Terms of use

BKK EWE, Staulinie 16-17, 26122 Oldenburg, telephone number: 0441/350285101, e-mail address: info@bkk-ewe.de, hereinafter referred to as "health insurance fund", has been offering its insured persons, hereinafter referred to as "users", the use of an insured person-managed electronic patient file ("ePA") approved by the Gesellschaft für Telematik in accordance with Section 342 (1) SGB V as a core element of digital medical applications in several expansion stages since January 1, 2021 upon application and with consent.

The ePA is intended to provide insured persons on request with barrier-free electronic information, in particular on findings (e.g. electronic doctor's letters), diagnoses (e.g. electronic emergency data), therapy measures carried out and planned (e.g. the electronic medication plan) and treatment reports, for use across institutions, disciplines and sectors for healthcare purposes, in particular for the targeted support of anamnesis and diagnosis as well as their own health data.

These General Terms of Use ("Terms of Use") constitute the legal framework for the registration and use of the ePA by the insured persons of the health insurance fund ("Users"). They apply between the health insurance fund and the users. 

More information 

• on how the ePA works, 
• on transfer options for data stored with the health insurance fund to the ePA, 
• on transfer options for treatment data to the EPR by service providers, 
• on transfer options for data from electronic health records to the EPR, 
• on the access of service providers to data in the ePA, 
• for technical access release to the data processing of service providers, 
• to temporarily non-existent options for restricting consent, 
• on additional applications and how they work, including data processing, storage location and access rights, 
• for the secure use of components that enable insured persons to access the ePA via a user interface on suitable end devices, and 
• on the possibility and requirements of voluntarily releasing data from the EPR for research purposes 

can be found in the information material which can be accessed by the user during the entire term of this license agreement(https://www.bkk-ewe.de/ihr-service/ePA).

The subject of these terms of use is the temporary provision of the ePA in the legally prescribed form by the respective responsible health insurance fund to its insured persons. The ePA enables users to securely store, transmit and manage their health data (e.g. findings, laboratory reports, doctor's letters, etc.).

3.1 The ePA is made available to the user of the health insurance fund free of charge. 

3.2 The ePA is accessed via the Internet. The user is responsible for providing Internet access and the hardware required to access the ePA. The user must provide the necessary technical requirements for using the ePA. The user must ensure that their smartphone or operating system has not been tampered with or maliciously modified (no rooting or jailbreaking). Before the ePA can be used, the user must be successfully identified.
The necessary technical requirements for using the ePA are contained in the linked document Leistungsbeschreibung_ePA_Produkt(www.bkk-ewe.de/ihr-service/ePA).

3.3 Beyond the functions prescribed by law, the user is not entitled to the provision of the ePA in a specific form, in a specific configuration or with specific functionalities. The health insurance fund reserves the right, at its reasonable discretion and taking into account the interests of the user, to change individual functionalities or services of the ePA that are not prescribed by law, in particular to extend or restrict functions or services or to terminate them in whole or in part. The user will be informed in good time before any termination of functions or services and will be given the opportunity to export the data stored by him/her from the ePA.

3.4 The ePA and/or individual applications may be temporarily unavailable or only available to a limited extent due to technical faults. The user has no claim against the health insurer that the ePA and/or the content and applications offered will be available at all times or at certain times. The health insurance fund is not obliged to guarantee uninterrupted and error-free access to the ePA or certain content and applications at all times.

4.1 Registration and conclusion of the contract for the ePA shall be in German. The user must register in order to set up and use the ePA. As part of the registration process, the user will be asked to enter the correct and complete information about their identity.

• At the beginning of the registration process, the user is given the opportunity to read these terms of use, information materials and the ePA privacy policy. The user can download and save the documents via the links provided. The user must first accept the terms of use and confirm that they have read the ePA privacy policy. 
• Next, the user must consent to the data processing in the ePA vis-à-vis the health insurance company in accordance with data protection regulations, whereby the consent can be revoked at any time in the app, in writing and without giving reasons.

4.2 Access to the ePA is then activated, the user's administrative personal master data required for the purpose of setting up the ePA is transferred to the ePA by the health insurance fund and the user's account is created. The activation of the ePA is displayed to the user electronically in the ePA. With the confirmation of the activation of the ePA by the health insurance company, the user contract between the user and the health insurance company is concluded on the basis of these terms of use. The user will receive confirmation of the content of the contract and the essential information on the user contract, including a copy of the terms of use, so that the user can save these separately.

