7va23":"'By assessing the hazards associated with employees' work, the employer must determine which occupational health and safety measures are necessary.'","k225byss91i6":"Link to this section: 5.3 Art. 7 GDPR and a verifiable commitment","k226gsxcw10n":"Link to this section: 14.1 The conflict over deletion, explained openly","k22engqkfoia":"Section 5(1) ArbSchG:","k22tv7x5zqri":"5.4 Why we do not rely on Section 26(1) BDSG#","k232sfixus4t":"Your employer receives no individual health data from us. Not your result, not your findings, not even whether you took part.","k23nlqpuy8ej":"Pharmacogenetics","k23rcxgrvbi5":"State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, FAQ on legal bases for employee data: https://www.baden-wuerttemberg.datenschutz.de/faq-rechtsgrundlagen-bei-beschaeftigtendaten/","k23u2avk258h":"Art. 9(3)","k23zbswv2ls7":"Link to this section: Two statements we do not make","k241qhc3g5q1":"Screenings submenu","k2477r9r3v8e":"Data is deleted once the measure ends.","k24a156f1w62":"A free, voluntary preventive examination that the employee would otherwise have to arrange privately comes close to the textbook case of a 'legal or economic advantage'. We say so, and we still do not present consent as unproblematic.","k24emjk4z7o1":"News","k25a749nk5ry":"Data protection Germany","k25n7sur56t7":"Link to this section: 7.1 The criminal provision","k25rfqv5obhv":"The storage location and the service providers we use are disclosed.","k25s5u0sji1e":"Consent can be withdrawn at any time, in one step, and not through the HR department.","k25zmoucnxys":"Section 6(3) ArbMedVV obliges the doctor","k260hxbl748p":"Designation of a data protection officer","k26wu9b6gxb":"Specialist literature and practice","k26y3ma7upbg":"Standard clause of the works agreement; prohibition of victimisation under Section 612a BGB","k27lh51qr4ic":"11","k280drygrmq9":"Value","k2884cy9we1y":"Link to this section: 5.4 Why we do not rely on Section 26(1) BDSG","k288cxzuxkjm":"Basis","k28bq96l6y5r":"Data protection impact assessment","k28irktl4rp":"88. The boundary: occupational health checks versus voluntary screening","k28rng1yixft":"7Medical confidentiality: Section 203 StGB and the professional code of conduct#","k29biig6uiv4":"Link to this section: 5.1 What Section 26(2) BDSG says, and it is more favourable to us than often presented","k29n47ahcbud":"Link to this section: Sources","k29qveckbvt9":"Have you settled who is the controller for each data category?","k29rd491eefi":"Main navigation","k29vz0esc58t":"How enforcement works, and it is counter-intuitive:","k2a918173p72":"1313. Aggregated reporting and the minimum group size","k2ajzd3uca22":"Wording, abridged","k2artas3j1to":"10","k2axbqyg8dqz":"WhatsApp Chat","k2b6870xc2kj":"1414. What we do structurally","k2bh05mwaor2":"Visibly and organisationally separate from any fitness-for-work examination.","k2bv3skcrjtz":"The business case for corporate health management in Germany","k2c7vx37k0vh":"4","k2cmq4bypsq":"4Art. 9 GDPR: health data is prohibited unless#","k2cpj3y06jv":"Appoint a data protection officer","k2cujltk2e3f":"Checklist","k2cxg2fubsp8":"Further reading: Baden-Württemberg State Commissioner for Data Protection, FAQ zu Rechtsgrundlagen bei Beschäftigtendaten (https://www.baden-wuerttemberg.datenschutz.de/faq-rechtsgrundlagen-bei-beschaeftigtendaten/) and Hessian Commissioner for Data Protection and Freedom of Information, Handreichung April 2023 (https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2023-04/handreichung_beschaeftigtendatenschutz_eugh-urteil.pdf).","k2dkqm6pp7z5":"11. The one-sentence commitment","k2dp3i8opz8v":"7.1 The criminal provision#","k2dtbhdcc7t":"Ensuring confidentiality, integrity, availability and resilience","k2dvmew4k11q":"Art. 9(2)(b)","k2fb1336ouc":"As at September 2026. Next review: March 2027 or on any amendment to Section 26 BDSG.","k2ffujgztn66":"Employer, based on the risk assessment","k2g00311ogv4":"Why this appears here even though we do not offer BEM:","k2goood5tj8p":"As at September 2026. Next review: March 2027, or immediately if Section 26 BDSG is amended or an employee data act enters into force.","k2k573c6hhb":"About us","k2krckysn56":"Link to this section: The short answer for employees","k2ralr3crdl":"That is not a promise but a consequence of how the service is built. This page explains how it is built, with article, paragraph and link, so that your data protection officer, works council and legal department can check it rather than take our word for it.","k2s8ijndieg":"1The one-sentence commitment#","k3tgw24pdjy":"Art. 37 GDPR, Section 38 BDSG: where 20 or more people are regularly engaged in automated processing, and regardless of headcount wherever a data protection impact assessment is required","k3xtaznplwb":"7","k4b1o0v1tsz":"Eye screening","k4djdp6qilw":"17Two statements we do not make#","k4v8z8xjgy1":"Art. 5, 6, 7, 9, 13, 17, 26, 28, 30, 32, 35, 37, 88 GDPR: https://dsgvo-gesetz.de/","k56n0u5anoh":"Employer, with statutory health insurance fund support under Section 20b SGB V where applicable","k5fjryto3lk":"4.3 The consequence for responsibility#","k5tb5dj253r":"Link to this section: Genetic data: the Genetic Diagnostics Act","k65vpw92kcd":"Epigenetic coaching","k68ygcqemn6":"14What we do structurally#","k6gq49solxu":"Link to this section: Aggregated reporting and the minimum group size","k7jeyqp2osq":"Legal basis","k7mhxmhbyfy":"Rule","k7se5tgxhux":"What it follows from","k844mxevra":"3The short answer for employers#","k8cxwfzuh3o":"Genetic Sciences submenu","k8ioymy98xf":"Requirement under Section 22(2) BDSG","k8jh64slxy6":"Art. 9(3) GDPR; Section 203(1) StGB","k8rskdrwvwb":"Talk to us","k9stl3e5xy2":"Art. 9(2)(h) in conjunction with para. 3 GDPR, Section 22(1) no. 1(b) BDSG","ka2dwzgfdj2":"Employer learns","kaiywayie5l":"Genetic Sciences","kar72h8cxi":"5.2 Recital 43, read correctly#","karmquxs4no":"GKV-Spitzenverband: Leitfaden Prävention, version of 17 December 2025, in particular on the requirements for digital services: https://www.gkv-spitzenverband.de/media/dokumente/krankenversicherung_1/praevention__selbsthilfe__beratung/praevention/praevention_leitfaden/20251218_Leitfaden_Pravention_2025_barrierefrei.pdf","karvhwqm6qd":"More dossiers","kaubzv37s2b":"Participation","kb3d0oombjl":"Sections 5 and 6 ArbSchG: https://www.gesetze-im-internet.de/arbschg/__5.html · https://www.gesetze-im-internet.de/arbschg/__6.html","kbexijw92lv":"Link to this section: The risk assessment: what happens to this data","kbkhtnmxiyy":"Section 8 ASiG (freedom from instructions and duty of confidentiality): https://www.gesetze-im-internet.de/asig/","kbu00fayocs":"1515. Our documents","kch6ejr7rql":"1010. BEM is something different","kcjryxc6ni9":"There is no data processing agreement for the medical level, and that is deliberate.","kcqb6ojlk8g":"Cost to the employee","kczc8jzrpb7":"3","kd6wgp2lqx":"Is a minimum group size for reports agreed by contract?","kdps33hei9g":"The business case for corporate health management","ke9w6fxii4y":"Involve the works council","keb8yocn9h3":"Link to this section: The short answer for employers","kektmbcx0lm":"Technical and organisational measures","kemhgni9yrs":"1","kf70l59vhoh":"What the evidence supports and what it does not. With an absence cost calculator and a Section 3 no. 34 EStG budget helper.","kge7ku02eq1":"Art. 13 GDPR. The storage location is agreed before the project starts and documented in the project's data protection notice","kgih9xxw7uv":"Link to this section: What we do structurally","kgkmlf2i77o":"Link to this section: 7.3 And the independence of the occupational physician's role","kh3eli3ase2":"Contact","kh42f23d590":"Countries","khbondudmkl":"yes","khdu7bdy1jh":"Link to this section: Consent in the employment relationship: the problem others keep quiet about","khx370dscqd":"Scope of logging in the medical system","kihg0cj00rt":"Rules for transfer and change of purpose","kimyd3rdqlw":"WhatsApp","kj0oxzpw9ip":"44. Art. 9 GDPR: health data is prohibited