Data protection in your care

1. Controller

Zentrum für klinische Forschung (“ZfKF”)
Berliner Straße 895, 51069 Köln-Dünnwald
Phone: (0221) 29 72 81 3 · E-mail:

Please address questions about data protection to our contact Ms P. Meusel: . We are not under a statutory obligation to appoint a data protection officer.

2. For what purposes do we process your data?

• Treatment and diagnostics: patient admission, medical history, diagnostics, treatment planning and delivery, physician letters and follow-up care.
• Billing and administration: billing with health insurers and private billing agencies, service accounting, cost-coverage enquiries.
• Statutory duties: reporting and documentation duties (e.g. under the Infection Protection Act), handling of Medical Review Board procedures.
• Research (only with your separate consent): checking the suitability of your data for scientific purposes (see section 7).

3. On what legal basis?

Processing is based on the treatment contract (Art. 6(1)(b) GDPR, § 630a BGB), statutory obligations (Art. 6(1)(c) GDPR), the protection of vital interests (Art. 6(1)(d) GDPR) and — for health data — on Art. 9(2)(h) GDPR in conjunction with § 22(1) no. 1(b) BDSG. For research purposes, only your voluntary consent applies (Art. 6(1)(a), Art. 9(2)(a) GDPR).

4. Who receives your data? (full list of recipients)

Your data is only shared where this is permitted or required by law or where you have consented. Recipients or categories of recipients may be:

Co-treating and referring physicians and psychotherapists

Referrals, physician letters and transmission of findings for co- and follow-up treatment.

Laboratories and pathology

Analysis of samples and preparation of medical findings.

Hospitals and clinics

Admission, inpatient co-treatment and follow-up care.

Statutory health insurers (GKV)

Billing of services rendered, cost-coverage enquiries and the statutory exchange of data.

Private health insurers and private medical billing agencies (PVS)

Billing of private medical services and individual health services (IGeL).

Association of Statutory Health Insurance Physicians North Rhine (KV)

Billing and auditing of panel-physician services.

Medical Review Board (MD)

Assessment within the statutory framework.

Employers’ liability insurers and accident insurance institutions

For occupational and commuting accidents and within the trauma-consultant (D-Arzt) procedure.

Public health service / public health office

Fulfilment of statutory reporting and notification duties (e.g. under the Infection Protection Act).

Courts, public prosecutors and authorities

Only where a statutory obligation or authorisation exists.

IT and telematics service providers (processing under Art. 28 GDPR)

Practice management system, telematics infrastructure (gematik/TI), data backup, archiving and IT maintenance — contractually bound to act on our instructions.

Tax advisors

Exclusively billing- and accounting-relevant data.

Certified provider for research-data analysis

Only with your separate consent and exclusively using pseudonymised data (see “Use of data for research”).

Transfer to countries outside the EU/EEA (third countries) does not take place.

5. How long do we store your data? (retention periods)

We store your data for as long as it is necessary for your treatment and statutory retention obligations exist. The longest applicable period always governs:

Different statutory periods may apply to individual documents. After the respective period expires, your data is deleted or destroyed in a data protection-compliant manner.

6. Your rights

At any time you have the right to:

• information about the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to the processing (Art. 21 GDPR)
• withdraw consent given, with effect for the future

Please note that statutory documentation and retention obligations (see section 5) may preclude erasure.

7. Consent to the use of data for research

We work together with other medical practices in a research network. With your separate consent, we first have your patient data analysed automatically for its general suitability for medical research. The analysis is carried out by a certified service provider that acts exclusively on our instructions (processing on our behalf) and uses pseudonymised data — your name and direct contact details are replaced by a code, so that the provider itself cannot draw any conclusions about your identity. If your data is found to be suitable, it is added to a data pool in pseudonymised form.

The printed consent form comprises three separately selectable modules that you may grant or decline independently of one another:

BConsent to data analysis

Your patient data is analysed automatically for its general suitability for medical research and, if suitable, added to a data pool in pseudonymised form.

CContact regarding research projects / studies

You may consent to the ZfKF contacting you about specific research projects or studies for which your data could serve as a data basis.

DContact regarding incidental medical findings

You may consent to the ZfKF contacting you about incidental medical findings identified during the data analysis that could be of significant importance to you personally.

This is not consent to participate in a study — such consent would always be obtained in a separate conversation with a separate consent form. You can view which studies are currently being conducted with patient data at any time at the Medical Informatics Initiative.

Your consent is voluntary and applies until withdrawn. You can withdraw it at any time, without giving reasons and without disadvantage, in whole or in part — e.g. at . A withdrawal only affects the future use of your data; analyses already completed remain unaffected.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia — LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, phone: +49 211 38424-0.

Version of this patient data protection information: July 2026.