Hey 1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:
- Company
- Haedge Consulting GmbH
- Address
- Grossbeerenstrasse 10, 28211 Bremen, Germany
- P.O. Box
- Postfach 10 06 15, 28006 Bremen, Germany
- Phone
- +49 421 40885636
- info@hey-midwife.de
- Website
- hey-midwife.de
- Court of registration
- Local court (Amtsgericht) Bremen · HRB 39352 HB
- Managing Director
- Florian Haedge
2. Data Protection Officer
For questions about data protection and to exercise your rights, please contact:
- Postal address
- e-health.software – Datenschutz –
P.O. Box 10 06 15
28006 Bremen
Germany - datenschutz@hey-midwife.de
3. Which data we process
In the course of operating this website, we process the following categories of personal data:
- Technical connection data (collected automatically): IP address, date and time of access, requested URL, transmitted data volume, HTTP status code, referrer URL, browser and operating system.
- Contact data (when actively submitted): name, email address, phone number and the content of your message, when you contact us via the contact form or by email.
- Email address for launch notification: If you sign up on the home page to be notified of the launch, we process your email address solely for that purpose.
- Newsletter sign-up data: When you subscribe to our newsletter, we process your email address, the topic preferences you select and the sending frequency you choose (see Section 5).
- Response data from postal advertising campaigns: If you reach our website via an individual link or QR code from a letter we sent you, we process the individual code and the time of access solely to measure the success of that campaign (details in our privacy notice on the advertising campaign, in German).
- Technical usage data via external services: When loading the Inter font, the visitor's IP address is transmitted to the CDN provider Bunny Fonts (see Section 8).
- Details provided when requesting a promotion code (page
/messe): first and last name or practice name, town, email address, type of work (self-employed / practice / delivery room) and the identifier of the campaign through which you reached us. - Details provided when pre-registering for the student licence (page
/studium): first and last name, email address, your degree programme — either selected from a list of universities and programmes or entered as free text —, optionally your semester, and the identifier of the campaign through which you reached us. - Details provided when registering for a webinar (page
/webinar-anmeldung): name, email address, your decision whether we may ask you for feedback after the webinar, and a technical indication of the channel through which you reached the registration page (e.g. trade-fair stand, newsletter, search engine). - Connection data when playing embedded videos: If you start a video on the page
/media, your IP address is transmitted to Google (see Section 8). - Details provided in the website chat: the text of your messages, your email address if you choose to provide it, the address of the page on which you opened the chat, the selected language, timestamps and your truncated IP address (see Section 7).
We do not collect any special categories of personal data within the meaning of Art. 9 GDPR.
4. Server log files
When you access this website, our hosting provider automatically stores information in so-called server log files. This is technically necessary data without which proper operation of the website is not possible:
- IP address of the requesting device (where applicable in anonymised form)
- Date and time of the request
- Requested URL and transmitted data volume
- HTTP status code and referrer URL
- Name and version of the browser and operating system used
This data is processed exclusively to ensure trouble-free operation and to defend against attacks. It is not combined with other data sources.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).
5. Contact requests
When you contact us via the contact form, by email or by phone, we process the data you provide (name, email address, phone number, message content) solely for the purpose of handling your request.
When the contact form is submitted, the entered data is forwarded to us by email immediately. The content of the contact form is not stored server-side. This does not apply to the forms for requesting a promotion code, for pre-registration and for webinar registration — the details entered there are stored; see Section 6. Server logs contain only metadata (timestamp, IP address, response code), not the content of the inquiry. The server infrastructure is hosted by Hetzner Online GmbH; a data-processing agreement (AVV) is in place.
If you sign up via the notification form on the home page, we process the email address you provide solely to inform you once about the launch of Hey Midwife. Your address is not added to a mailing list or newsletter.