unless","kj5hqx0025b":"Clients","kj7l8xbhfqh":"Health promotion, mental health and stress management for your employees through corporate health management. We combine innovative pharmacogenetics with practical health solutions.","kjelykw0inj":"Works agreement","kjfhdxh57a4":"Who pays","kjw5b2zu59g":"Section 38 BDSG (data protection officers of non-public bodies): https://www.gesetze-im-internet.de/bdsg_2018/__38.html","kk0qub4mqbe":"Link to this section: 4.1 The four exceptions that matter in corporate health management","kko8lc4762v":"'Doctors must maintain silence about what has been entrusted to them or has become known to them in their capacity as doctors, even beyond the death of the patient. This also includes written communications from the patient, records about patients, X-ray images and other examination findings.'","kksz2b1dw7h":"Private Medical Office (for individuals)","klf2qndy5bo":"1212. Genetic data: the Genetic Diagnostics Act","klnc0kmh96o":"Employer","klpk5vjovr5":"Samstagernstrasse 55","km6wczitmnu":"This freedom from instructions is the reason why an external provider cannot replace occupational medical care but can only work alongside it.","kmfe0csajlf":"info@health-prime.ch","kmk6jpiurug":"Corporate health management in figures: Switzerland 2026","kmkd7bm6s4o":"Workshops and seminars","knh0q8yhck3":"Under data protection law, two things need to be kept apart:","knnqm0dyuuf":"Link to this section: The one-sentence commitment","knp2sr3uhgu":"Initiated by","knxriu1h5rx":"Section 203 StGB (breach of private secrets, in particular subsections (3) and (4)): https://www.gesetze-im-internet.de/stgb/__203.html","kod3332r2rt":"Have you settled which exception under Art. 9(2) GDPR you rely on?","kohojik6h1t":"both Section 25 (criminal law) and Section 26 (administrative fine of up to fifty thousand euros)","kokce5pld6q":"Data security","kokqbulbao5":"No cross-tabulation from which a smaller cell could be reconstructed","kow7sqvye5g":"Facts & Figures","kp2jsof3d7c":"Cardiovascular screening","kp2zt6q3ajj":"Link to this section: Data protection check","kp60vz7f6h4":"4.2 Why we build on point (h) and not on consent#","kq6oc9b1f5v":"Section 87, Section 77(6), Section 80, Section 88 no. 1 BetrVG: https://www.gesetze-im-internet.de/betrvg/__87.html · https://www.gesetze-im-internet.de/betrvg/","kqauxhlptms":"Art. 9(2)(h) in conjunction with Art. 9(3) GDPR; Section 22(1) no. 1(b) BDSG; Section 203 StGB","kqcbw2pk525":"Art. 5(1)(c), Art. 9 GDPR","kqf3bstqh85":"Frequency and proof","kqwh3r1virt":"What your own obligations are:","kqyz70bwgoq":"Executive Medical Office","kr5cyt7qe9h":"Corporate health management in figures: Germany 2026","krlzowmeplq":"Art. 9(2)(a)","krujt4whgdt":"Sections 19, 20, 21, 22, 25 and 26 GenDG: https://www.gesetze-im-internet.de/gendg/","kry8q6b6slj":"Four statements this page supports:","ksg1ti3g3d6":"14.1 The conflict over deletion, explained openly#","ksralfge3al":"Role and permissions concept; no access for people not involved in the case","kssti1cmalm":"Sickness absence rates compared across eight sources, plus costs, mental health, presenteeism and prevalence, with the basis given for every figure.","kssutum3jvy":"Menu","kt146qydhx2":"5.5 The Employee Data Act (Beschäftigtendatengesetz)#","kt1qkcsl5ir":"33. The short answer for employers","kt3qcm88iig":"Concept including recovery","kt627t5jiqi":"Switzerland","ktqdomog565":"Corporate health management in figures: Germany 2026","ktx8sa9l6w8":"Legal","ku3a61tb90u":"Can you rule out registration going through the HR department?","kubhtpx6ur2":"No analysis of health data to assess performance or behaviour.","kubvxhg2xm3":"5.3 Art. 7 GDPR and a verifiable commitment#","kuc29x58hde":"Encryption in transit and at rest; pseudonymisation for analyses","kuu27nbha50":"Occupational health check (ArbMedVV)","kuxwcvyorsy":"Link to this section: 5.5 The employee data act","kuys0bpzykh":"Art. 9(1) GDPR, verbatim:","kv01q8pmbsk":"Our non-medical staff are also bound to confidentiality, formally and on record.","kv6e2aavawz":"Health Prime AG","kv73ld7m1x0":"Every commitment in this table follows from the sections above. None rests on trust alone.","kvdszmtf2gb":"6Section 22 BDSG: the German opening clause and our list of measures#","kvnnvtec7nv":"Purpose limitation; it can be lifted only with the agreement of the works council and the consent of the person concerned.","kw0z5rowv7z":"Link to this section: Medical confidentiality: Section 203 StGB and the professional code","kwed51sjeea":"Hessian Commissioner for Data Protection and Freedom of Information, guidance on the CJEU judgment, April 2023: https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2023-04/handreichung_beschaeftigtendatenschutz_eugh-urteil.pdf","kwfy8w0do8m":"0 of 12 questions answered.","kwo5plg3ydj":"Such an agreement would imply that the employer can give instructions about medical data","kwqm2odb8m6":"2The short answer for employees#","kwsrpwlsgw1":"Commitment","kwxwuuip05p":"'This check is a guide, not a legal assessment of your individual case.'","kx21vqio20l":"66. Section 22 BDSG: the German opening clause and our list of measures","kx7qz7m11kn":"A note on accuracy: we deliberately avoid the dramatic talk of penalties that is popular in provider copy. One year, or two in aggravated cases, is the position under German law.","kxgxfkw350l":"Link to this section: FAQs","kxln9by5s8z":"Section 88 no. 1 BetrVG, and at the same time a collective agreement under Art. 88(1) GDPR","kxsj3gutdp6":"Language","kye35e9r57x":"Section 26 BDSG (processing of employee data, consent, collective agreement): https://www.gesetze-im-internet.de/bdsg_2018/__26.html","kyfwyujuwr8":"2","kyjg92veavd":"8832 Wollerau","kymf1hv6jp6":"Data protection in corporate health management","kyttn9zdlul":"Art. 9(2)(h)","kz98q7eg8rb":"1717. Two statements we do not make","kzk4d3z1ykb":"The employer receives no individual health data.","kzkkclj51yi":"Pseudonymisation and encryption","m108j5abklfl":"<0>What you may not demand:</0> individual results. Not even with the employee's consent, where the data falls under medical confidentiality and the processing is based on Art. 9(2)(h) in conjunction with Art. 9(3) GDPR. A provider who reports individual findings to an employer creates liability rather than avoiding it.","m10naohm9cze":"<0>Consent form</0>, kept separate from other declarations, under Art. 7(2) GDPR","m10s0cq0mwde":"<0/>Disputed<1>This responsibility analysis has not been conclusively settled in law. The opposing view assumes joint controllership under Art. 26 GDPR for the organisational level.</1>","m115jr3w5r1j":"<0>Section 9 of the Model Professional Code for Physicians Practising in Germany</0> reads, in paragraph 1:","m11fagldqgux":"<0>Section 19 of the Genetic Diagnostics Act (GenDG)</0>, verbatim:","m11gelan914t":"<0>5</0>5. Consent in employment: the problem others do not mention","m1226d1tqr15":"<0>4</0>Art. 9 GDPR: health data is prohibited unless<1>#</1>","m123hsch4ra2":"<0>12</0>Genetic data: the Genetic Diagnostics Act<1>#</1>","m127ndyuo0v1":"<0>19</0>Sources<1>#</1>","m12hwjzt7fy3":"<0>Confidentiality undertaking</0> under Section 203(4) StGB, documented for each person","m12z4yz1rlte":"A note for procurement: for <0>digital</0> services, the GKV Prevention Guide (Leitfaden Prävention) takes as its benchmark an information security management system based on ISO 27001, with a certificate that must be presented, and ISO 27018 for cloud operation. Your group procurement team will ask for exactly this.","m12zsuq6z2cd":"<0>Data is deleted once the measure ends.</0>","m12ztl0hx7nl":"<0><1>15</1>15. Our documents</0>","m13ahzxrwwjn":"<0><1>10</1>10. BEM is something different</0>","m13bgmsdlukk":"<0>Section 6(3) ArbMedVV</0> obliges the doctor","m13d6z794h66":"<0><1>1</1>1. The one-sentence commitment</0>","m13dd28hrqgd":"4.2 Why we build on point (h) and not on consent<0>#</0>","m13vjik16s7s":"<0>Section 80(2) BetrVG</0> gives the works council rights to information and documents <1>even where there is no co-determination</1>. <2>Section 80(3) sentence 2 BetrVG</2> provides that, where artificial intelligence is involved, calling in an expert is deemed 'necessary to that extent', at the employer's expense.","m13wd4hwy0gr":"<0>What happens to my data?