1. General Information
This privacy notice provides information on the processing of personal data in connection with the installation and use of the careIT mobile application (hereinafter referred to as the “App”).
NursIT provides the App as a supplementary mobile user interface for the careIT nursing documentation system.
It enables authorised staff at hospitals, care facilities, outpatient nursing services and comparable organisations to access, record and edit medical and nursing information on mobile devices.
The App is not a standalone nursing documentation system. Its use requires valid access authorisation for the careIT system operated by the relevant institution.
Simply downloading or installing the App does not grant access to patient or nursing data.
The App is intended for use on mobile devices authorised and managed by the relevant institution. Under the intended operating model, use on privately owned devices is not permitted.
2. Data Protection Responsibilities
2.1 Responsibility of the relevant institution
The institution using the careIT system is generally the controller responsible for processing personal patient and nursing data in the context of medical treatment and nursing care.
It determines the purposes of processing, the authorised users and their respective access rights.
The relevant institution fulfils the obligation to provide data protection information to patients and, where applicable, employees insofar as it acts as controller.
2.2 Role of NursIT
Where NursIT processes personal data on behalf of the relevant institution in the provision, maintenance or support of careIT, this is carried out on the basis of contractual data processing agreements in accordance with Article 28 GDPR.
Use of the mobile App does not, in itself, change this allocation of responsibilities.
Where NursIT processes personal data under its own responsibility the following information applies. At the current state NursIT does not process personal data within the app for its own purpose.
2.3 Contact details of NursIT
NursIT Institute GmbH
Pfalzburger Straße 71a
10719 Berlin, Germany
Email: info@nursit-institute.com
2.4 Data Protection Officer
The Data Protection Officer of NursIT can be contacted at:
datenschutz@nursit-institute.com
3. Purposes and Scope of Data Processing
The App serves exclusively as an additional mobile access point to the existing careIT system.
Processing is carried out in particular for the following purposes:
| Processing activity | Data categories | Purpose |
|---|---|---|
| Login and authentication | User identifiers, authentication and session information | Ensuring authorised access |
| User and permissions management | User roles, permissions, organisational assignments | Restricting access to authorised information |
| Medical and nursing documentation | Patient master data, health and nursing data, treatment information | Supporting and documenting medical treatment and nursing care |
| Offline use | Locally stored patient, documentation and permissions data | Providing selected functions without an active network connection |
| Synchronisation | New and amended documentation entries, required assignment and time information | Transmitting and reconciling documentation data with the careIT system |
| Technical operation and security | Connection, error, login and security information, insofar as actually logged | Ensuring functionality, troubleshooting and access security |
The type and scope of the information processed depend on the functions used and the permissions defined by the relevant institution.
In particular, the App may process special categories of personal data under Article 9 GDPR, including health data, patient data and employee data.
4. Login and Access Authorisation Checks
Users log in to the App using the authentication methods provided for the connected careIT system.
Access rights are based on the permissions assigned to each user in the careIT system.
These permissions are granted, modified and withdrawn by the relevant institution or its authorised representatives.
Data previously made available may remain accessible through the intended offline functions during a temporary interruption to network connectivity.
Separate technical safeguards and time restrictions apply to offline access.
- Verification of the server’s identity before any sign-in details are sent.
- Password check by the organisation’s system.
- Encrypted storage of sign-in details and care data on the device.
- Exclusion of care data from device backups.
- Offline access only for users who have already signed in on the device.
- Automatic screen lock after inactivity, with a limit on repeated password attempts.
- Automatic sign-out and deletion of data on the device after longer inactivity.
- The organisation can switch the app off and withdraw a user’s access.
5. Local Storage and Offline Use
The App allows selected functions to be used without an active network connection.
For this purpose, personal patient and nursing data, including health data, may be stored on the mobile device.
Local storage is used solely to provide the intended careIT functions during mobile use.
The type and scope of locally stored data depend on the functions and permissions required in each case.
The App is intended for use on mobile devices authorised and managed by the relevant institution. Use on privately owned devices is not part of the intended operating model.
Appropriate technical and organisational security measures are envisaged for locally stored information, particularly to protect against unauthorised access and breaches of confidentiality.
Local encryption
- Care data on the device is encrypted field by field with AES-256-GCM. Devices whose processor lacks AES support use XChaCha20-Poly1305 instead.
