Trust through
Transparency.

• HTTPS/TLS 1.2+ on all connections
• Firewall & DDoS protection (ALL-INKL)
• Regular security updates
• Access on a need-to-know basis
• Cookie consent management
• Logging of all system accesses

We use Unifyr Analytics (analytics.agentur-circle.com) for privacy-friendly website statistics. No tracking without cookie consent. No sharing with third parties. No cross-site tracking.

• Access (Art. 15 GDPR)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21)

Requests to datenschutz@pcm-group.at – response within 30 days.

• Development & maintenance of all PCM Group websites and product landing pages
• Graphics, UI/UX design and corporate identity
• Online marketing, SEO and performance optimization
• Operation of Unifyr Analytics (privacy-friendly website statistics)
• Technical implementation of marketing campaigns

• Financial data and business documents (receipts, invoices, accounts)
• Employee data for payroll (name, social security number, salary)
• Customer data within the scope of accounting (invoice recipients)
• Tax data for tax authority filings

Wellpoint processes patient data (health data) pursuant to Art. 9 GDPR. Processing only on explicit consent (Art. 9 para. 2 lit. a). All data is stored and transmitted AES-256 encrypted.

• TLS 1.2+ transport encryption
• AES-256 at-rest encryption
• Two-factor authentication
• Role-based access control
• Automatic session timeouts
• Complete audit log
• Penetration tests (annual)
• 24/7 system monitoring

Wellpoint provides each customer with a DPA pursuant to Art. 28 GDPR. As a therapist you are the data controller – Wellpoint is the processor. DPA available by email or via the customer portal.

In the event of data breaches, affected therapists and the supervisory authority are notified within 72 hours. 24/7 security monitoring through Hetzner infrastructure. Dedicated incident response process documented and tested.

PHE Buddy processes health data (phenylalanine values, dietary diary) pursuant to Art. 9 GDPR. Processing only on explicit consent. No data sharing with third parties without explicit consent. AES-256 encryption at rest.

• Encrypted device storage
• Optional PIN/biometric protection
• No advertising, no profiling
• Offline functionality available

Privacy policy available in German and English. All international users (DACH + EU) are treated equally – GDPR applies to all.

No customer content flows into external AI services. All AI functions in Unifyr run on EU-hosted models or are operated by instructed processors.

• No tracking without active cookie consent
• No cross-site tracking – data is not linked across products
• No sharing with advertising networks or third parties
• No personal user profiles
• IP anonymization active in analytics & pixel
• Data remains exclusively within EU jurisdiction
• Opt-out possible at any time via cookie settings
• Inbox data visible only to the respective website operator

Lyvio is integrated as a media module into the Unifyr platform. Hosting, data protection architecture and security measures follow the same standards as the entire Unifyr platform.

• Encrypted media storage
• HTTPS/TLS for all transmissions
• Secure authentication
• Automatic EU backups
• Complete access logs
• Privacy by Design (Art. 25 GDPR)

The following data categories are under no circumstances entered into external cloud AI services (Claude.ai, ChatGPT, Higgsfield or others):

Measures that prevent data processing systems from being used by unauthorized persons.

• Password policy: minimum length 12 characters, upper/lowercase letters, special characters, numbers
• Two-factor authentication (2FA) for all administrative access and cloud services
• Automatic screen lock after 5 minutes of inactivity
• Automatic session timeout for all web applications
• Password manager mandatory for all employees (no reuse)
• Immediate account deactivation upon employee departure
• Regular review of active user accounts (quarterly)
• VPN mandatory for access to internal systems from home office

Ensuring that authorized users of a data processing system can only access the data covered by their access authorization.

• Role-based access control (RBAC) in all product systems
• Principle of least privilege – each employee receives only the rights necessary for their role
• Separation of development, test, and production environments
• No direct database access for end users – exclusively via API layer
• Database access only for administrators with documented justification
• Logging of all privileged access (audit log)
• Regular review of access rights (annually, immediately upon role change)

Ensuring that personal data cannot be read, copied, altered, or removed without authorization during electronic transmission or transport.

• Transmission exclusively over encrypted connections (HTTPS/TLS 1.2+)
• HSTS (HTTP Strict Transport Security) on all product domains
• No sending of personal data via unencrypted e-mail
• File transfers exclusively via secured, authenticated channels
• No transfer of personal data to insecure third countries
• Logging of data disclosures to sub-processors
• API communication exclusively via authenticated endpoints (Bearer Token / API Key)

Ensuring that it can subsequently be checked and determined whether and by whom personal data has been entered, modified, or removed from data processing systems.

• Complete audit log for all data changes in product systems (Wellpoint)
• Timestamps for creation, modification, and deletion of all records
• Immutable log files (append-only logs)
• User ID is stored with every data change
• Form validation and input sanitizing to protect against manipulation
• Logs retained for at least 90 days

Ensuring that personal data processed on behalf of the controller can only be processed in accordance with the controller's instructions.

• DPA (Data Processing Agreement) with all sub-processors pursuant to Art. 28 GDPR
• Written instructions to all processors before processing begins
• Regular review of sub-processors (at least annually)
• Register of all sub-processors used is kept up to date
• Sub-processors may not engage further sub-processors without authorization
• Contractual obligation of all employees to confidentiality (§ 6 DSG)
• Data protection training for all employees with access to personal data

Ensuring that personal data is protected against accidental destruction or loss.

• Daily automatic backups of all databases (encrypted, EU-internal)
• Backup retention: 30 days rolling
• Redundant server infrastructure (Hetzner: multiple locations)
• UPS (uninterruptible power supply) and emergency generators at data center locations
• 99.9% availability SLA at ALL-INKL, guaranteed uptime at Hetzner
• 24/7 monitoring of all production systems with automatic alerting
• Disaster recovery plan documented and tested annually
• Recovery Time Objective (RTO) < 4 hours for critical systems
• Recovery Point Objective (RPO) < 24 hours

Ensuring that data collected for different purposes can be processed separately.

• Logical tenant separation: customer data from different clients is stored in isolation
• Strict separation of development, test, and production data
• No use of real data in test/development environments
• Separate databases per product (Wellpoint, etc. do not share a database)
• Marketing data and operational customer data in separate systems
• Accounting data (Finanzbuchhaltung Monuth KG) separated from operational CRM data

• Dedicated data protection officer / contact person designated internally
• Incident response contact: datenschutz@pcm-group.at
• Register of all data protection breaches maintained internally

• Data protection considered from the beginning of product development (Privacy by Design)
• Most privacy-friendly settings by default (Privacy by Default)
• Data Minimization: collect only data strictly necessary for the purpose
• Storage limitation: deletion concepts defined for all data categories
• Cookie consent required before tracking (no pre-ticking)
• New features checked for data protection compliance before launch
• Data Protection Impact Assessment (DPIA) for high-risk processing

Pursuant to Art. 5 EU AI Act, the following AI practices are prohibited. PCM Group confirms that none of these systems are in use:

• AI-generated text drafts are labeled as such internally and reviewed by a human before sending
• No use of AI chatbots that pretend to be human
• No deepfakes or AI-generated media without labeling
• Users are informed when AI systems are used in the product context
• AI-supported decision assistance is communicated as such – final decision always rests with the human

• All AI systems are used as assistive tools – no autonomous decision-making without human approval
• AI outputs are reviewed by an employee before use
• No AI system has direct write access to production databases
• Kill switch: all AI services can be deactivated immediately
• No AI system makes decisions that have legal or significant financial consequences for individuals