</0><1/>Your examination results go to the doctor who examines you, and to you. Nobody else sees them. You receive your results in person and discuss them with a doctor.","m14gnjwlnbmx":"<0>Private Medical Office (for individuals)</0>","m14ln7jxyg98":"<0>Have you carried out a data protection impact assessment or documented why one is not needed?</0><1>Art. 35 GDPR</1>","m155rpkqhjw3":"<0>Section 6(1) sentence 6 ArbMedVV:</0> 'The doctor must observe medical confidentiality.' And: examinations may not be carried out <1>against the employee's will</1>.","m15eijz5eabr":"Processing under point (h) is permissible only if the data is processed by or under the responsibility of professionals subject to an obligation of <0>professional secrecy</0>","m15mhzb974eb":"<0>Section 167(2) SGB IX</0> obliges the employer, where an employee has been unfit for work for <1>more than six weeks within a year</1>, whether continuously or repeatedly, to clarify the options for overcoming the incapacity for work, namely '<2>with the consent and participation of the person concerned</2>', involving the employee representatives, where applicable the representative body for severely disabled employees, at the employee's request a person of trust of their own choosing and, where necessary, the company or occupational physician, with prior information about the data collected and the aims of the procedure.<3/><4>https://www.gesetze-im-internet.de/sgb_9_2018/__167.html</4>","m15sej786j64":"<0>Executive Medical Office (for companies)</0>","m15td65yrbt2":"<0>Survey data from a risk assessment of mental stress must be analysed so that no person and no very small unit can be identified.</0> The minimum group size under section 13 applies here in exactly the same way.","m16jbb5dsxzp":"<0>Print or save as PDF</0>","m16owperdz0l":"<0>What this means for us, and it can be verified:</0> our non-medical employees are formally bound to confidentiality under Section 203(4) StGB, the obligation is documented for each person, and we provide the declaration of commitment on request.","m174cbctkiu":"<0>For the medical data, the employer is neither controller nor processor.</0> The architecture is a split:","m17fz3yk31p8":"<0>Bowel cancer screening</0>","m17zy3iacekt":"<0>8</0>8. The boundary: occupational health checks versus voluntary screening","m18civo9isdf":"<0>Visibly and organisationally separate from any fitness-for-work examination.</0>","m18mca3mtjw9":"<0>What if my employer demands it anyway?</0><1/>We do not supply it. For the medical level, processing is lawful because it stays within medical confidentiality (Art. 9(3) GDPR). Passing it on would remove that basis and engage Section 203 StGB.","m197br0mgmcs":"<0>No analysis of health data to assess performance or behaviour.</0>","m19ho974zgw8":"<0><1/><2>Yes</2></0><3><4/><5>No</5></3>","m19nez1qbh2l":"<0>Your employer receives no individual health data from us. Not your result, not your findings, not even whether you took part.</0>","m19rfbsy9s7c":"<0>What employers should take from this:</0> if a provider offers you genetic or pharmacogenetic analyses as part of a workplace programme, check very carefully where your company could come into contact with the results. <1>Section 19 GenDG prohibits you even from accepting them.</1>","m19whmpvvkwx":"Section 9 of the Model Professional Code for physicians practising in Germany. The professional code of the competent state medical association is binding: <0>https://www.bundesaerztekammer.de/themen/recht/berufsrecht</0>","m1a6uz9uwo3j":"<0>Section 5(1) ArbSchG:</0>","m1agytqozguf":"<0>It is the one German health data procedure that every HR department already knows.</0> It supplies the mental model.","m1ahggn1bsew":"Sections 19, 20, 21, 22, 25 and 26 GenDG: <0>https://www.gesetze-im-internet.de/gendg/</0>","m1anngqjb50u":"<0>Employer</0>","m1bl4l4refvq":"Section 167(2) SGB IX (BEM): <0>https://www.gesetze-im-internet.de/sgb_9_2018/__167.html</0>","m1brxwpktla2":"<0>We deliberately cite no case numbers on this page.</0> The doctrine is set out here in clear language; the references are in our internal legal memo and are handed over on request. A wrong case number on a page whose value lies in its diligence would be an own goal.","m1bsyj4iv8r4":"<0>Designation of a data protection officer</0>","m1c1nv5jz9zk":"<0>We say two things about this, and both matter:</0>","m1cmstfk1tsp":"<0>Legal notice</0>","m1ctqemcewl0":"<0>Cardiovascular screening</0>","m1d6cgdocia1":"<0>Switzerland</0>","m1d7hygejiy3":"<0>Clients</0>","m1dqix8m00jk":"<0>Why do you need consent at all if you rely on Art. 9(2)(h)?</0><1/>Consent legitimises participation and everything that goes beyond the core medical processing. It cannot make the processing lawful on its own, however, because consent in an employment relationship is fragile.","m1e9ev2jvx5p":"<0>A point of accuracy we care about:</0> the Model Professional Code is a <1>model</1>. What is binding is the <2>professional code of the competent regional medical association</2>, and these differ from one another. Anyone who cites 'the MBO-Ä' as if it were law is being imprecise.<3/><4>https://www.bundesaerztekammer.de/themen/recht/berufsrecht</4>","m1efur2c5qw5":"<0>Involve the works council</0>","m1ekna0lg1vq":"<0>How long is my data stored?</0><1/>The organisational data is deleted once the measure ends. Medical records are subject to medical retention obligations, which conflict with data minimisation. We explain that conflict in section 14 rather than hide it.","m1ep4p4p9mq5":"<0>Anonymisation must be demonstrated to the employee representatives</0>","m1exjztmyco5":"<0>Introducing a health programme</0>","m1ez6ura1cvg":"Purpose limitation in the contract and in the works agreement; purpose limitation may be lifted only with the works council's consent <0>and</0> the consent of the data subject","m1f4kehk5yjz":"<0>Is a screening the same as occupational health checks?</0><1/>No, and it does not replace them. Occupational health checks are regulated by law and arranged by the employer on the basis of the risk assessment. A voluntary screening is an additional service. The two are kept visibly and organisationally separate (Section 3(3) ArbMedVV).","m1faevmrg5tk":"Art. 5(1)(e), Art. 17 GDPR. <0>Keep the tax retention of payroll records separate from the deletion periods for health data.</0> These are different obligations on different documents","m1fiaj9xhhmw":"'In order to ensure that consent is freely given, consent should <2>not provide a valid legal ground</2> for the processing of personal data in a specific case where there is a <0>clear imbalance</0> between the data subject and the controller, in particular where the controller is a <1>public authority</1> and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.'<3/><4>https://dsgvo-gesetz.de/erwaegungsgruende/nr-43/</4>","m1flihgdk8g":"<0>Art. 9(2)(b)</0>","m1fr25fqgoy2":"<0>Reset answers</0>","m1gcatjzwsb4":"<0>No. 6:</0> 'The introduction and use of technical devices designed to monitor the conduct or performance of employees'","m1gtzsdypwdr":"'the data subject has given <0>explicit consent</0> to the processing … for one or more specified purposes'","m1ieg0uh78au":"necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject <0>in the field of employment and social security and social protection law</0>","m1ifyp8pi7f2":"<0>Medical confidentiality is backed by criminal penalties</0>, and Section 203(4) StGB obliges us to bind our non-medical staff formally as well. This obligation must be documented for each person; you can ask for the evidence before the project starts.","m1in2dglzpir":"<0>Genetic Sciences overview</0>","m1izrykgr6a3":"4.1 The four exceptions that matter in corporate health management<0>#</0>","m1j2ibduskj7":"<0>Medical data is held only by people bound by professional secrecy.</0>","m1jwtgd2ft9f":"<0>16</0>Data protection check<1>#</1>","m1kmjz1mc164":"<0>Our commitment:</0>","m1m15wum1vl8":"<0>17</0>17. Two statements we do not make","m1m6immksw4p":"<0>Art. 9(3)</0>","m1m6zxio6cn":"<0>9</0>9. The risk assessment: what happens to this data","m1mmyh505gzu":"<0>Section 21 GenDG (prohibition of discrimination in employment):</0> 'In any agreement or measure, in particular when establishing the employment relationship, in career advancement, in giving instructions or on termination of the employment relationship, the employer may not discriminate against employees on the basis of their own genetic characteristics or those of a genetically related person.'","m1n3l7k9kp24":"<0><1>5</1>5. Consent in employment: the problem others do not mention</0>","m1n9c2sz2dcg":"<0>3</0>The short answer for employers<1>#</1>","m1nbbwv11q0x":"The full account and its practical consequences are on our page <0>Introducing a health programme</0>. Here is the short version for data protection.","m1o010gyui7t":"<0>Section 20 GenDG</0> prohibits genetic examinations as part of occupational health checks, with a narrow exception for diagnostic genetic analyses relating to a serious illness that can be triggered at the workplace. <1>[The precise exception and its conditions must be verified before any public statement.]</1>","m1o9fq5d1dt1":"<0><1>16</1>16. Data protection check</0>","m1oaji6gkxjg":"<0>Nutrition coaching</0>","m1oeito6liua":"<0>What you never receive:</0> individual results, findings, diagnoses, risk scores, participant lists, lists of people who did not attend, and any analysis from which an individual could be reconstructed.","m1p0kvh57fgl":"Section 8 ASiG (freedom from instructions and duty of confidentiality): <0>https://www.gesetze-im-internet.de/asig/</0>","m1p2cgpi6ovw":"<0>Melanoma screening</0>","m1peewlo2quv":"Further reading: Baden-Württemberg State Commissioner for Data Protection, FAQ zu Rechtsgrundlagen bei Beschäftigtendaten (<0>https://www.baden-wuerttemberg.datenschutz.de/faq-rechtsgrundlagen-bei-beschaeftigtendaten/</0>) and Hessian Commissioner for Data Protection and Freedom of Information, Handreichung April 2023 (<1>https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2023-04/handreichung_beschaeftigtendatenschutz_eugh-urteil.pdf</1>).","m1pk1jobg3g2":"<0>18</0>18. FAQs","m1pwr193r4w0":"7.3 And the independence of the occupational physician's role<0>#</0>","m1q8046swpre":"<0>Confusing the two is a real risk.</0> A works council that reads a screening service as a covert substitute for BEM, or an employer that tries to steer BEM cases through a health day, creates a serious legal problem and a trust problem.","m1qoycexh813":"<0><1>17</1>17. Two statements we do not make</0>","m1qqjuailebj":"<0>How enforcement works, and it is counter-intuitive:</0>","m1r643hoenid":"<0>Data security</0>","m1r6841q29gt":"What is <0>not</0> permissible: using the results of a voluntary screening as a data source for a risk assessment unless this is made transparent, set out in the works agreement and covered by the minimum group size. Once results are fed back by workplace, the co-determination position changes too (section 11).","m1rj2fsg9q2u":"'Health data is prohibited in principle under Art. 9(1) GDPR. We do not base medical processing on consent, which is notoriously open to challenge in the employment relationship, but on <0>Art. 9(2)(h) in conjunction with Art. 9(3) GDPR</0>: processing for the purpose of preventive care by medical personnel under professional secrecy.'","m1saf5jhefxw":"Section 22 BDSG (special categories, list of measures in subsection (2)): <0>https://www.gesetze-im-internet.de/bdsg_2018/__22.html</0>","m1sbi9bhdmcs":"<0/>Well evidenced","m1t3h4wh2387":"<0>There is no data processing agreement for the medical level, and that is deliberate.</0>","m1tathzbg4er":"GKV-Spitzenverband: <0>Leitfaden Prävention</0>, version of 17 December 2025, in particular on the requirements for digital services: <1>https://www.gkv-spitzenverband.de/media/dokumente/krankenversicherung_1/praevention__selbsthilfe__beratung/praevention/praevention_leitfaden/20251218_Leitfaden_Pravention_2025_barrierefrei.pdf</1>","m1touqqtet8k":"<0>Deletion plan</0>, separated by purpose","m1u2ec0m1a1b":"<0/>Disputed<1>Each of these elements needs legal review case by case, in particular against Sections 7 to 11 GenDG.</1>","m1ugfbp2oaoi":"<0>Germany</0>","m1ujt5s4flys":"<0/>Disputed<1>Ruling well evidenced, scope disputed</1>","m1uoul5j9qca":"<0>No. 1:</0> 'Matters relating to the operation of the establishment and the conduct of employees in the establishment'","m1usd1lbs8te":"On <0>30 March 2023</0> the Court of Justice of the European Union held in Case <1>C-34/21</1> that a national provision which merely repeats the general requirements of the GDPR is not a 'more specific provision' within the meaning of Art. 88(1) GDPR and must therefore be disapplied. The decision concerned <2>Section 23(1) sentence 1 of the Hessian Data Protection and Freedom of Information Act</2>.","m1utngazeq7x":"<0><1>8</1>8. The boundary: occupational health checks versus voluntary screening</0>","m1uwtpjf1nbp":"Paragraph 2 permits disclosure where the duty of confidentiality has been waived or to protect a legal interest of higher rank. Paragraph 3 permits access by employees and trainees, requires that they be instructed on the statutory duty, and prescribes that this be <0>recorded in writing</0>.","m1uxo2mqg4gp":"<0>Record of processing activities</0>, even as a small business","m1uys7dr1akv":"7.1 The criminal provision<0>#</0>","m1v2qz2bt9yg":"<0>And the documents you need to produce yourself:</0> works agreement, your own record of processing activities (even with fewer than 250 employees, see Section 3), a data protection impact assessment where applicable, appointment of the data protection officer, and your own deletion plan.","m1v3icn1v6qx":"<0>2</0>2. The short answer for employees","m1vxh4kusonl":"Section 612a BGB (prohibition of victimisation): <0>https://www.gesetze-im-internet.de/bgb/__612a.html</0>","m1w5q3q7mqen":"14.1 The conflict over deletion, explained openly<0>#</0>","m1wcpu2041jb":"<0>Logging</0> of entry, alteration and deletion","m1we5qdxg7ez":"<0>This is the most useful section of the page for an HR buyer, because German law spells out the answer in a single sentence.</0>","m1wfldy0fqo8":"Art. 30 GDPR. <0>The exemption for businesses with fewer than 250 employees does not apply where special categories under Art. 9 are processed.</0> A corporate health management programme therefore brings even a small employer within scope","m1wlv2qum0i2":"<0>Why this appears here even though we do not offer BEM:</0>","m1wozv66kqmk":"<0>The comparison:</0>","m1wrbkvk6rf1":"<0>10</0>10. BEM is something different","m1wzntmcy9if":"<0>0 of 12 questions answered.</0>","m1xtadap1hcg":"<0>Eye screening</0>","m1xv00okf17x":"<0>Does my employer find out whether I took part?</0><1/>No. Registration does not go through the HR department but through us or through your occupational physician. Your employer receives only summarised figures, for example how many appointments were booked at a site. There are no lists of names, and there are no lists of people who did not attend.","m1xvw6t1nnpp":"<0>What you receive:</0> an aggregated report above an agreed minimum group size, process metrics such as reach and slot utilisation, and the documentation you need for the payroll account and for funding from the statutory health insurance fund.","m1y0ry13luy2":"<0>Read the verbs.</0> Employers are forbidden not only to <1>demand</1> genetic results but also to <2>accept or use them</2>. Employee consent changes nothing.","m1y3qjn87hnw":"<0>7</0>7. Medical confidentiality: Section 203 StGB and the professional code of conduct","m1y77t4skeg":"<0>The employer receives no individual health data.</0>","m1ygsqihub09":"5.5 The Employee Data Act (Beschäftigtendatengesetz)<0>#</0>","m1ykkhzw694a":"What actually applies: <0>Art. 9 GDPR</0> and the principle of data minimisation give rise to a <1>duty to anonymise</1>. The operational test is the <2>risk of re-identification through combined characteristics</2>, not a fixed number. An analysis by location, age group, gender and health topic can make a person identifiable even at n = 30.","m1yu9m0xfhy2":"<0>Even for occupational health checks required by law, your employer learns only that an appointment took place, when, and for what reason.</0> That is what Section 6(3) no. 3 ArbMedVV provides. <1>With our voluntary screening, it does not even learn that.</1>","m1z1tvlbt8vq":"<0>It is the sharpest available contrast.</0> BEM is triggered by the employer, is name-based, is documented in the HR process and, in addition to consent to the procedure, needs its own <1>data protection consent under Art. 9(2)(a) GDPR</1>. A voluntary screening is none of those things.","m1z4m4vsv961":"In addition to Part 5, the general GenDG regime applies to every genetic examination for medical purposes: the <0>reservation to physicians</0> (a diagnostic genetic examination may be carried out only by a physician, a predictive one only by a specialist in human genetics or an appropriately qualified physician), the requirement of <1>informed written consent</1> and the duty to provide <2>genetic counselling</2> for predictive examinations.","m1z4yqvjr62m":"<0>Epigenetic coaching</0>","m1zmfwq1netx":"<0>Section 26(2) BDSG</0> requires that, when assessing whether consent was given voluntarily, particular account be taken of the <1>dependence in the employment relationship</1> and the circumstances in which consent was given. And then comes the sentence the market rarely quotes: voluntariness may <2>exist in particular</2> where the employee gains a <3>legal or economic advantage</3> or where employer and employee pursue the <4>same interests</4>. Consent must as a rule be given <5>in writing or electronically</5>, and the employer must inform the employee of the purpose and of the <6>right to withdraw</6>.<7/><8>https://www.gesetze-im-internet.de/bdsg_2018/__26.html</8>","m1zmzhc9ai5b":"<0>The examining doctor</0>, under professional secrecy","m1zp8drao9w1":"<0>6</0>6. Section 22 BDSG: the German opening clause and our list of measures","m1zvwgwcozcb":"<0>European law</0>","m2172u9whoxx":"<0>Supervisory authorities</0>","m21bc6xojp1z":"<0>4</0>4. Art. 9 GDPR: health data is prohibited unless","m21cmac6j8e2":"<0><1>12</1>12. Genetic data: the Genetic Diagnostics Act</0>","m21k72mwzlxb":"<0>The business case for corporate health management</0>","m21q7uhv192s":"<0/>Well evidenced<1>as a negative finding</1>","m21yzzrxdg5x":"<0><1>2</1>2. The short answer for employees</0>","m221x6atpf2r":"<0>14</0>What we do structurally<1>#</1>","m2224ddynjw5":"<0>Section 5(3) no. 6 ArbSchG</0> expressly names 'mental stress at work'. <1>Section 6 ArbSchG</1> requires documentation.<2/><3>https://www.gesetze-im-internet.de/arbschg/__5.html</3>","m222byo2ta95":"<0>Section 3(3) ArbMedVV:</0> Occupational health checks should not be carried out together with examinations that serve to establish fitness for work, unless operational reasons require it; in that case the doctor must make the different purposes clear. <1>Operational consequence for us:</1> a voluntary screening is kept visibly and organisationally separate from every fitness-for-work examination, and where possible from mandatory check appointments too. Same day, same room is a compliance risk and a trust risk.","m22buam9pf7k":"We do not resolve this by concealing one of the two obligations. We use a <0>tiered deletion plan</0> instead: the organisational data collected to run the programme is deleted once the measure ends. Medical documentation is subject to the physician's retention duty and stays within the medical sphere, out of the employer's reach. The specific periods and their legal basis will be agreed before the project starts and documented in the project's data protection notice.","m22wf8oyh72u":"<0>Appoint a data protection officer</0>","m22xwoovy9ij":"<0>only that, when and for what reason</0> (Section 6(3) no. 3)","m23eikd8j3pw":"<0>Reports only at or above the agreed minimum group size, no cross-tabulations that allow reconstruction, anonymisation that can be demonstrated to the works council.</0>","m24jiqio7ltb":"<0>Has a data protection officer been appointed?</0><1>Art. 37 GDPR, Section 38 BDSG</1>","m24yctzx28jg":"<0><1>18</1>18. FAQs</0>","m253tpgzlugl":"<0>And at the medical level there is deliberately no data processing agreement with the employer.</0> Such an agreement would imply that the employer has the power to give instructions over medical data, and that is exactly what must not exist. A reasoned finding that no processor relationship exists is a stronger position than a carefully worded contract about something that must not exist.","m25765elgqmc":"<0>3</0>3. The short answer for employers","m25jto9hgz11":"<0>10</0>BEM is something different<1>#</1>","m26u31852cv6":"Art. 5(1)(e), Art. 17 GDPR. <0>Subject to one limitation, which we set out openly below</0>","m270zmtt0h8d":"State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, FAQ on legal bases for employee data: <0>https://www.baden-wuerttemberg.datenschutz.de/faq-rechtsgrundlagen-bei-beschaeftigtendaten/</0>","m27lxh29u6k8":"<0>Section 22 GenDG</0> extends the part to public-law service relationships.","m28is3ragg32":"<0>11</0>Co-determination: why your works council has a say, even when participation is voluntary<1>#</1>","m28tr6dplaax":"<0>7</0>Medical confidentiality: Section 203 StGB and the professional code of conduct<1>#</1>","m29328o4ksk3":"<0>BEM_SCOPE</0> <1>We state explicitly whether we offer any BEM services.</1> If not, this page says so in one sentence.","m299lyci1nx5":"<0><1>11</1>11. Co-determination: why your works council has a say even though participation is voluntary</0>","m29f7f0nfd64":"<0>Works agreement</0>","m29m8n0s6sad":"<0>No. 7:</0> 'Regulations on the prevention of industrial accidents and occupational diseases and on the protection of health within the framework of statutory provisions or accident prevention regulations'","m2a8osg5n92f":"<0>Does my employer see my results?</0><1/>No. Your employer receives no results, no findings, no risk scores and no names from us.","m2aegomoyu6q":"<0>And if I, as an employee, consent myself?</0><1/>Your results belong to you, and you can of course pass them on yourself. We do not. The difference matters: in an employment relationship, consent given to one's own employer is structurally open to challenge as not freely given, so we build our architecture to stop this question arising in the first place.","m2aqzohqncj":"<0>Consent does not disappear as a result</0>, but it gets its proper role: it legitimises <1>participation</1> and everything that goes beyond the core medical processing, and it safeguards voluntariness. It does not carry the whole burden of lawfulness on its own.","m2arx6wg71d0":"<0>8</0>The boundary: occupational health checks versus voluntary screening<1>#</1>","m2avamtyusrd":"<0>Data protection impact assessment</0>","m2b7ox1kioe6":"<0>Under Art. 9(1) GDPR, health data is prohibited in principle.</0> We start from the prohibition, not from consent.","m2bi32pekmp":"<0>All screenings</0>","m2bpm8gxm34m":"Art. 35 GDPR. Whether it is mandatory here depends on your supervisory authority's list of processing that requires one under Art. 35(4). <0>Our recommendation: carry one out anyway.</0> Large-scale processing of Art. 9 data about employees, that is, about a group in a relationship of dependence, meets at least two of the criteria of the European Data Protection Board","m2bspsnzs8tn":"<0>Have you settled who is the controller for each data category?</0>","m2c7opjy15zy":"<0>Input to your data protection impact assessment</0>, as far as we can provide it","m2c9y0cgy1q2":"<0>15</0>Our documents<1>#</1>","m2chs8dveg50":"<0>Pharmacogenetics</0>","m2ckqdo0g80u":"<0>What does my employer get, then?