Privacy Policy

Preface

We, Pacsy GmbH, Puricellistraße 34, 93049 Regensburg, Germany (hereinafter "Pacsy", "we" or "us"), take the protection of your personal data seriously. Pacsy is a cloud-based PACS system (Picture Archiving and Communication System) that enables medical practices, radiologists, MVZs and clinics to digitally manage and securely exchange medical image data. This privacy policy informs you about how your personal data is processed by us.

1. Definitions

"Personal data" (Art. 4 No. 1 DSGVO/GDPR) means any information relating to an identifiable natural person. "Processing" (Art. 4 No. 2 DSGVO) means any operation performed on personal data. "Controller" (Art. 4 No. 7 DSGVO) determines the purposes and means of processing. "Processor" (Art. 4 No. 8 DSGVO) processes data on behalf of the controller.

2. Name and Address of the Controller

3. Data Protection Officer

4. Legal Bases of Data Processing

• Art. 6 (1) sentence 1 lit. a DSGVO: Consent of the data subject.
• Art. 6 (1) sentence 1 lit. b DSGVO: Performance of a contract or pre-contractual measures.
• Art. 6 (1) sentence 1 lit. c DSGVO: Compliance with a legal obligation.
• Art. 6 (1) sentence 1 lit. f DSGVO: Safeguarding the legitimate interests of the controller.
• Art. 9 (2) lit. a DSGVO: Explicit consent for health data.
• Art. 9 (2) lit. h DSGVO: Processing of health data in the context of healthcare.

5. Data Deletion and Storage Duration

Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies and no statutory retention obligations (e.g. § 257 HGB, § 147 AO) preclude deletion.

6. Data Security

We implement appropriate technical and organizational security measures. The Pacsy application and all medical image data (DICOM) are operated exclusively on servers of Hetzner Online GmbH in Germany (Nuremberg and Falkenstein, ISO 27001 certified). Email is operated on our own server at RKOM Data Center 3, Keltenstraße 5, 93138 Lappersdorf. All servers are located in Germany. Data transmission is exclusively encrypted (TLS). User accounts are protected by two-factor authentication (2FA).

7. Pacsy as Processor

Insofar as Pacsy stores DICOM image data (health data) for medical practices, MVZs or clinics, Pacsy acts as a processor pursuant to Art. 28 DSGVO. The respective practice remains the controller. A data processing agreement (DPA / AVV) is concluded with each practice. For inquiries regarding their own health data, patients should contact their practice.

8. Cooperation with Processors

To provide our services, we use the following processors:

Hetzner Online GmbH

Industriestraße 25, 91710 Gunzenhausen, Germany. Main servers for the application, database, DICOM image data and backups. Locations: Nuremberg and Falkenstein, Germany. ISO 27001 certified. Legal basis: Art. 6 (1) lit. b, f DSGVO.

Own Email Server (Mailcow) – RKOM Data Center 3

Keltenstraße 5, 93138 Lappersdorf, Germany. Operation of our own email server for system-relevant emails, including image sharing emails. Processing exclusively in Germany. Legal basis: Art. 6 (1) lit. b, f DSGVO.

Spryng B.V.

Hannie Dankbaarpassage 20-B, 1053 RT Amsterdam, Netherlands. Transactional SMS delivery (e.g. 2FA codes). EU provider, DSGVO compliant. Privacy policy: https://www.spryng.de/datenschutzerklaerung/ – Legal basis: Art. 6 (1) lit. b, f DSGVO.

Functional Software Inc. (Sentry) / self-hosted GlitchTip on Hetzner

Currently: Sentry, 45 Fremont St., San Francisco, CA 94105, USA (third-country transfer with EU standard contractual clauses). Planned: migration to self-hosted GlitchTip on Hetzner infrastructure in Germany – at which point the third-country transfer will no longer apply. Purpose: app error telemetry; no patient data or DICOM content. Legal basis: Art. 6 (1) lit. f DSGVO.

Expo Technology Inc. (Push Notifications and App Updates / EAS)

650 Castro St., Mountain View, CA 94041, USA. Push notifications (Expo Push Service) and over-the-air app updates (EAS). Third-country transfer with EU standard contractual clauses. Push notifications can be disabled at any time in device settings. Privacy policy: https://expo.dev/privacy-explained – Legal basis: Art. 6 (1) lit. a, f DSGVO.

Google LLC (Firebase Cloud Messaging – Android Push Notifications)

1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Push notifications on Android devices. Third-country transfer with EU standard contractual clauses. Privacy policy: https://cloud.google.com/terms/cloud-privacy-notice – Legal basis: Art. 6 (1) lit. a, f DSGVO.

