Purpose of this overview
The handling of metadata is governed bindingly in the platform agreement (Master Services Agreement, § 8.6–8.11) and in the accompanying data protection and technical-organisational framework. The details are set out in an internal policy on the handling of metadata. It is part of medudoc’s information security management system (ISMS) and is not disclosed to third parties.
This page summarises the applicable principles and states where the individual points are governed and can be verified.
What are metadata?
Metadata (usage data) are data that arise from the use of the medudoc platform as a result of its operation. They are not content data – in particular, not patient or health data. They mainly include (§ 8.6):
- Login and logout times
- IP addresses
- Information on resources used, such as storage and computing capacity
- Access times and technical session data
medudoc keeps your facility’s content data strictly separate from metadata. Content data are subject to the stricter protective measures for health data under Art. 9 GDPR.
What medudoc uses metadata for
medudoc collects and uses metadata exclusively for the contractually defined purposes (§ 8.7):
- Billing of the contractually agreed services
- Detection, resolution and analysis of malfunctions and errors
- Detection, investigation and handling of security incidents
- Provision and assurance of the proper operation of the platform
medudoc uses metadata for improving the platform or for operational analyses only in anonymised form. It is then not possible to draw conclusions about your facility, individual users or patients. There is no commercial use, in particular no disclosure to third parties for marketing purposes (§ 8.8).
As some platform services are billed on a usage basis, metadata are also used for billing your facility.
Storage and deletion
Metadata are stored only for as long as is appropriate for their purposes. medudoc then deletes them without undue delay, unless statutory retention obligations prevent this (§ 8.9).
The specific retention periods are set out in the internal policy. Retention and deletion run automatically via fixed retention rules; no manual intervention is required.
Access and protection
Only authorised medudoc employees and authorised medudoc systems access metadata, in accordance with the principle of least privilege (§ 8.10).
- Encryption: All data are encrypted in transit (HTTPS with TLS 1.2 or higher) and at rest (AES-256).
- Logging: Security-relevant access is logged completely and in a tamper-proof manner (Annex 2A, TOM.4).
- Support access: Access by medudoc support to your facility’s data requires explicit, time-limited approval by your administrators. Every activation and every access is logged (Annex 2A, TOM.3).
What you receive on request
On request, medudoc provides your facility with an overview of the categories of metadata collected and the applicable retention periods (§ 8.11).
If a security incident affects your facility, you will receive, on written request, the relevant event metadata – that is, timestamps, affected system components and the type of incident – as well as a summary of the forensic findings. medudoc provides this information in anonymised or non-security-critical form. Raw system logs and security-critical details of the infrastructure are excluded (Appendix 2, § 10.3).
Contractual and regulatory basis
The data protection basis is the data processing agreement (DPA) under Art. 28 GDPR and the technical and organisational measures (TOMs) under Art. 32 GDPR (platform agreement, Appendix 2). The handling of metadata implements criterion OPS-11 ‘Concept for handling metadata’ of the BSI C5 criteria catalogue and is embedded in the ISMS certified to ISO/IEC 27001:2022.
Where the individual points are governed
| Topic | Governed or verifiable in | Availability |
|---|---|---|
| Definition, purposes, storage, deletion and access | Platform agreement, § 8.6–8.11 | Part of the contractual documentation |
| Specific retention periods and overview of categories | Internal policy on the handling of metadata (platform agreement, § 8.9); overview under § 8.11 | On written request under an active contract |
| Event metadata in the case of security incidents | Platform agreement, Appendix 2, § 10.3; logging under Annex 2A, TOM.4 | On written request under an active contract |
| Contractual and data protection basis | Data processing agreement under Art. 28 GDPR; TOMs under Art. 32 GDPR (platform agreement, Appendix 2) | Part of the contractual documentation |
| Control framework | BSI C5 – criterion OPS-11 ‘Concept for handling metadata’; ISMS under ISO/IEC 27001:2022 | Criteria catalogue, audit and certification |
You can read more about encryption, access protection and evidence on the Security page. Certificates and the list of sub-processors are available in the Trust Center.