</0><1/>A summarised report on the group, and only if the group is large enough that nobody can be identified from it. The minimum group size is agreed in the contract before the project starts, see section 13.","m2ct6plm147w":"<0>Anonymised sample report</0> with the documented minimum group size","m2cu1zx1bsdm":"Art. 5, 6, 7, 9, 13, 17, 26, 28, 30, 32, 35, 37, 88 GDPR: <0>https://dsgvo-gesetz.de/</0>","m2d3xks1oe2f":"<0><1>19</1>19. Sources</0>","m2d4falob7pk":"<0>Our non-medical staff are also bound to confidentiality, formally and on record.</0>","m2d9d9dmpgtx":"<0>Record of processing activities</0> for our own area of responsibility","m2da6fxz1lqn":"<0>We do not base medical processing on Section 26 BDSG</0>, because, following the judgment of the Court of Justice of the European Union of 30 March 2023 (C-34/21), paragraph 1 sentence 1 of that provision is regarded in the specialist literature as contrary to EU law. Our architecture does not depend on it.","m2f2bhve813":"<0>16</0>16. Data protection check","m2fa5zd26ojt":"And the counter-intuitive rule: <0>the weaker the statutory requirement, the stronger the co-determination.</0> Sections 3 and 5 of the Occupational Safety and Health Act (ArbSchG) are framework provisions that need to be filled in. Where the employer has room to decide how, the works council has a say in that decision.","m2fet5b3p7qy":"<0>Does the works council really have to be involved, even though everything is voluntary?</0><1/>Yes, in practically any real-world set-up. As soon as a booking tool is involved, Section 87(1) no. 6 BetrVG applies regardless of whether participation is voluntary.","m2fjvgbf79fq":"<0>The risk assessment assesses workplaces, not people.</0> Its subject is conditions. It is not an instrument for collecting individual health data and must not be turned into one.","m2g46lj5hmfp":"<0>Is there a works agreement that also governs data processing?</0><1>Section 88 no. 1 BetrVG, Art. 88(1) GDPR</1>","m2g70briy0su":"<0>Section 203(4) StGB</0> is the paragraph that matters most for a provider: it extends criminal liability to <1>persons who contribute to the work</1>, and additionally makes the holder of professional secrecy liable if they fail to ensure that these persons are bound to secrecy.","m2g8b4fpoi5y":"<0/><1>Yes</1>","m2ge7l5aav9f":"Section 87, Section 77(6), Section 80, Section 88 no. 1 BetrVG: <0>https://www.gesetze-im-internet.de/betrvg/__87.html</0> · <1>https://www.gesetze-im-internet.de/betrvg/</1>","m2ghhde7wuof":"<0>Are the provider's non-medical staff demonstrably bound to confidentiality?</0><1>Section 203(4) StGB</1>","m2gjynkfy3z5":"<0>Corporate health management in figures: Switzerland 2026</0>","m2gmy53qskkb":"<0>The provision that matters most to us.</0> A screening carried out by a doctor is preventive care","m2xcp36cmji":"<0>Section 20</0> (genetic testing as part of occupational health checks)","m33vmk3mii7":"<0>In the public sector</0>, the Federal Staff Representation Act (BPersVG) and the sixteen state staff representation acts apply. Section 80 BPersVG (2021) lists health management and reintegration management among the matters subject to co-determination. The state laws differ; check the law that applies to you.","m3hmmvxmfsh":"<0>Section 21</0> (prohibition of discrimination)","m3mf0e59pvy":"<0>Pseudonymisation and encryption</0>","m41hij7cy2y":"<0>13</0>13. Aggregated reporting and the minimum group size","m4rn2ha30op":"5.2 Recital 43, read correctly<0>#</0>","m5agl40a73e":"<0/><1>No</1>","m5bz6ufbfpj":"<0>9</0>The risk assessment: what happens to this data<1>#</1>","m5ugbqgabqw":"<0>The point most often overlooked in corporate health management:</0> under the Federal Labour Court's settled case law, what matters under no. 6 is <1>not whether the employer intends to monitor</1>, but whether the technical system is <2>objectively capable</2> of collecting and recording information on behaviour or performance. <3>A sign-up portal that records who has booked an appointment is therefore subject to co-determination, even if participation is entirely voluntary and nobody intends to monitor anyone.</3>","m69h08ozh07":"<0>Can you rule out registration going through the HR department?</0>","m6cq07fuk3e":"<0>18</0>FAQs<1>#</1>","m6frqg4nxit":"<0>Menu</0><1><2/></1>","m6i9kqs8hb6":"<0>Who sees my results?</0><1/>The examining doctor, and the medical assistants where this is necessary to carry out the examination. All of these people are bound by confidentiality, and breaching that duty is a criminal offence in Germany.","m6lh4rhbazt":"<0>The storage location and the service providers we use are disclosed.</0>","m6sgj3wlsrj":"<0>20</0>Disclaimer","m71byzkdweq":"<0>Processing is prohibited unless an exception in paragraph 2 applies.</0> The question is therefore not 'do we have consent' but 'which exception do we rely on, and why does it hold'.","m79zrx7cxoy":"Because <0>Section 26(1) sentence 1 BDSG</0> is almost identical in wording, the prevailing view in German practice and among several supervisory authorities is that Section 26(1) sentence 1 BDSG cannot serve as a legal basis either, and that processing must be based directly on Art. 6 and Art. 9 GDPR.","m7q0kh4dtp8":"<0>Health Prime AG</0><1>Samstagernstrasse 55</1><2>8832 Wollerau</2><3>info@health-prime.ch</3><4>+41 44 250 28 71</4><5>WhatsApp Chat</5>","m7s3c6mnozd":"<0>Data protection in corporate health management</0>","m7wuzgec9aw":"<0>Art. 7 GDPR</0> provides for: the controller's duty to demonstrate consent (para. 1); that the request must be made 'in an intelligible and easily accessible form, using clear and plain language' and be clearly distinguishable from other matters (para. 2); that 'the data subject shall have the right to <1>withdraw his or her consent at any time</1>' and that withdrawal must be '<2>as easy to withdraw as to give consent</2>' (para. 3); and the prohibition on bundling consent (para. 4).<3/><4>https://dsgvo-gesetz.de/art-7-dsgvo/</4>","m8bvwhmszyo":"<0>Is withdrawal as easy to make as consent?</0><1>Art. 7(3) GDPR</1>","m8hasa3109i":"<0>'The works council does not need to be involved because participation is voluntary.'</0><1/>This claim circulates in the German market and is wrong often enough to be dangerous. It is the most common reason a rollout in Germany fails.","m8lwpmairz2":"Sections 5 and 6 ArbSchG: <0>https://www.gesetze-im-internet.de/arbschg/__5.html</0> · <1>https://www.gesetze-im-internet.de/arbschg/__6.html</1>","m8r53qmhgec":"<0>Specialist literature and practice</0>","m8rd746vkeg":"<0><1>7</1>7. Medical confidentiality: Section 203 StGB and the professional code of conduct</0>","m8ze3ny9q18":"<0/>Well evidenced<1>for the legal texts, disputed as to scope</1>","m983i9p175f":"<0>Consent can be withdrawn at any time, in one step, and not through the HR department.</0>","m9bbr0tl6yd":"<0><1>3</1>3. The short answer for employers</0>","m9bj99vqyer":"<0>Read that carefully.</0> Even for occupational medicine that is <1>required by law and initiated by the employer</1>, the employer learns only <2>that the appointment took place, when and for what reason</2>, and when the next one is due. <3>No result. No findings. No fitness assessment.</3>","m9c34oeqjue":"<0>The employer does not learn who took part.</0>","m9dulnv4ubo":"<0>11</0>11. Co-determination: why your works council has a say even though participation is voluntary","m9g5cpsqvhw":"<0>Terms and conditions</0>","m9xcc916k7r":"<0>Section 203(3) StGB</0> permits disclosure to 'assistants working for them professionally' and to persons in training, where necessary.","ma6iaguzmea":"Two obligations pull in different directions. <0>Data minimisation and the duty to delete</0> under Art. 5(1)(e) and Art. 17 GDPR require us not to keep data longer than necessary. <1>The physician's duty to document</1> requires the opposite: treatment records must be kept for years.","maa2r2sru2h":"A draft bill from the Federal Ministry of Labour and Social Affairs and the Federal Ministry of the Interior dated <0>8 October 2024</0> was meant to replace Section 26 BDSG with a law of its own. <1>No Employee Data Act is in force.