4.3 Once registration is complete, the user has completed all the necessary activities to obtain authentication. The ePA can then be set up.

4.4 The user is entitled to cancel the registration process at any time, jump back one step in the process, pause the process and resume it later. 

5.1 The ePA is an electronic file managed by the insured person. The use of the electronic health record is voluntary for all users. The user can partially or completely revoke the creation of the electronic health record at any time. 

5.2 The user must provide the health insurance company with complete information for the proper execution of the contractual relationship and keep the data up to date until the termination of this user contract. The user may only store and manage information on the ePA that is correct to the best of the user's knowledge

5.3 The user may only use the ePA for the intended purpose and to the agreed extent. Any other use, in particular the misuse of the ePA functions, is prohibited. However, the user may allow third parties to access his/her data stored in the ePA via the functions of the ePA, insofar as this is expressly permitted in the ePA. The ePA may not be used to store and manage the health data of third parties.

5.4 The user must keep his access data, with which he gains access to the ePA, secret from third parties. The user is responsible for every access to the ePA with his/her access data. The user account may not be passed on to third parties for access to the ePA.

5.5 It is prohibited to use the ePA for unlawful, obscene, offensive or fraudulent activities, such as causing or facilitating damage, compromising the integrity or security of systems or networks, bypassing filters, sending unsolicited, misleading or abusive messages, distributing malicious software, viruses or infringing the rights of third parties.

5.6 The user is responsible for the legality of the content stored by him/her in the ePA. The health insurance fund merely provides the technical and organizational platform for the user with the ePA. The health insurance fund has no knowledge of the content that the user has stored in the ePA and does not assume any monitoring or control tasks with regard to the content. From the point of view of the health insurance fund, this is therefore third-party content. The user may not store or have stored in the ePA any content that

a) constitute a breach of legal obligations or prohibitions or official orders, or are otherwise illegal or inadmissible;
b) denigrate, insult or discriminate against others;
c) glorify violence, are obscene or pornographic;
d) are in breach of copyright or constitute a breach of third-party rights, in particular they must not infringe any industrial or intellectual property rights or personal rights;
e) contain malware, viruses or damaging data.

5.7 Blocking:
The health insurance fund is entitled, at its reasonable discretion and taking into account the interests of the user, to temporarily or permanently block the use of the ePA by the user or to terminate it without notice if the user exceeds the limits of the permitted use of the ePA by violating these terms of use or applicable law and the health insurance fund has previously requested the user to remedy or cease the violation within a reasonable period of time. The health insurance fund may also delete the user's ePA if it has reasonable indications that the user is using the ePA in an unlawful manner with regard to the data to be deleted.

5.8 Specifications in the event of the death of a user
The death of a user does not lead to the automatic deletion of the EPC. 

The ePA can only be deleted after the death of the user by the authorized representatives or heirs by means of written termination with proof of the status of heir or authorization or after a period of 365 days.

Within this time limit, the heir must submit a power of attorney to indicate their right to manage the deceased's data. If no power of attorney is submitted to the health insurance fund within this period, the EPR will be deleted immediately and irrevocably in accordance with paragraph 11.3.

If the power of attorney was submitted to the health insurance fund in due time, the authorized representative/heir will be informed by the health insurance fund in accordance with paragraph 11.4 of the period during which he/she can export the deceased's data. Once this period has expired, the EPA will be deleted immediately and irrevocably.

Users are advised that they alone can ensure during their lifetime that authorized representatives or heirs can gain access to the encrypted data after their death. The user can do this either by granting a power of attorney, e.g. through the "Representative regulation" in the ePA app from (from 01.01.2022) or by depositing the PIN for the eHC with the will.

6.1 The rights of use under copyright law belong exclusively to the health insurance fund. The health insurance fund grants the user a non-exclusive, non-transferable, non-sublicensable, revocable right, limited to the term of this user agreement, to use the ePA for private, non-commercial purposes for the storage, transmission and management of their own health data.

6.2 The user may only use the ePA to the extent to which he/she is authorized by the user agreement and for which the ePA is intended. Any use beyond this is prohibited.