If you sign up via the newsletter form on the home page, we process the email address you provide in order to send you our newsletter regularly on the topics you have selected. Consent is obtained by double opt-in: after you sign up, we send a confirmation email containing a confirmation link; your address is added to the mailing list only after you click that link. You can unsubscribe at any time by clicking the link in any newsletter or by sending a message to datenschutz@e-health.software. For sending our emails — the newsletter as well as the confirmation, reminder and notification emails from the form-based offers described in Section 6 — we use the service provider Twilio SendGrid (Twilio Inc., 645 Harrison Street, Third Floor, San Francisco, CA 94107, USA) as our data processor; a data-processing agreement pursuant to Art. 28 GDPR is in place. Transfers to the USA are based on the EU-US Data Privacy Framework (Twilio is a certified participant) and, additionally, on the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46 (2) (c) GDPR.
Your data is not shared with third parties unless this is necessary to handle your request or you have explicitly agreed.
Legal basis: Art. 6 (1) (b) GDPR (initiation or performance of a contract) and Art. 6 (1) (f) GDPR (legitimate interest in responding to inquiries).
6. Form-based offers: promotion code, pre-registration, webinars
On individual pages of this website you can voluntarily provide us with details: to request a personal promotion code (/messe), to pre-register for the student licence (/studium) or to register for one of our free webinars (/webinar-anmeldung). All three offers are voluntary; without the details marked as mandatory, however, we cannot provide the requested service. There is no statutory or contractual obligation to provide them.
When you submit a form, the details are transmitted directly from your browser to our customer-management system at crm.hey-healthcare.de and stored there. Your IP address is also transmitted to that system. The system is operated by the controller named in Section 1 itself; no transfer to another company is involved. The servers are located at Hetzner Online GmbH in Germany; a data-processing agreement is in place. For sending the associated emails we use Twilio SendGrid (see Section 5).
6.1 Requesting a promotion code
We process your details in order to send you a personal promotion code by email. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual steps taken at your request).
Beyond sending the code, we keep your details as a prospect record so that we can approach you about our offering. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in acquiring and supporting prospective customers for our software (cf. Recital 47, sentence 7, GDPR).
You may object to this processing at any time — informally and without giving reasons, for example by emailing datenschutz@hey-midwife.de. After your objection we will no longer process your details for this purpose (Art. 21 (2) and (4) GDPR). In that case we may revoke promotion codes already issued.
6.2 Pre-registration for the student licence
We process your details in order to pre-register you for a student licence, to confirm the pre-registration and to notify you once as soon as the app is available. This one-off notification is part of the pre-registration you requested and is not advertising. The legal basis is Art. 6 (1) (b) GDPR.
We need your degree programme in order to verify your student status — it is a prerequisite of the student licence and therefore mandatory; this processing is likewise based on Art. 6 (1) (b) GDPR.
Providing your semester is voluntary; we use it to offer you suitable onboarding and learning materials. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in an offering tailored to your stage of study); you may object to this processing at any time pursuant to Art. 21 (1) GDPR without affecting your pre-registration.
6.3 Webinar registration
We process your name and email address in order to confirm your registration, to send you the access link and a reminder 24 hours before the session, and to inform you of any changes or cancellation. The legal basis is Art. 6 (1) (b) GDPR (performance of the registration you requested).
In addition, we store with your registration a technical indication of the channel through which you reached the registration page. We use it solely to understand which of our channels make our offers accessible. The legal basis is Art. 6 (1) (f) GDPR; you may object to this processing at any time pursuant to Art. 21 (1) GDPR without affecting your registration.
If you additionally consented when registering, we will ask you once by email for brief feedback after the webinar. The legal basis is Art. 6 (1) (a) GDPR (your consent); you may withdraw it at any time with effect for the future, for example by sending us a short message. Without this consent you will not receive a feedback request.
Your registration data — including your decision on the feedback request — is anonymised 90 days after the date of the webinar. This also applies if you cancelled your registration or the webinar was cancelled; the period runs from the date of the session, not from the status of your registration.
