Two sets of rules apply at once
Under Section 203 of the German Criminal Code (StGB), doctors, psychotherapists, lawyers, tax advisers and other professionals must not disclose secrets entrusted to them without authorisation. A breach is a criminal offence – not just a fine. On top of that come the secrecy duties of professional law, for example in the medical chamber’s professional code, Section 43a BRAO for lawyers and Section 57 StBerG for tax advisers.
The GDPR applies at the same time. It is particularly strict for health data, a special category under Art. 9 GDPR. Art. 32 GDPR requires security measures appropriate to the risk for every processing operation: the more sensitive the data, the more protection is expected.
Together this means in practice: pass on only what is necessary, only to the right person and only on a channel that reliably keeps unauthorised people out. This is general guidance, not legal advice.
When a service provider is involved
Since 2017, Section 203 (3) StGB allows professionals to involve service providers – such as cloud storage – as far as necessary. The condition is in subsection 4: you must ensure the provider is bound to secrecy. For lawyers and tax advisers, Section 43e BRAO and Section 62a StBerG spell this out: contract in text form, instruction on the criminal consequences, access only as far as necessary, clear rules for further providers.
If a service directly serves a single mandate, Section 43e (5) BRAO also requires the client’s consent. For data protection you additionally need a data processing agreement under Art. 28 GDPR. How both look at SafeDoc is explained on the page For professionals bound by secrecy.
Which channels are risky
- Email attachments: the file then sits in every inbox it passed through. A forward takes it along, and you cannot get it back.
- Private messengers and accounts: photos of findings or receipts end up in services your practice or firm has no contract with.
- USB sticks and printed piles: they get lost, left behind or never deleted.
- Shares without an end: a link created two years ago for an expert opinion may still work.
Five principles for a secure exchange
- Necessary? Only pass on what the other side needs for its purpose – if in doubt an extract instead of the whole file.
- Right person? Check the address before you send. With new contacts, a short phone call helps.
- Protected? A link with a password that you share by a second channel keeps others out.
- Time-limited? Access should end on its own – after days, not years.
- Traceable? You should always see what you shared with whom, and be able to revoke it.
Typical cases in practices and firms
| Case | Suitable channel |
|---|---|
| Findings or a report for a patient | Link with password, expiry after a few days, download limit |
| Draft brief for a client | Link with password and expiry, password by phone |
| Collecting receipts and documents from clients | File request into a separate folder per client and year |
| Ongoing work with experts or colleagues | Share with an account, limited to the duration of the job |
This does not replace channels that professional law prescribes for certain purposes – such as the special electronic lawyers’ mailbox for submissions to German courts or the telematics infrastructure services in healthcare. Cloud storage is for exchanging with patients, clients and partners, not for official channels.
How to do it with SafeDoc
- Links with password, expiry and download limit from Plus Paid plans · soon: expiry after 1, 7 or 30 days; wrong passwords are slowed down on the server.
- File requests in every plan: clients and patients upload straight into one of your folders, without an account and without seeing what is in it. The request expires on a date you set.
- Sharing with people, optionally limited to 1, 7, 30 or 90 days. People without an account only get access with a confirmed account for exactly the invited address.
- Overview: under “Shared by me” you see all links and shares and how often files were downloaded. Important actions such as shares and deletions are logged.
- Sign-in with a second factor via app or passkey – strongly recommended for an account with patient or client data.
- End-to-end vault for particularly sensitive files: files are encrypted on your device, only you hold the key. Not yet externally reviewed Beta invite only.
Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now. We do not use the contents of your files to train AI models and do not pass them on to providers of AI services.
Concrete examples per profession: for medical practices and psychotherapists, for law firms and for tax offices.
The agreements: DPA and confidentiality agreement
The data processing agreement is included in every paid plan from Plus, including individual accounts Built · launches with paid plans. What it covers is explained on the data processing agreement page.
The confidentiality agreement under Section 203 StGB can be concluded from launch. Before that, we bind everyone involved in our service to confidentiality in text form – only then do we offer it. You can already read the wording in your account under Settings → Agreements.
Checklist for practices and firms
- Conclude a DPA with your storage provider.
- Bind the provider to secrecy under Section 203 (4) StGB (text form).
- For mandate-specific services, check whether consent is needed (Section 43e (5) BRAO).
- Create a separate folder for each patient or client.
- Only send protected links with password and expiry, password by a second channel.
- Collect documents with a file request instead of email.
- Turn on two-factor sign-in for all accounts.
- Review shared links once a month and delete what is no longer needed.
How to share individual client data step by step is shown in the article Sharing client data under the GDPR.
Note