6.3 It is prohibited to retranslate, disassemble, reproduce, modify, make publicly available or distribute the software of the EPA. An exception to this is partial decompilation for the purpose of creating interoperability of an independently created computer program with the software of the EPA or with other computer programs under the restrictions specified in § 69e of the German Copyright Act. However, the user is obliged to ask the health insurance fund for the necessary information beforehand. Only if the health insurance fund does not provide the user with the necessary information within a reasonable period of time may the user proceed in accordance with sentence 2 above. 

7.1 As the controller, the health insurer shall ensure that the user's data is protected and secure when the ePA is provided. For the entire term of this user contract, the user remains the controller of the personal data transferred to the ePA by him or at his instigation (e.g. by his doctor). The user alone decides which data is stored in the ePA, who may access the data stored in the ePA and which data is deleted. Details on the processing of personal data by the health insurance fund, on the options for independently storing and deleting data in the ePA and on the rights of the user vis-à-vis the health insurance fund as the controller are set out in the privacy policy for the ePA. At no time does the health insurance company have access to the data stored by the user in the ePA. 

7.2 For data protection monitoring purposes, the health insurance fund will provide the user with log data on accesses and attempted accesses to his personal data in the ePA for up to three (3) years after termination of the user contract from 01.01.2022 on request. At the end of this period, the log data will be deleted.

7.3 From 01.01.2022, users will be able to import and save their data stored in an electronic health record ("eHR") into the EPC. To do this, they must back up the data stored in the electronic health record and transfer it independently to their EPR. 

8.1 The health insurance fund guarantees the basic operability of the ePA. It shall rectify any errors that occur in the ePA within a reasonable period of time and ensure that the use of the ePA does not conflict with any third-party rights. The current version available to the user is subject to the warranty.

8.2 Warranty claims do not exist for insignificant defects.

8.3 The health insurance company also fulfills its obligation to rectify defects by making updates available for download in the respective app store and offering the user support to solve any installation problems that may arise.

8.4 A functional impairment of the EPA resulting from hardware defects, environmental conditions, incorrect operation or similar is not a defect.

8.5 The user is obliged to notify the health insurer immediately of any defects in the ePA. The user shall support the health insurance fund in diagnosing and rectifying faults, in particular by describing any problems that occur in concrete terms, providing the health insurance fund with comprehensive information and granting it the time and opportunity required to rectify the fault.

8.6 No guarantee is given for the correctness and completeness of the content of databases in stored form.

8.7 If the search for errors and causes of errors reveals that these are not due to a defect in the ePA, the ePA has been modified, used outside the specified environment or operated incorrectly, there is no defect.

8.8 Further warranty claims are excluded.

9.1 The health insurance fund is liable without limitation for intent, gross negligence and the absence of warranted characteristics. 

9.2 The health insurance fund is only liable for slight negligence if an obligation is breached, the fulfillment of which is essential for the proper execution of the contract and the breach of which jeopardizes the achievement of the purpose of the contract and on the observance of which the user regularly relies. However, the health insurance fund is not liable for unforeseeable damage that is not typical for the contract.

9.3 Strict liability on the part of the health insurance company for errors already existing at the time of conclusion of the contract in accordance with § 536a BGB is expressly excluded.

9.4 The health insurance fund is not responsible for delays in performance in the event of force majeure, industrial action, official measures, unforeseeable failure of means of transport or energy and other unavoidable events, even if these circumstances occur at an upstream supplier of the health insurance fund. The obligation to provide services does not apply if one of these events leads to an impossibility for which the health insurance fund is not responsible.

9.5 If data, files and information originate from third parties and are merely processed by the health insurance fund, no liability is assumed for their accuracy and completeness.

9.6 The above provisions shall also apply to claims for reimbursement of futile expenses pursuant to Section 284 BGB.

9.7 In the event of data loss, the health insurer is only liable if the user has complied with the obligations imposed in these terms of use when handling the data stored in the ePA.
Liability for the recovery of the user's data is also limited to the costs necessary to recover the data if it is regularly backed up in the manner specified by the health insurance fund or can otherwise be reconstructed from machine-readable data material with reasonable effort.

9.8 Liability under the Product Liability Act and for damages arising from injury to life, limb or health, for fraudulently concealed defects or the assumption of a guarantee shall remain unaffected by these liability provisions.