6.4 Webinars held via Google Meet
Our webinars are held via Google Meet. The provider for users in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google acts as our data processor for holding the webinars; a data-processing agreement pursuant to Art. 28 GDPR is in place.
If you attend a webinar, Google processes the data transmitted to the session: the display name you choose, your IP address, connection and device data, and any questions you post in the chat. You do not need a Google account; camera and microphone are not required to attend.
Google Ireland Limited may forward this data to Google LLC in the USA. This is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, in which Google LLC participates as a certified participant, and additionally on the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46 (2) (c) GDPR.
Legal basis for holding the webinar is Art. 6 (1) (b) GDPR.
6.5 Newsletter option in these forms
In all three forms you may additionally and voluntarily subscribe to our newsletter. The checkbox is not pre-selected; without your tick you will not receive the newsletter, and your request is not affected. Subscription is by double opt-in. The legal basis is Art. 6 (1) (a) GDPR; see Section 5 for details.
7. Website chat
On this website you can ask us questions about Hey Midwife via a chat window. Your messages are read and answered by members of our team; we do not use an automated response system (chatbot, artificial intelligence). Use of the chat is voluntary. You do not need to provide your name or email address in order to write to us.
Data processed. We process the text of your messages, our team's replies, your email address if you choose to provide it, and technical details: the address of the page on which you opened the chat (without parameters), the selected language, the timestamps of the messages and your truncated IP address. The truncated IP address serves solely to limit abusive use; it is neither intended nor possible to identify you by it. At the end of the conversation you may voluntarily tell us whether the reply was helpful.
Recipients. The chat runs entirely on our own systems: the chat window is loaded from this website, and your messages are transmitted to and stored in our customer-management system at crm.hey-healthcare.de (see Section 6). No third-party providers are involved, and no data is transferred to countries outside the EU. When a new inquiry arrives, our team is notified by SMS or email; that notification contains neither message content nor any details about you.
Storage in your browser. So that your conversation is preserved as you move between the pages of this website, we store a randomly generated conversation identifier in your browser's local storage. It contains no information about you, is not used to recognise you beyond the conversation and expires after 24 hours of inactivity; you can delete it at any time via your browser settings. This storage is strictly necessary for the chat you have requested and does not require consent under § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). The chat does not set cookies.
Outside our hours of availability (daily from 08:00 to 21:00 German time) the chat accepts your message together with your email address; it is then handled like an inquiry via our contact form (Section 5), and we reply to you by email.
Please do not share health or patient data. The chat is intended for questions about our offering, not for transmitting health data or information about third parties. Should you nevertheless share such information, we will delete it as soon as we notice it.
Legal basis. Where your inquiry is directed at concluding a contract with us, Art. 6 (1) (b) GDPR is the legal basis for processing your messages and your email address; otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to inquiries and communicating with prospective customers). The processing of the technical details, including the truncated IP address, and of your feedback on the reply is based on Art. 6 (1) (f) GDPR (legitimate interest in secure operation and in the quality of our advice). You may object at any time to processing based on Art. 6 (1) (f) GDPR pursuant to Art. 21 (1) GDPR.
Retention period. 90 days after the end of the conversation — or, if a conversation has remained unanswered for 24 hours, 90 days after that point — we remove your email address and the truncated IP address. The remaining message texts are then evaluated internally only, to identify frequently asked questions and improve our help content; any details pointing to individuals are removed in the process. Messages are included in published help content only after editorial review and without personal data. You may request earlier deletion at any time by emailing datenschutz@hey-midwife.de.
Note on exercising your rights. If you have not provided an email address, we cannot attribute your conversation to any person (Art. 11 GDPR). In that case you can exercise your rights under Section 14 only if you provide us with details that enable attribution — for example the time and content of your inquiry.
8. External services
Bunny Fonts (Inter font)
This website loads the Inter font via the service Bunny Fonts (BunnyCDN, Bunny Way d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia). Bunny Fonts is an EU-compliant service and does not transfer IP addresses to third countries outside the EU/EEA. No cookies are set and no user profiles are created.
