Who is this relevant for?
Section 203 of the German Criminal Code (StGB) protects secrets entrusted to professionals bound by professional secrecy. These include doctors, dentists, psychotherapists, pharmacists and other healthcare professionals as well as lawyers, notaries, tax advisors and auditors.
These professionals may involve external service providers, but must oblige them to confidentiality (Section 203 (3) and (4) StGB). This also applies to software vendors, for example of practice or law firm software, that use seven to send SMS for their customers: they pass this obligation on to their own service providers.
What does our DPA cover?
From version 2.3 onwards, our standard Data Processing Agreement (DPA) explicitly names these confidentiality obligations. Section 3 "Confidentiality and Personnel" states:
- seven only uses persons for processing personal data who have committed themselves to confidentiality and have been instructed in the relevant data protection provisions.
- This explicitly includes the secrecy of telecommunications (Section 3 TDDDG), social secrecy (Section 35 SGB I) and professional secrecy under Section 203 StGB.
- The obligation continues after the end of the employment relationship.
- Access to personal data is granted on a need-to-know basis only.
In addition, we process data solely within the scope of the main contract and your documented instructions (Section 2 DPA), and our subprocessors are contractually bound to confidentiality (Section 5 DPA).
No separate confidentiality declaration or DPA addendum is required.
Sign or update the DPA
- In the dashboard, open the "Data Processing Agreement (DPA)" box under
Settings > Legal. - If you have not signed a DPA yet or an older version applies, sign the standard DPA in its current version. For older versions, the dashboard shows a notice to update.
- The contract and confirmation are then available as PDF downloads, for example for your own records or those of your customers.
You can find the individual steps with screenshots in the article Sign the Data Processing Agreement (DPA).
Software vendors and subaccounts
A DPA on the main account also covers all subaccounts. If you use seven as a software vendor for your customers, you sign the DPA once, not separately for each subaccount.
What is not possible
- We do not sign customers' own templates or confidentiality declarations. The standard DPA applies.
- We cannot commit to an additional obligation of data centres or network operators under Section 203 StGB, as this cannot be enforced against these providers.
Tips for sending messages
- Do not include diagnoses, findings or case details in the message text. An appointment reminder only needs the date, time and sender.
- Provide confidential content via your patient or client portal and only use SMS to point out that new content is available.
- Depending on the content, reminders may require the recipient's consent. Please clarify this with your data protection officer.
- With the automatic journal deletion you decide how long message content is stored in your account.
Further information
This article does not replace individual legal advice.