- Downloads are encrypted while they are still in progress.
Key protection
- Encryption keys are kept in the device’s secure storage (iOS Keychain, Android Keystore)
- Keys are only available after the device has been unlocked.
- Working keys are derived from the stored key using HKDF-SHA256.
- Keys are replaced at every sign-out.
Data minimisation
- Care data and sign-in details are left out of device backups.
- Screenshots and screen recordings are blocked.
- Diagnostic logs contain no care data or sign-in details and are deleted after 7 days.
- All care data is deleted from the device at sign-out and when the session expires.
- Temporary files are removed automatically.
Device binding
- Keys and sign-in details are bound to the device and can’t be moved or restored to another device.
5.1 Records entered offline
Documentation newly entered or amended while offline is synchronised with the connected careIT system once an appropriate connection has been restored.
Synchronisation conflicts
- The server resolves conflicts: the most recently changed version of a record wins
- A change overtaken by a newer version on the server is not applied, and the user is told it was replaced
5.2 Deletion of local data
Locally stored data are subject to separate retention and deletion rules.
The maximum retention period for data held offline in the App is:
3 days and 1 additional day warning
All data relating to a patient or employee are marked with the date of their last use. If that date falls earlier than the current date and time minus the maximum retention period, the data are deleted from the device.
The rules cover, in particular, user logout, withdrawal of access rights, decommissioning of a device and the end of authorised use.
Documentation that has not yet been successfully synchronised is handled in accordance with the procedure established to prevent data loss.
Deletion of local copies does not automatically result in deletion of the corresponding documentation in the central careIT system.
6. Data Transmission and Synchronisation
The App communicates with the connected careIT system for authentication, data retrieval and synchronisation.
Protected communication channels are used to transmit personal data.
Data are exchanged over HTTPS using up-to-date encryption.
Data entered or amended through the App are transmitted to the connected careIT system for further processing.
Under the intended technical operating model, the App does not use any additional external analytics, tracking or cloud services.
The network connections are defined by the customer specific architecture and have to be maintained by the customer.
7. Data Protection by Design and by Default
The App is designed to process personal data only for the intended medical and nursing purposes.
Access rights are based on the roles and permissions defined in the relevant careIT system.
Local storage of patient and health data is to be limited to the information required for the relevant functions.
The technical design and intended default settings take account of the requirements for data protection by design and by default under Article 25 GDPR.
Only data relating to the patient’s current encounter are loaded. In the case further data is required they will be loaded separately.
8. Technical and Organisational Security Measures
Technical and organisational security measures appropriate to the relevant risks are used to protect personal data.
These include, in particular, authentication, access restrictions, protection of data transmission and safeguards for locally stored data.
The specific implementation takes account of the requirements of Article 32 GDPR and the contractual arrangements with the relevant institution.
Additional requirements for the security of the devices used and the handling of locally stored information apply to mobile use.
| Requirement | Reason | Realization |
|---|---|---|
| Health data encrypted at rest, “state of the art” | GDPR Art. 9, Art. 32, BDSG §22(2) | Every patient-data text field is encrypted with XChaCha20-Poly1305 via libsodium. The column name is bound in, so a value can’t be copied into another column or tampered with unnoticed |
| Keys kept apart from the data | GDPR Art. 32, BSI TR-03161 | The data key and password are in the Keychain/Keystore, set so they never sync to iCloud and never move to another device. |
| No copies leaving the device | GDPR Art. 32, Art. 44 ff. (transfers) | Android Backup, device-to-device transfer and iCloud are all disabled |
| Deletion / right to erasure | GDPR Art. 17, Art 5(1)(e) | Logout wipes the store and side files, then replaces the key, so leftover data in the file can never be read again. Purging a patient also removes their data. |
| Lost or stolen device | GDPR Art. 34(3)(a) | Because the data in encrypted to a current standard, a stolen device probably doesn’t require notifying each patient. The possible breach shall be reported to the supervisory authority (Art. 33) |
| Logs | GDPR Art. 5(1)(c) | Diagnostics logs are redacted. iOS doesn’t expose the app’s files through Dinder/Files |
9. Mobile Device Permissions
The App uses only those device functions and permissions required for the features provided.