More information: fonts.bunny.net/about
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in consistent and reliable presentation of the website).
YouTube videos (embedded, loaded only on click)
On the page /media we embed videos hosted on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The videos are not loaded automatically. As long as you do not start a video, no connection to YouTube or Google is established; you merely see a placeholder area with a play button delivered from our own server — no thumbnail is retrieved from Google either. Only when you start a video by clicking is the connection established. Your IP address is then transmitted to Google, and Google may store or read information on your device. We embed the videos in privacy-enhanced mode via the domain youtube-nocookie.com; according to Google, no cookies for analysing usage behaviour are set before you start a video. If you are logged in to Google at the time you click, Google may attribute the view to your account.
Legal basis: your consent, which you give by deliberately starting the video (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You may withdraw your consent for the future at any time by not starting any further videos. If you do not start a video, no processing takes place.
On data processing by Google: policies.google.com/privacy
9. Payment Services
For the processing of payments in connection with the performance of the contract — in particular for your Hey-Midwife software licence — we use the external payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, the Netherlands. Mollie is a payment institution licensed by the Dutch Central Bank (De Nederlandsche Bank) and processes the data transferred in the course of payment processing under its own data-protection responsibility (controller within the meaning of Art. 4 (7) GDPR), in particular to fulfil its own statutory obligations under payment services supervisory law (PSD2), anti-money-laundering and supervisory regulations, as well as to perform the contractual agreement between Mollie and us. Mollie does not act on our instructions in this regard. The processing of data by Mollie is governed by Mollie's own privacy statement, which you can access at mollie.com/en/privacy.
The data transferred to Mollie depends on the payment method you choose:
- for SEPA direct debit: name, billing address, e-mail address, IBAN, transaction amount and time;
- for credit card payments: name, billing address, e-mail address as well as the card and security data required for card authorisation; the latter is entered exclusively via Mollie's hosted checkout form and does not reach our systems;
- for PayPal: name, billing address, e-mail address, PayPal identifier, transaction amount and time.
Mollie B.V. is established in the European Union (the Netherlands); a transfer of your payment data to a third country does not take place in the context of this transmission.
Legal basis: Art. 6 (1) (b) GDPR (performance of the contract concluded with you) and — in the event of a failed payment or any necessary enforcement of claims — additionally Art. 6 (1) (f) GDPR (legitimate interest in securing the contractually owed remuneration).
Retention period: Data retained by us in connection with the payment process (in particular invoice data) is subject to commercial and tax retention obligations (§ 257 HGB, § 147 AO of German law) and is stored for the duration of these periods, however no longer than ten years following the end of the relevant financial year. Mollie determines the retention period of data processed by it under its own responsibility; please refer to Mollie's privacy statement linked above for further information.
10. Cookies & tracking
This website does not use any of its own cookies and does not employ remarketing or profiling. No user profiles are created, no session data is permanently stored, and no data is processed for advertising purposes. A cookieless, data-minimising reach measurement is carried out via the service Plausible Analytics — for further information please see Section 11 (Web analytics).
Only when external services are used (see Section 8) may technically necessary connection data be generated, used solely to deliver the resources.
Website chat: If you use the chat, it stores a random conversation identifier in your browser's local storage, which expires after 24 hours of inactivity (§ 25 (2) no. 2 TDDDG); see Section 7 for details.
Measuring the success of postal advertising campaigns: In individual advertising campaigns (e.g. the letter to midwives of June 2026) our letters contain individual QR codes and links of the form https://hey-midwife.de/r/<code>. When such a link is opened, we log only the individual code and the time of access. No IP address, no referrer data and no browser fingerprints are stored. The link between code and recipient record is dissolved and anonymised no later than 3 months after the end of the campaign. Detailed information on this processing is provided in our separate privacy notice on the advertising campaign (in German).