9.9 Section 44a TKG (Telecommunications Act) remains unaffected.

9.10 The health insurance fund has no further liability.

9.11 The above clauses also apply to claims for damages against legal representatives, executives or other vicarious agents of the health insurance fund.

10.1 The User may terminate the User Agreement with the health insurance company at any time without giving reasons and without observing a notice period. The User must declare the termination in writing or in person to his health insurance company.

10.2 The Health Insurance Fund may terminate the User Agreement,

a) if the user terminates his/her insurance relationship with the health insurance company, or

b) or does not accept the amended Terms of Use in accordance with Chapter 12.2.

10.3 The health insurance company informs the user about the received cancellation and tells him on which date the deletion will be executed by the health insurance company by commissioning BITMARCK.

10.4 The right to extraordinary termination without notice for good cause shall remain unaffected.

11.1 Deletion of the EPA.
If the user does not activate the EPA within 365 days after the registration process, the initially created but still empty EPA is automatically deleted.

11.2 The user can terminate the contract of use with the health insurance fund at any time in writing or in the ePA app, without giving reasons and without notice, and thereby delete the ePA.
The user can export his data until the end of use chosen by him. As soon as the end of use is reached, the ePA is immediately and irrevocably deleted.

11.3 The health insurance company may terminate the contract of use, 

a) if the insurance relationship with the health insurance fund ends or
b) the amended terms of use pursuant to paragraph 12.2 are not accepted,
c) if the user withdraws the declaration of consent for the use of the ePA in the app, the ePA must be deleted immediately in accordance with gematik's specifications. The user will be informed of this consequence when withdrawing consent in the app.

The health insurance company informs the user of the termination and grants him a period of 100 days during which the user can export his data. After this period, the EPA will be irrevocably deleted 

11.4 The right to extraordinary termination without notice for good cause remains unaffected.

12.1 The health insurer is entitled to amend these terms of use at any time during the term of this user contract. The health insurer shall inform the user of any amendments to these terms of use within the ePA app. As soon as the user accepts the amended terms of use, the amendments will take effect. These terms of use apply both to online access via the ePA app and to offline access outside the app.

12.2 The user can access the currently valid version of the Terms of Use via the ePA app (under Settings -> Terms of Use). If the user does not accept an amendment to the terms of use, the old terms of use shall remain in force. In this case, the health insurer is entitled to terminate the contract of use within 90 days. 

12.3 The health insurance fund is also entitled to amend these Terms of Use without obtaining the user's consent,
a) insofar as the amendment of the Terms of Use only offers advantages for the user;
b) insofar as the amendment only relates to new functions, services or parts of services and the amendment does not affect the valid service and contractual relationship;
c) insofar as the amendment is necessary to implement applicable legal requirements (e.g. in the event of a change in the applicable legal situation and the amendment only has an insignificant adverse effect on the user; or d) insofar as the health insurance fund thereby complies with a binding official decision or a binding court ruling.(e.g. in the event of a change in the applicable legal situation) and the amendment only has an insignificant adverse effect on the user; or
d) insofar as the health insurance company thereby complies with a binding official decision or a binding court ruling and the amendment only has an insignificant adverse effect on the user. The health insurance fund will inform the user of any changes in the ePA app.
 

13.1 These Terms of Use are governed by German law to the exclusion of the UN Convention on Contracts for the International Sale of Goods.

13.2 If the user is a consumer and has his habitual residence during the use of the ePA in a country other than the Federal Republic of Germany, mandatory legal provisions of this other country shall remain unaffected by the choice of law made in Section 12.1. A consumer within the meaning of this Section 12 is any natural person who concludes the contract of use for private use (i.e. the use is for the most part neither part of their commercial nor their self-employed professional activity).

In the event that any provision of these Terms of Use is held to be invalid, the remaining provisions shall remain in full force and effect, except where adherence to the Terms of Use would cause undue hardship to either party.

15.1 BKK EWE has set up an ombudsman's office. The user can contact this ombudsman's office with questions and concerns in connection with the ePA for the entire term of the user contract. The ombudsman's office advises the user on all questions and problems relating to the use of the ePA. In particular, it provides information on the procedure for applying for the ePA, user claims, the functionality and possible content of the ePA.

15.2 The user can contact the ombudsman's office by email at epa@bkk-ewe.de.