Permissions:
- Camera: Photographing wounds, documents and receipts, and scanning the connection QR code. Permission is asked the first time the camera is used
- Photos: Picking photos for documentation and pictures of the connection QR code. Permission is asked the first time a photo is picked.
- Notifications: Reporting the result of automatic background sync. Permission is asked after sign-in, only when automatic sync is on, or when it’s switched on in the settings (German: Einstellungen).
Required permissions are requested using the mechanisms provided by the relevant operating system.
Permissions can be managed through the operating system settings. If necessary permissions are denied, certain App functions may not be available.
10. Legal Bases for Processing
Patient and health data processed in the course of medical treatment and nursing care are handled under the responsibility of the relevant institution as controller.
The applicable legal bases arise in particular from Article 6(1) and Article 9(2) GDPR, in conjunction with the relevant national and federal-state legislation.
The legal bases applicable in an individual case depend, in particular, on the type of institution and the specific processing activity.
Where NursIT acts as a processor, data are processed in accordance with the controller’s instructions and the agreements pursuant to Article 28 GDPR.
11. Recipients of Personal Data
Patient and nursing data are made available within the careIT system to authorised users in accordance with their assigned access rights.
Additional recipients may arise from the technical and organisational arrangements of the relevant institution.
NursIT may access personal data only insofar as necessary to perform the agreed services and as permitted under data protection law.
In the intended operation of the mobile App, no additional external analytics, advertising, tracking or other services are used.
12. Transfers to Third Countries
Under the intended technical operating model, the App does not use additional external services to process patient documentation independently.
Whether and to what extent data are transferred outside the European Union or the European Economic Area in connection with the respective careIT installation or supplementary services depends solely on the relevant system configuration and the contractual arrangements concluded by the institution with third parties. These are set out in the relevant institution’s privacy notice.
13. Retention Periods and Deletion
Patient and nursing data processed centrally in the careIT system are stored and deleted in accordance with statutory retention obligations and the instructions of the institution acting as controller.
Separate retention and deletion rules apply to data stored locally on mobile devices.
In particular, these rules cover:
- the maximum permitted duration of offline access,
- storage and deletion of data that have already been synchronised,
- handling of documentation that has not yet been synchronised,
- the consequences of a user logging out or being blocked,
- removal of data when a device is decommissioned.
Data retrieved by a user while using the App are deleted when either of the following two conditions is met, whichever occurs first.
Condition 1: The relevant user’s session ends. All data retrieved by that user are then deleted from the device.
Condition 2: The last use of / access to the locally stored data was longer ago than the maximum retention period specified in section 5.2 of this document.
Where technical log or security data are processed, they are deleted after the end of their specified retention period, unless legal reasons require further retention.
Deleting a mobile user account or locally stored data does not automatically delete centrally stored medical or nursing documentation.
14. Rights of Data Subjects
Subject to the applicable statutory conditions, data subjects have the following rights:
- right of access under Article 15 GDPR,
- right to rectification under Article 16 GDPR,
- right to erasure under Article 17 GDPR,
- right to restriction of processing under Article 18 GDPR,
- right to data portability under Article 20 GDPR,
- right to object under Article 21 GDPR.
Where processing is based on consent, that consent may generally be withdrawn at any time with effect for the future.
The relevant institution, as controller, is generally responsible for handling requests to exercise data subject rights relating to medical and nursing documentation.
This applies in particular to requests concerning patient records, treatment data and statutory retention requirements for medical documentation.
The right to erasure is not absolute, particularly where statutory retention or documentation obligations apply.
Where NursIT processes personal data in its own capacity as controller, requests may be directed to the contact details provided in section 2.
Data subjects also have the right to lodge a complaint with a competent data protection supervisory authority.
15. Availability via App Stores
The App may be made available through the Apple App Store and Google Play.
When visiting an App Store listing or downloading, installing or updating the App, the respective platform operators may process personal data as part of their own services.
The respective platform operators’ privacy notices apply to this processing:
Installing the App through an App Store does not, in itself, give the platform operator access to patient and nursing data stored within the careIT system.
Any additional processing through operating system functions or App components must be considered separately.
16. Amendments to this Privacy Notice
This privacy notice may be amended where changes to App functions, technical processing or the legal framework make this necessary.
The current version is available at: