Privacy Policy

Last updated: 6 October 2026

Handling personal data responsibly is, for us, a central element of trustworthy collaboration. In this Privacy Policy, we provide transparent information about which personal data we process in connection with our websites and our Online Platform, for what purposes this is done, on what legal basis the processing takes place and what rights data subjects have.

This Privacy Policy applies to our websites and the Online Platform (reimbursement.institute, reimbursement.info, app.reimbursement.info). Our offering is expressly and exclusively directed at commercial, institutional and freelance customers (B2B). The conclusion of contracts with consumers is excluded. However, as our websites are publicly accessible, this Policy informs all visitors (unregistered Visitors), registered Users acting on behalf of Organisations and affected healthcare professionals about the data processing.

 

I. General Information and Controller

1. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

RI Innovation GmbH
Managing Director: Nicole Eisenmenger
Lehnengasse 20a, 50354 Hürth – Germany
Tel.: +49 (0) 2233 805 77 97
Email: info@reimbursement.institute

Website: https://reimbursement.institute
Cologne Local Court (Amtsgericht Köln), HRB 97427 | VAT ID: DE 815 815 580

Contact Details of the Data Protection Officer:
Data Protection Officer: Georg Leciejewski
Email: datenschutz@reimbursement.institute

 

II. Nature, Scope and Purposes of Data Processing

2. Data Processing When Accessing the Website (Server Log Files)

Each time our website or the Online Platform is accessed, our system automatically collects general data and information, which are stored in the server’s log files:

  • Browser types and versions used, as well as the operating system of the accessing system
  • The website from which an accessing system reaches our site (referrer)
  • The sub-pages accessed, and the date and time of access
  • The Internet Protocol address (IP address) and the internet service provider of the user

The processing is carried out to deliver the content correctly, to optimise the systems, to ensure their continued functionality and to avert threats in the event of cyberattacks. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. The server log files are stored separately from other personal data and are evaluated only for the aforementioned purposes.

Infrastructure and hosting:
Our websites and the Online Platform are hosted on the servers of a specialised cloud infrastructure service provider. For this purpose, we use the services of Hetzner Online GmbH. The server location is Germany. No processing or storage of data outside the European Union takes place in the context of hosting. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the hosting service provider.

3. Cookies, Similar Technologies and External Services

Our websites and the Online Platform use cookies, similar technologies and external services. Below you will find a summary overview of the systems we use:

a) Technically necessary platform infrastructure
We use technically necessary cookies and similar technologies that are required for the operation, security, login, session management and provision of expressly requested functions. These include in particular session, login and security cookies. The storage of this information and access to the terminal device are based on § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The subsequent processing of personal data is based on Art. 6(1)(b) GDPR insofar as it is necessary for the provision of the platform or the performance of the user relationship, and otherwise on Art. 6(1)(f) GDPR.

b) Cookie consent tool
We use a cookie consent tool in which we store your choices regarding cookies and similar technologies that require consent. This serves to document your consents, refusals or withdrawals and to take them into account when you visit our website or Online Platform again. The legal basis for the use of the cookie consent tool is § 25(2) TDDDG as well as Art. 6(1)(c) GDPR (compliance with a legal obligation to obtain and document consents) and Art. 6(1)(f) GDPR. Our legitimate interest lies in the user-friendly implementation and legally compliant demonstration of these statutory requirements.

c) Google Analytics (audience measurement and usage analysis)
We have integrated components of Google Analytics on this website. Google Analytics is a web analytics service for the collection, gathering and evaluation of data on the behaviour of visitors. The operating company is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only activated if you have previously given your active consent via our cookie consent tool. The storage of analytics cookies and access to comparable information on your terminal device are based on your consent pursuant to § 25(1) TDDDG. The subsequent processing of personal data is based on Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the settings of our cookie consent tool. In addition, you can object to the collection of data by Google Analytics by installing a browser add-on available at https://tools.google.com/dlpage/gaoptout. According to Google, Google Analytics does not log or store individual IP addresses of users from the EU. IP addresses are discarded before logging and used only to derive approximate location data.

d) Online chat via Olark (support)
For the online chat and the handling of support requests (Support Communication within the meaning of the Terms of Use), we use the Olark service of Habla, Inc. d/b/a Olark, 2810 N Church St., #63602, Wilmington, DE 19802, USA. When using the chat, in particular name, email address, organisation, chat history and technical usage data (e.g. IP address) may be processed. Insofar as Olark uses technically necessary cookies or similar technologies to provide the chat, their use is based on § 25(2) TDDDG. Insofar as cookies or similar technologies that are not technically necessary are used in addition, they are used only on the basis of your consent pursuant to § 25(1) TDDDG. The subsequent processing of personal data is based, depending on the purpose, on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. Our legitimate interest lies in efficient support and the user-friendly provision of our Online Platform.

e) Platform-internal AI assistance function (in preparation)A platform-internal AI assistance function is in preparation and is currently not available. Before it is activated, we will supplement this Privacy Policy with a description of the processing. This is to be distinguished from AI assistants that Users choose themselves and connect via interfaces; we do not operate these (Section 7a).

f) Common data protection information for the external services:

Insofar as external service providers process personal data on our behalf, this is done on the basis of corresponding data processing agreements pursuant to Art. 28 GDPR.

Insofar as processing of personal data by external service providers outside the European Union or the European Economic Area (in particular in the USA) cannot be ruled out, such processing takes place only in accordance with Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision of the European Commission or appropriate safeguards such as the EU Standard Contractual Clauses.

For Separately Processed Data from the separate import module, the special provisions of the Terms of Use and the respective DPA additionally apply. Patient data, health data and other special categories of personal data must not be introduced into the Online Platform via chat, free-text fields or other communication tools, but exclusively via the import module provided for this purpose.

4. Data Security and Transport Encryption

In order to adequately protect the security of your data during transmission over the internet, the Provider uses state-of-the-art encryption methods on the URLs of the website and the Online Platform, in particular TLS/SSL via HTTPS. You can recognise such an encrypted transmission by the prefix “https://” in the address bar of your browser and by the closed padlock symbol.

5. Contact, Support, Contract Administration and Billing

If you contact us by email, telephone, contact form, support chat or by any other means, we process the personal data you provide in order to handle and respond to your enquiry.

If a Customer within the meaning of the GTC or an Organisation within the meaning of the Terms of Use commissions a paid Premium Version, consulting services or other paid services, we process the contract, contact, invoicing and payment data required for this purpose. This may include in particular name, organisation, address, email address, contract data, service data, invoicing data, payment information and information required under tax and commercial law.

Insofar as you contact us via support chat, helpdesk, contact forms, email, telephone, online chat or comparable communication channels, we process the “Support Communication” transmitted in this context within the meaning of the Terms of Use.

The processing is based on Art. 6(1)(b) GDPR insofar as it serves the initiation, performance or execution of a contractual relationship. Insofar as we process data to comply with statutory retention, documentation, tax or commercial law obligations, the processing is based on Art. 6(1)(c) GDPR. In all other cases, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling and documentation of enquiries, customer communication and the administration of our contractual and business relationships.

6. Registration and Setting Up a User Account

Visitors have the option of registering on our Online Platform by providing personal data. In doing so, the data from the input form are collected: email address, username, password and information on the organisation, the type of organisation, the professional role, function or job description. Registration takes place via a double opt-in procedure.

Purpose & legal basis: Registration serves to set up and manage the personal user account, to manage permissions within the Organisation Area and to perform the user relationship with the specified Organisation.

Insofar as the registered User is a contracting party themselves, the processing is based on Art. 6(1)(b) GDPR. Otherwise, it is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the performance and administration of the user relationship with the Organisation and the secure provision of personal user accounts.

Note: Our offering is directed exclusively at organisations and businesses. Contracts with consumers within the meaning of § 13 of the German Civil Code (BGB) are not concluded. Registration is only permitted if the Visitor is acting on behalf of the specified Organisation.

7. Use of the Online Platform and Personalisation

When the Online Platform is used, we process log, interaction and usage data as well as information on the User’s organisation, type of organisation, professional role, function or job description. This includes in particular login times, function calls, search and filter operations, and interactions with User Content, in particular NUB templates and coding aids, with Information Content and with platform functions.

The purposes of the processing are in particular:

  • Provision, administration and security of the Online Platform and the user accounts.
  • Error analysis, quality assurance and detection of misuse.
  • Personalisation and relevance ranking of notices, recommendations and search results.
  • Operation, quality assurance and improvement of search, analysis and recommendation functions and, once activated, of the platform-internal AI assistance function (Section 3e).

These data are not used for training, improving or validating AI models and are not made available for monitoring the performance or behaviour of employees.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure provision of the Online Platform to the respective Organisation in accordance with the contract, in protection against misuse and in the needs-based personalisation and further development of our functions.

Interactions with published NUB templates and coding aids are additionally processed for Content Access Analytics pursuant to Section 8a.

Note on Separately Processed Data:
Separately Processed Data from the import module are processed separately from other platform data and are not processed for the aforementioned purposes. They are processed exclusively in accordance with § 7 of the Terms of Use and the respective DPA.

7a. Access via Interfaces and Self-Selected AI Assistants

Users of the Premium Version may, subject to a separate agreement, access the Online Platform via interfaces, in particular application programming interfaces (API) and servers based on the Model Context Protocol (MCP), including via an AI assistant of their own choice (§ 5a of the Terms of Use). In this context, we process access tokens (in particular API keys and OAuth tokens) and log data of the queries, in particular time, function queried, query parameters (such as search terms, codes and places), scope and access token used. We do not receive the content of the conversation with the AI assistant; we receive only the queries the AI assistant sends to the interface.

The purpose is to provide interface access, authentication, enforcement of query limits as well as security and prevention of misuse. The legal basis is Art. 6(1)(b) GDPR. For logging and detection of misuse, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the Online Platform and its content against impermissible data extraction.

Content retrieved via interfaces may contain personal data, in particular Physician, Contact Person and Referrer Data pursuant to Section 8. It is transmitted to the AI assistant that the User has chosen and connected themselves. The AI assistant is not operated by us; its vendor is neither our service provider nor our processor. The User or their Organisation is responsible for the selection of the AI assistant and for the further processing by its vendor, including outside the European Union.

Users may send us a feedback report through the AI assistant, for instance about an incorrect or unexpected answer. A report is sent only if the User expressly agrees in the chat. It contains the information the AI assistant takes from the conversation with this agreement (summary, question, expected and received answer, affected queries), as well as the user account, the Organisation and the AI assistant used. We add the log data of the User’s own interface queries from the 30 minutes before the report, at most 30 queries. Feedback reports are handled internally only. The purpose is error analysis and improvement of the interface. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in assuring the quality of the Online Platform.

Note on Separately Processed Data:
Separately Processed Data from the import module are retrieved via interfaces only in accordance with the DPA, on the instructions of the Organisation and within the scope of the access rights pursuant to § 7(4) of the Terms of Use.

8. Processing of Physician, Contact Person and Referrer Data pursuant to Art. 14 GDPR

Within the Online Platform, we provide information on healthcare facilities, hospitals, specialist departments, office-based physicians, hospital physicians, medical practices, medical care centres (MVZ), medical contact persons and actual or potential referrers. Insofar as this information relates to identified or identifiable natural persons, we process personal data.

This may include in particular name, title, professional function, specialty, assignment to a practice, clinic or organisation, business address, telephone number, email address, practice site information, BSNR (practice site number), LANR (lifelong physician number), regional assignments as well as referrer or potential information.

Referrer and potential information is processed exclusively as professional, organisation-related analytical information. It does not serve to assess private characteristics, personal performance, health or behaviour of the data subject outside their professional context.

The processing is limited to professional, function-related and organisation-related information in connection with the data subjects’ activities in the healthcare sector. Private contact details, patient data, health data of the data subjects and special categories of personal data within the meaning of Art. 9 GDPR are not specifically collected or provided.

Depending on the data category, the data originate from publicly accessible sources, official directories, hospital and practice websites, public registers, specialist directories, data suppliers, cooperation partners or from our own structured research and preparation.

The processing is carried out for the provision, structuring, updating and display of search, filter, analysis, comparison, export and evaluation functions within the Online Platform. Once activated, this also includes processing by the platform-internal AI assistance function (Section 3e).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a specialist information and analysis platform for professional users in the healthcare sector and in the structured presentation of professional contact data, organisational information and referrer-related analytical information.

As we process a large number of professional contact person data from various public and specialist sources, we inform data subjects centrally through this Privacy Policy. At the same time, we apply protective measures, in particular data minimisation, purpose limitation, access restrictions, regular checks for up-to-dateness and simple objection and deletion processes.

The data may be displayed and made available to registered Users and Organisations within the scope of the activated platform functions. Users of the Premium Version may also retrieve the data via interfaces and transmit them to an AI assistant of their own choice (Section 7a). Use for establishing contact, business development, CRM storage or direct marketing is only permitted in accordance with the Terms of Use and the applicable statutory requirements. The respective Users or Organisations are responsible for the lawfulness of such further use.

The data are stored for as long as they are necessary for the stated purposes or legitimate interests in their processing exist. The data stocks are regularly reviewed for up-to-dateness, necessity and accuracy and, where necessary, rectified, updated, restricted or deleted.

Data subjects may at any time object, pursuant to Art. 21 GDPR, on grounds relating to their particular situation, to the processing of their personal data based on Art. 6(1)(f) GDPR and may assert their other data subject rights. To do so, they can contact info@reimbursement.institute or datenschutz@reimbursement.institute. In the event of a justified objection, the personal data concerned will be deleted, blocked or removed from display, unless overriding legitimate grounds prevail. To implement objections or deletion requests, we may maintain an internal blocking or exclusion list in order to prevent data records that have already been blocked from being displayed again.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority, in particular with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

8a. Content Access Analytics for Published NUB Templates and Coding Aids

In order to finance free access to published NUB templates and coding aids, we record their use, in particular views, downloads and markings, and assign it to the user account and the respective Organisation.