</1> We do not write this page as if there were one, and we date it. The fact that the legal basis for processing employee data is in flux is itself an argument for an architecture built on Art. 9(2)(h).","mb4ps0nqzxv":"Section 203 StGB (breach of private secrets, in particular subsections (3) and (4)): <0>https://www.gesetze-im-internet.de/stgb/__203.html</0>","mb85hkx5wzp":"Recital 43 GDPR: <0>https://dsgvo-gesetz.de/erwaegungsgruende/nr-43/</0>","mba4j363jhp":"<0>Four statements this page supports:</0>","mbad1rm96p6":"<0>Is a minimum group size for reports agreed by contract?</0>","mbm97v798cq":"Section 38 BDSG (data protection officers of non-public bodies): <0>https://www.gesetze-im-internet.de/bdsg_2018/__38.html</0>","mbnv2dh4bjp":"<0>Section 88 no. 1 BetrVG</0> expressly provides for <1>voluntary</1> works agreements on 'measures to prevent occupational accidents and damage to health'. This works agreement is also the <2>collective agreement within the meaning of Art. 88(1) GDPR</2>, and therefore a core element of the data protection architecture. Note <3>Section 77(6) BetrVG</3>: by law, an agreement continues to apply after expiry only for its mandatory parts; for the voluntary parts, this must be expressly agreed.","mbterj0zu2k":"Kiesche, E.: <0>Betriebliches Gesundheitsmanagement. Betriebs- und Dienstvereinbarungen. Analyse und Handlungsempfehlungen</0>, Hans-Böckler-Stiftung und Bund-Verlag, Frankfurt am Main 2013, ISBN 978-3-7663-6274-2. 125 agreements analysed; the analysis predates the GDPR","mbuy21deg52":"<0>Section 203(1) StGB</0> makes the unauthorised disclosure of another person's secret a criminal offence where it was entrusted to, or otherwise became known to, a 'doctor, dentist, veterinary surgeon, pharmacist or member of another healthcare profession that requires state-regulated training for the exercise of the profession or the use of the professional title', in that capacity. The penalty is up to <1>one year's imprisonment or a fine</1>, and in aggravated cases (for payment, or with intent to enrich oneself or to harm another) up to <2>two years</2>.<3/><4>https://www.gesetze-im-internet.de/stgb/__203.html</4>","mbynbtyf8l9":"5.3 Art. 7 GDPR and a verifiable commitment<0>#</0>","mc4t5w78ni8":"<0>14</0>14. What we do structurally","mcenatdw8gr":"<0>And an important clarification:</0> a voluntary commercial screening <1>is not an occupational health check</1> and must never be presented as a substitute for one. It complements it.","md0l4h8d9i0":"<0>Health Prime AG</0><1>Samstagernstrasse 55</1><2>8832 Wollerau, Switzerland</2><3>Phone +41 44 250 28 71</3><4>info@health-prime.ch</4>","md9auo4aqzk":"Disclaimer<0>#</0>","mdgj0lfonq6":"<0>New screenings for 2026</0>","me7irrpqvtw":"<0>Is there a deletion plan that separates the physician's duty to document from data minimisation?</0>","megmj7pwxwd":"<0>Do you have a record of processing activities for the health programme?</0><1>Art. 30 GDPR, without the exemption for companies with fewer than 250 employees</1>","mejm470by8s":"<0>We label this expressly as a contractual commitment, not a statutory minimum.</0> A provider who says 'the law names no figure, so we name one and bind ourselves to it' can be checked. A provider who invents a statutory obligation cannot be.","mep8foxiii":"<0>A precision warning we impose on ourselves:</0> Recital 43 gives a <1>public authority</1> as its example, not an employer. Anyone who cites it as if it said 'consent in the employment relationship is invalid' overstates it. The correct chain is this: Recital 43 (clear imbalance) leads to Section 26(2) BDSG (dependence in the employment relationship), and from there to the consistent position of the supervisory authorities that consent in the employment relationship is <2>possible but fragile</2>.","mex5aulrl42":"<0>Where are the data held?</0><1/>The storage location and the service providers used will be agreed before the project starts and documented in the project's data protection notice. This page is not a privacy policy and commits to nothing on this.","mfgdo06mhzn":"<0>2</0>The short answer for employees<1>#</1>","mfhqibm7hdv":"4.3 The consequence for responsibility<0>#</0>","mfpblusx7k1":"<0><1>9</1>9. The risk assessment: what happens to this data</0>","mg63s57cbea":"<0>How do I withdraw my consent?</0><1/>With a message to us, in one step. Withdrawal must be as easy as giving consent; the GDPR requires this. It does <2>not</2> go through your HR department, and you do not have to give a reason. Once you withdraw, we stop processing your data; the processing carried out up to that point remains lawful.","mgocrhvfp7a":"<0>Section 22(2) BDSG</0> requires 'appropriate and specific measures to safeguard the interests of the data subject' and <1>lists them</1>. In effect, this list is a published checklist of what our technical and organisational documentation must contain. We map it one to one:","mh763unoi4x":"<0>Regular review of effectiveness</0>","mhdsjkis8j0":"We explain this legal position because it marks the point at which German law is particularly strict. <0>This page describes no pharmacogenetic service.</0>","mhmegwbulam":"<0>Art. 9(2)(h)</0>","mieb222phnm":"<0>19</0>19. Sources","mj31xrwj71l":"and the data is processed 'by <0>medical personnel or by other persons who are subject to a corresponding duty of confidentiality, or under their responsibility</0>'.<1/><2>https://www.gesetze-im-internet.de/bdsg_2018/__22.html</2>","mjb3ureluu6":"<0>'This is GDPR-compliant.'</0><1/>Compliance belongs to a specific processing operation in a specific company, not to a product. We describe the architecture and explain why it stands up. Your data protection officer makes the assessment, not us.","mjddu600slm":"<0><1>6</1>6. Section 22 BDSG: the German opening clause and our list of measures</0>","mjl74754pym":"<0>https://www.gesetze-im-internet.de/betrvg/__87.html</0>","mk2n5qbb5z1":"<0><1>13</1>13. Aggregated reporting and the minimum group size</0>","mk6x6hwa7st":"A note on the health reports of the health insurance funds, because the point is often confused: the funds, too, apply their own minimum figures before producing a workplace health report. These thresholds differ from fund to fund, are mostly unpublished and are <0>fund practice, not law</0>. And a report drawn from a single fund's data is a non-random subsample of your workforce, skewed by occupational structure, and never 'the company's sickness absence rate'.","mk7vm02s4w0":"<0>Criminal offence</0> under Section 25 GenDG: up to one year's imprisonment or a fine, up to two years if committed for payment or with intent to enrich oneself or cause harm. Usually prosecuted only on complaint. <1>No administrative fine</1>","ml2jwxhz5h3":"<0/>Well evidenced<1>for the statute text</1>","mlb97411ue8":"<0>What your own obligations are:</0>","mlc1uzdzjt7":"<0>1</0>1. The one-sentence commitment","mlh85o55yq9":"<0>13</0>Aggregated reporting and the minimum group size<1>#</1>","mlhhref2ups":"<0>About us</0>","mlp87rk1ykf":"<0>Section 8 ASiG</0> states that occupational physicians and occupational safety specialists are 'not bound by instructions in the application of their expertise', that they must not be disadvantaged for performing their duties, that occupational physicians are '<1>subject only to their medical conscience</1>' and must observe the rules of medical confidentiality.<2/><3>https://www.gesetze-im-internet.de/asig/</3>","mm014rh933s":"<0>No examination against the will of the employee.</0>","mm0gzhht2l5":"<0>This page explains the legal position. It is not legal advice,</0> and it does not replace a review of your individual case by your data protection officer, your legal department or a lawyer. What binds you is the statutory text, to which we link throughout, together with the interpretation of the competent supervisory authority and the courts.","mmf4hdexzce":"<0>1</0>The one-sentence commitment<1>#</1>","mmg8xlnb5oc":"<0>The ruling did not concern Section 26 BDSG directly.