Patient data is Article 9 data. We treat it that way.
MitaBase runs on its own servers at Hetzner in Nuremberg. Patient data sits on a LUKS2-encrypted volume, every customer has their own installation with their own database, and encrypted backups go to a second data centre in Germany every 24 hours. Map, routing and address search run on our own servers: no Google, no Mapbox, no analytics.
You are responsible for the patient data, we process it on your behalf. So this page says where the data sits and who else sees it, rather than that security is “important to us”.
Where the data sits
Hetzner, Nuremberg
LUKS2Patient data on a LUKS2-encrypted volume. Article 9 data never sits on an unencrypted disk.
Backups to a second data centre
encryptedEncrypted, every 24 hours, to a second data centre in Germany. If the first fails, the latest state is ready in the second.
One installation per customer
1 customer · 1 installationEvery customer gets their own installation with their own database and their own keys. A break-in to one panel reaches one customer, not all of them.
Encrypted in transit
TLSEvery connection between browser, app and server is TLS-encrypted. Patient data never travels in the clear.
Who else sees it
Map, routing, tracking: ours
self-hostedMap tiles, route calculation, address search and even the fonts come from our own servers in Germany. No Google, no Mapbox, no third-party key.
Notifications without patient names
no namesThe server talks to Apple and Google directly, with no push vendor in between. The notification and the lock-screen card never name a patient.
Our hub does not see your data
licence onlyYour installation checks in with the hub once a day, for the licence only. The hub never reaches into a customer installation.
No analytics
0 trackersAnywhere. Not on this page either. Check your browser's network tab.
Who may do what
Permissions in the server, not the interface
server-sideEvery request is checked against the role in the server, not merely hidden in the interface. A driver sees their rides, nothing else.
Logs nobody trims
no gapsWorking time and money are logged without gaps. A deletion needs elevated rights and a written reason, which stays in the log.
A password change ends every session
immediateImmediately, on every device, not at the next expiry.
Every file is checked
checkedEvery uploaded file is checked; anything that does not pass is refused and deleted. Private documents are reachable only when signed in, never through a link.
Credentials encrypted on the phone
encryptedThe driver app keeps sign-in data in the device's encrypted storage, not in a file.
Contract and responsibility
You are the controller, we process
Art. 28Your company remains the controller for the patient data; MitaBase processes it on your behalf (Art. 28 GDPR). We conclude the data processing agreement with you in text form before we process any personal data on your behalf; it is being finalised with a lawyer.
Payment by SEPA, no card data
SEPABilling runs by SEPA direct debit. Credit card details are never collected or stored.
Found a vulnerability?
security.txtWrite to info@mitabase.com. We reply on working days and tell you what we are doing about it.
What we do not have
This list is here because somebody would otherwise find it. We do not claim a certificate we do not hold. A supplier who names their gaps is the only one whose other statements you can check rather than believe.
- No ISO 27001, no C5. No certification of any kind.
- The data processing agreement and the TOM document are being finalised with a lawyer. Until they are reviewed, we do not offer them.
- EXIF data in photos is not stripped. We would rather say so than imply a scrub that does not happen.
- No payer interface: no § 301, no § 302, no EDIFACT.
Frequently asked questions
Who sees the driver's location, and for how long?
Only your dispatch, in your own installation, and only during an open shift after the driver has confirmed “Position teilen”. Clocking out or signing out ends the transfer at once. No route history is stored: what is visible is the trail of the last few minutes, 5 to 60 depending on your company's setting, and older points are discarded. The ride keeps the calculated arrival time and the time of arrival. When clocking in or out, the location is stored once with the time entry as proof of working time.
GPS in the vehicle: what about the works council?
The works council has a say: GPS on duty is subject to co-determination under § 87 BetrVG. What is recorded is position during duty, working time and completed rides. No microphone, no private journeys, no evaluation after hours. The driver can switch position sharing off in the app; everything else keeps working.
Do the drivers' phones keep patient data?
Not permanently. The app holds rides with name and address only in memory; they are not stored on the phone. A photo, say of a transport form, stays only until the server has confirmed receipt, then the app deletes it. On screens with patient data the app prevents screenshots as far as the operating system allows. When signing out, the app deletes the sign-in token.
How long are transport forms and records kept?
As long as the law requires: transport forms, rides and receipts are accounting records and are kept for eight years by default (§ 147 AO, § 257 HGB). You set the period as the controller, within the statutory limits. When it ends, the records are deleted.
What happens to our data when we cancel?
After the contract ends, your data stays available for export for 30 calendar days, in a common, machine-readable format. Then we delete it completely, unless a statutory retention obligation requires otherwise. Deleted data can remain in the encrypted backups until the backup is overwritten.