From these data, we prepare Content Access Analytics, which we also pass on to companies and institutions against payment. The Content Access Analytics contain information on the institution and on usage, but no names, contact details or user identifiers of individual Users. The recipients process the Content Access Analytics under their own responsibility.

The data recorded for Content Access Analytics are anonymised after their processing. Anonymised access data may be stored and evaluated for an unlimited period of time.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in financing the free offering and evaluating the use of published content.

Users may object to this processing pursuant to Art. 21 GDPR on grounds relating to their particular situation.

 

III. Legal Framework and Data Subject Rights

9. Automated Decision-Making and Profiling

We use automated procedures to analyse usage patterns and to provide Users with specialist content, notices, recommendations, search results or analysis functions that are likely to be relevant. In doing so, organisation, type of organisation, professional role, function or job description as well as usage and interaction data may in particular be taken into account. This evaluation may constitute profiling within the meaning of the GDPR. No decision based solely on automated processing that produces legal effects or similarly significantly affects the data subject takes place. The final professional decision always remains with the User or the Organisation.

In connection with Physician, Contact Person and Referrer Data pursuant to Section 8, too, the Online Platform merely provides search, analysis, comparison and evaluation functions. No decision based solely on automated processing that produces legal effects or similarly significantly affects the physicians or other contact persons concerned takes place. Decisions based on the information provided always remain with the respective User or the respective Organisation.

10. Recipients and Categories of Recipients

Personal data are received only by those internal departments and external service providers that need them to fulfil the stated purposes. External recipients may in particular be hosting, IT, maintenance, security, analytics, cookie consent tool, chat, payment, billing, tax and legal advisory service providers as well as public authorities. These include in particular Hetzner Online GmbH and Habla, Inc. d/b/a Olark, insofar as they are used in the respective processing context. Processing on behalf is carried out on the basis of Art. 28 GDPR.

In addition, Content Access Analytics pursuant to Section 8a are received by companies and institutions that purchase them from us, in particular manufacturers. These recipients are not processors but independent controllers.

Content retrieved via interfaces is also received by the vendors of the AI assistants that Users have chosen and connected themselves (Section 7a). These are not processors; the transmission takes place at the instigation and under the responsibility of the User or their Organisation.

11. Routine Deletion and Storage Period

Personal data are deleted or anonymised as soon as the purpose of their processing no longer applies.

By way of derogation, we store:

  • Contract and invoicing data: For the duration of the statutory retention periods under tax and commercial law (generally 6 to 10 years).
  • User account and registration data: For the duration of the active user relationship or until the account is deleted.
  • Contact, support and usage data: Only for as long as is necessary for handling, system security, error analysis or the assertion of legal claims.
  • Data from the import module: Exclusively in accordance with the data processing agreement (DPA) concluded with you.
  • Actions recorded for Content Access Analytics (Section 8a): The recorded actions are anonymised after their processing for the Content Access Analytics. The anonymised access data are retained without time limit. Content Access Analytics already transmitted are the responsibility of the recipients.
  • Access tokens: until they are revoked or deactivated or the user account is deleted. Log data of interface queries are stored in the same way as usage data.
  • Feedback reports including the attached log data: up to 12 months after their handling is completed, at the latest until the user account or the Organisation is deleted.

12. Necessity of Providing Personal Data

The provision of certain personal data is necessary for registration, the user account, assignment to an organisation, use of the platform, performance of the contract and billing. The recording of actions pursuant to Section 8a is a prerequisite for free access to published NUB templates and coding aids via the Online Platform. Without these data, the respective functions or services cannot be provided, or cannot be provided in full.

Insofar as data are required on the basis of statutory retention, tax or commercial law obligations, the obligation to provide them arises from the respective statutory provisions. Data based solely on consent are provided voluntarily; consent may be withdrawn at any time with effect for the future.

Data subjects whose Physician, Contact Person or Referrer Data pursuant to Section 8 are processed from third-party sources, public sources, data suppliers, cooperation partners or our own research are not required to provide these data to us.

13. Rights of the Data Subject

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

Insofar as processing is based on your consent, you may withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

Right to object pursuant to Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR.

Following an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Insofar as personal data are processed for direct marketing purposes, you may object to this processing at any time. The personal data concerned will then no longer be processed for direct marketing purposes.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

To exercise your rights, you can contact info@reimbursement.institute or datenschutz@reimbursement.institute at any time.