Apple Inc. (Apple Push Notification Service – iOS Push Notifications)

One Apple Park Way, Cupertino, CA 95014, USA. Push notifications on iOS devices. Third-country transfer pursuant to Art. 46 DSGVO. Privacy policy: https://www.apple.com/legal/privacy/ – Legal basis: Art. 6 (1) lit. a, f DSGVO.

9. Your Rights as a Data Subject

• Right of access (Art. 15 DSGVO)
• Rectification of inaccurate data (Art. 16 DSGVO)
• Erasure / right to be forgotten (Art. 17 DSGVO)
• Restriction of processing (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO)
• Objection to processing (Art. 21 DSGVO)
• Withdrawal of granted consent (Art. 7 (3) DSGVO) – without affecting prior processing
• Complaint to the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, email: poststelle@datenschutz-bayern.de

10. No Automated Decision-Making

We do not use automated decision-making, including profiling, pursuant to Art. 22 DSGVO.

11. Changes to this Privacy Policy

We reserve the right to amend this privacy policy. The current version is available at https://pacsy.de/en/datenschutz. Last updated: September 2026.

1. Visiting our Website (pacsy.de)

a) Server Log Files

When you access our website, log data is automatically stored on our Hetzner servers (Germany): URL, referrer, date/time, browser type, operating system, HTTP status code, anonymized IP. Legal basis: Art. 6 (1) lit. f DSGVO. Storage duration: 30 days.

b) Contact via Email or Contact Form

Your data (name, email, message content) is processed on our own mail server (Mailcow) at RKOM Data Center 3, Keltenstraße 5, 93138 Lappersdorf, Germany. Legal basis: Art. 6 (1) lit. b or lit. f DSGVO.

c) Registration and User Account

A user account is required to use Pacsy. We collect: name, email, practice name, phone (optional), password (encrypted). Double opt-in procedure. Data is stored on Hetzner infrastructure in Germany. Legal basis: Art. 6 (1) lit. b DSGVO.

2. Use of the Pacsy App

a) Camera Access

With your consent, the app may access the camera (e.g. for QR codes). Captures are processed locally only. Legal basis: Art. 6 (1) lit. a DSGVO. Withdrawal of consent is possible at any time via device settings.

b) Error Telemetry (Crash Reporting)

In the event of technical errors, telemetry data is recorded: error message, app version, operating system version, anonymized session ID, timestamp. No patient data or DICOM content is transmitted. Currently: Sentry (USA, EU standard contractual clauses). Planned: migration to self-hosted GlitchTip on Hetzner in Germany. Legal basis: Art. 6 (1) lit. f DSGVO. Storage duration: 90 days.

c) Push Notifications

With consent, we send push notifications via the Expo Push Service (USA). Depending on the device, Firebase Cloud Messaging (Android, Google LLC, USA) or Apple Push Notification Service (iOS, Apple Inc., USA) is used. Third-country transfer with EU standard contractual clauses or pursuant to Art. 46 DSGVO. Deactivation is possible at any time via device settings. Legal basis: Art. 6 (1) lit. a DSGVO.

d) App Updates (Over-the-Air via EAS)

The app can receive updates via Expo EAS (USA). Data transmitted: technical device data (app version, platform) – no user or patient data. Third-country transfer with EU standard contractual clauses. Legal basis: Art. 6 (1) lit. b, f DSGVO.

e) Processing of Medical Image Data (DICOM)

DICOM image data constitutes health data pursuant to Art. 9 DSGVO. Pacsy processes such data exclusively as a processor on behalf of the respective practice. The DICOM data is stored exclusively on servers of Hetzner Online GmbH in Germany (Nuremberg and Falkenstein). Processing outside Germany does not take place. Legal basis: Art. 9 (2) lit. h DSGVO in conjunction with Art. 28 DSGVO.

f) Image Sharing via Email

Pacsy enables practices to transmit image data by email to patients or authorized recipients. This function is initiated exclusively by the practice as controller. Delivery via our own mail server (Mailcow) at RKOM Data Center 3, 93138 Lappersdorf, Germany. Legal basis at practice level: Art. 9 (2) lit. a or lit. h DSGVO.

3. SMS Notifications

For transactional SMS (e.g. 2FA codes) we use Spryng B.V., Hannie Dankbaarpassage 20-B, 1053 RT Amsterdam, Netherlands. EU provider, DSGVO compliant. Legal basis: Art. 6 (1) lit. b, f DSGVO.

4. Cookies

Our website uses exclusively technically necessary cookies (session, authentication). We do not use tracking or advertising cookies. Legal basis: Art. 6 (1) lit. f DSGVO.

5. Social Media Presence

Pacsy maintains a presence on Instagram and Facebook (Meta Platforms Ireland Ltd.). Their privacy policies apply to your interactions there.

Contact for Privacy Inquiries