</0> Extending it to Section 26 BDSG is the prevailing view, but not the unanimous one. Anyone who presents it otherwise is being imprecise.","mmgtv9g0a5v":"<0>Workshops and seminars</0>","mmjxa6gjxy6":"<0>15</0>15. Our documents","mmxe04236oj":"'The employer may not, either before or after the employment relationship is established,<0/>1. require genetic examinations or analyses to be carried out or<1/>2. require the disclosure of results of genetic examinations or analyses already carried out, or <2>accept or use such results</2>.'<3/><4>https://www.gesetze-im-internet.de/gendg/</4>","mn3i6z6a63o":"<0>German law has no statutory minimum group size for aggregated health reports.</0> We claim nothing else, and we advise you to be wary of any provider that quotes a statutory figure.","mndvz0x2vn6":"<0/>Well evidenced<1>for the statutory texts</1>","mnqaubm8oyh":"Sections 3 and 6 ArbMedVV: <0>https://www.gesetze-im-internet.de/arbmedvv/__3.html</0> · <1>https://www.gesetze-im-internet.de/arbmedvv/__6.html</1>","mnwd36ldpjp":"<0>German law</0>","mnx754e54u":"<0>Section 19</0> (do not demand, do not accept, do not use)","mo521zbl98g":"<0>Section 22(1) no. 1(b) BDSG</0> permits public <1>and non-public</1> bodies to process special categories of data where this is necessary","mon3jv0xqw6":"<0>both Section 25 (criminal law) and Section 26 (administrative fine of up to fifty thousand euros)</0>","motwf0yz691":"'1. to record the result and the findings of the occupational health check in writing and to advise the employee on them,<0/>2. to make the result available to the employee at their request, and<1/>3. to issue the employee and the <2>employer with a certificate confirming that, when and for what reason an occupational health check appointment took place</2>; the certificate also states when a further occupational health check is indicated from a medical point of view.'<3/><4>https://www.gesetze-im-internet.de/arbmedvv/__6.html</4>","mq63qq80d9l":"5.1 What Section 26(2) BDSG says, and it is more favourable to us than often portrayed<0>#</0>","mqawpgwov8v":"<0>Was the works council involved before a booking or reminder tool was introduced?</0><1>Section 87(1) no. 6 BetrVG</1>","mqjmo705zu2":"Section 26 BDSG (processing of employee data, consent, collective agreement): <0>https://www.gesetze-im-internet.de/bdsg_2018/__26.html</0>","mqnh6aeavuq":"<0>The six-week threshold</0> in Section 167(2) SGB IX is the same as the limit on continued payment of wages in Section 3(1) EntgFG. That is the bridge to our page on the business case.","mqulqgrnyor":"<0>5</0>Consent in employment: the problem others do not mention<1>#</1>","mrefixi7n0l":"<0><1>20</1>Disclaimer</0>","mrkpaibzy3a":"<0>Vein screening</0>","mrtrpzzvjms":"<0>Section 87(1) of the Works Constitution Act (BetrVG)</0> begins: 'Where no statutory or collective-agreement provision exists, the works council has a right of co-determination in the following matters'.","mrzoi8ibt48":"<0>Have you settled which exception under Art. 9(2) GDPR you rely on?</0>","msbmiyj7e19":"<0>What if something is found?</0><1/>Then the doctor discusses it with you and, where appropriate, recommends follow-up through standard care. Your employer learns nothing about it.","mseutmk9wj3":"<0>Art. 9(2)(a)</0>","mslmriadisz":"<0>nothing at all</0>, not even participation","mtop1853tkn":"<0>17</0>Two statements we do not make<1>#</1>","mtra2e29wpu":"<0>Section 6(4) ArbMedVV:</0> If the doctor considers the occupational safety measures inadequate, the doctor informs the employer and proposes measures. <1>Where a change of job is necessary solely for reasons relating to the employee personally, this notification to the employer requires the employee's consent.</1>","mtwgntuddmc":"Section 3(1) EntgFG (six-week limit, as a reference to Section 167(2) SGB IX): <0>https://www.gesetze-im-internet.de/entgfg/__3.html</0>","mua3rauoi5j":"<0>What happens if I do not take part?</0><1/>Nothing. Participation is voluntary, and non-participation is not recorded anywhere. The works agreement usually also includes a prohibition of retaliation.","mucggec9lii":"<0>Recital 43 GDPR</0>, verbatim:","mujbev3td4i":"<0>From this we derive a concrete, verifiable commitment:</0> with us, withdrawal is one step, via an address printed on the participant information sheet. <1>It does not go through a form in the HR department.</1> That can be checked, which is why it is stated here.","musmrbvwv2y":"<0>That is precisely why our architecture does not depend on it.</0> The medical level rests on Art. 9(2)(h) in conjunction with para. 3 GDPR, the organisational level on the works agreement as a collective agreement under Art. 88(1) GDPR. Whether Section 26(1) BDSG remains applicable changes nothing about that.","mutjdsrzc7w":"<0><1>4</1>4. Art. 9 GDPR: health data is prohibited unless</0>","muwlapiyej":"<0>The strongest sentence on this page:</0><1/>'Even for occupational health checks required by law, under Section 6(3) no. 3 ArbMedVV your employer may learn only <2>that an appointment took place, when and for what reason</2>, no result and no findings. With our voluntary screening, it does not even learn that.'","mv2hhoant3n":"<0>6</0>Section 22 BDSG: the German opening clause and our list of measures<1>#</1>","mweqszkaqhe":"Hessian Commissioner for Data Protection and Freedom of Information, guidance on the CJEU judgment, April 2023: <0>https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2023-04/handreichung_beschaeftigtendatenschutz_eugh-urteil.pdf</0>","mwkk3b2m54e":"<0>Does my employer really get nothing at all?</0><1/>It receives an aggregated report above the agreed minimum group size, plus process metrics on utilisation. It receives no names, no results and no participation information on individuals.","mwr1qly2g3t":"<0>carries neither criminal nor administrative penalties.</0> Enforced through employment-law and civil-law claims","mwtbnhfjbma":"<0>Contact</0><1><2/></1>","mx2dv5ucfe0":"'necessary for the purposes of <0>preventive or occupational medicine</0>, for the <1>assessment of the working capacity</1> of the employee, for medical diagnosis, the provision of health or social care or treatment'","mxbr0fgrkpb":"<0>Data protection concept</0> with the allocation of responsibilities under Section 4.3","mxi8napwp68":"7.2 The professional code of conduct<0>#</0>","mxikjjcp0vb":"<0>Thyroid ultrasound</0>","mxmi1sf2r3h":"The hinge. Point (h) holds only because the processing takes place <0>within medical confidentiality</0>","mxmq4rdak22":"<0>Art. 9(1) GDPR</0>, verbatim:","mxrcsmkvs5v":"'Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning <0>health</0> or data concerning a natural person's sex life or sexual orientation shall be <1>prohibited</1>.'<2/><3>https://dsgvo-gesetz.de/art-9-dsgvo/</3>","mysjd2dhun0":"<0>Documentation of technical and organisational measures (TOM)</0>, structured as a one-to-one mapping of the list in Section 22(2) BDSG","mz053n6gojz":"<0>12</0>12. Genetic data: the Genetic Diagnostics Act","mzar7l7ob4k":"<0><1>14</1>14. What we do structurally</0>","mzbmeonv6k2":"The route for <0>mandatory</0> occupational medicine (mandatory occupational health check under ArbMedVV) and for occupational safety obligations. <1>It is not available for voluntary screening</1>","mzl9hb8tu99":"5.4 Why we do not rely on Section 26(1) BDSG<0>#</0>","mznqaa85ypt":"<0>Purpose limitation; it can be lifted only with the agreement of the works council and the consent of the person concerned.</0>","mzq2qj738lb":"<0>Participant information</0> under Art. 13 GDPR, in plain language, with instructions on how to withdraw","t1fzvydj1vxj":"+{0} {1} {2} {3} {4}","t1mvkpnkfpta":"Section {0}({1}) StGB","t1wdiqgxsm2l":"Art. {0}({1}) GDPR","t29tealerxyy":"{0}","tl5tand5qy6":"Section {0}({1}) ArbMedVV"}}