11. Web analytics — Plausible Analytics
For statistical analysis of the usage of this website we use the web analytics tool Plausible Analytics. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia.
Plausible collects aggregated usage data such as the number of visitors, pages visited, referral sources and approximate geographical region as well as aggregated event counters (in particular form submissions, file downloads and outbound clicks). For this purpose, your device’s IP address and User-Agent are temporarily processed and combined with a daily rotating salt into a non-reversible hash value, which is used solely for same-day identification of returning visitors. The IP address and User-Agent are not stored persistently; no cookies are set and no information is stored on or read from your device (§ 25 TDDDG, the German Digital Services Data Protection Act, remains unaffected). No profile is created and no cross-site recognition takes place.
The sole recipient of the data is Plausible Insights OÜ as our data processor within the meaning of Art. 28 GDPR; a data processing agreement is in place. The servers are located exclusively within the European Union (Estonia and Germany); no transfer to third countries takes place.
Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest lies in the demand-oriented optimisation of our online offering based on aggregated usage figures. You may object to this processing at any time pursuant to Art. 21 GDPR; a simple way to do so is the „Do Not Track“ setting of your browser, which Plausible respects.
Further information on data processing by Plausible is available at plausible.io/data-policy.
12. Legal bases for processing
Where we obtain consent from the data subject for processing operations involving personal data, Art. 6 (1) (a) GDPR serves as the legal basis. For processing of personal data necessary to perform a contract or to take pre-contractual steps, Art. 6 (1) (b) GDPR serves as the legal basis. Where processing is necessary to comply with a legal obligation, Art. 6 (1) (c) GDPR serves as the legal basis. Where vital interests of the data subject or another natural person make processing necessary, Art. 6 (1) (d) GDPR serves as the legal basis. Where processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) (f) GDPR serves as the legal basis for processing.
13. Retention period
Personal data is deleted or blocked as soon as the purpose of storage no longer applies. Storage beyond this may take place if it is provided for by statutory regulations (e.g. tax and commercial retention obligations). In such cases, deletion takes place after the respective period has expired.
- Server log files: usually 7–30 days, depending on the hosting provider's configuration
- Contact requests: until the request has been finally processed, then until the expiry of statutory retention periods (max. 10 years), if a business relationship arises
- Email for launch notification: until the launch notification has been sent, after which the address is deleted unless another business relationship has arisen
- Newsletter sign-up data: until you unsubscribe; confirmation emails (double opt-in) are documented for 12 months
- Response data from postal advertising campaigns (code + time): until the campaign evaluation is complete, no longer than 3 months after the end of the campaign; thereafter the code attribution is dissolved or anonymised
- Details from a promotion-code request: the prospect record is kept without a fixed period for as long as our legitimate interest in approaching you persists. It is deleted as soon as you object or request deletion (Art. 17, 21 GDPR). If a business relationship arises from the contact, commercial and tax retention periods apply.
- Details from pre-registration for the student licence: until you register in the app, at the latest until you request deletion; the launch notification is sent once.
- Details from webinar registration: anonymised 90 days after the date of the webinar — regardless of whether the registration was cancelled or the webinar was called off.
- Website chat: 90 days after the end of the conversation, the email address and truncated IP address are removed; the remaining message texts are evaluated internally only and without personal reference (Section 7). Messages submitted outside our hours of availability are treated as contact requests.
14. Your rights as a data subject
You have the following rights regarding the personal data concerning you:
To exercise your rights, please contact: datenschutz@hey-midwife.de
15. Right to lodge a complaint with a supervisory authority
If you consider that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority.
The supervisory authority responsible for us is:
- Authority
- Die Landesbeauftragte für Datenschutz und Informationsfreiheit Bremen
(State Commissioner for Data Protection and Freedom of Information of Bremen) - Address
- Arndtstraße 1, 27570 Bremerhaven, Germany
- Phone
- +49 421 361-2010
- office@datenschutz.bremen.de
- Website
- www.datenschutz.bremen.de