Privacy Policy hiLuno®

Version 1 · 2026-10-06

Last update of the privacy policy: 06. Oktober 2026

Orientation guide

The protection of your personal data and your child's data is very important to us. With this privacy policy, we would like to inform you about the scope and purpose of the personal data we collect, use and process.

An overview of the individual chapters for better orientation can be found here:

Preamble – Here you will find a brief overview of the content of the application and the data protection topics.

Contact – How can you get in touch with us quickly and easily?

Data processing and Storage – Which of your and your child's data is stored and processed, how, for what purpose, where, by whom and for how long?

Legal basis – On what legal basis do we process your and your child's data?

Data transfer – To which processors and other third parties is your and your child's data transferred, for what purposes and on what legal basis?

Data security – What do we do to protect your and your child's data as much as possible?

Your rights – Here you will find an overview of all your rights as a data subject.

1. Preamble

The hiLuno® application is a guided, digital self-help programme for parents and guardians of children with ADHD and non-organic sleep problems aged approximately 4 to 11 years. The children act as patients and the parents or guardians as users of the application.

The medical device software hiLuno® supports families in gradually improving the child's sleep and the evening routine. Through psychoeducational content, personalised training plans, sleep tracking, bedtime routines and further interactive features, guardians learn to adapt sleep-related behaviours and framework conditions together with their child. The aim is to improve sleep or sleep satisfaction and to ease everyday family life — not to treat the core symptoms of ADHD itself. [TBD]

Based on specific user input (including questionnaires on life and sleep situation), the application creates an individual training plan. Features such as a sleep diary, bedtime routine, reminders, feedback loops and optional event capture via a remote control enable interactive engagement with the programme. [TBD]

hiLuno® is based on evidence-based elements of cognitive behavioural therapy for insomnia (CBT-I), sleep hygiene and behavioural parenting strategies. [TBD]

As part of app registration and use, various personal data is collected from you and your child. This data includes health data within the meaning of Art. 9 para. 1 of the General Data Protection Regulation, which is specially protected by law. In this privacy policy, we explain for what purposes and how we process this data, how we protect this data and how you can exercise your rights as set out in the GDPR.

2. Contact

You can reach us via the feedback function in the hiLuno® app or directly via the service e-mail address kinderschlaf@medice.de. Our core hours are Monday to Friday (excluding public holidays) from 8:00 to 18:00. You can also reach us outside our core hours via the feedback function or directly via the service e-mail address kinderschlaf@medice.de.

You will receive a response to your enquiry within 24 hours at the latest.

Controller within the meaning of Art. 4 (7) of the EU General Data Protection Regulation (hereinafter "GDPR"), the German Federal Data Protection Act (hereinafter "BDSG") and other data protection regulations is:

Medigital GmbH

Medice-Allee 1

58638 Iserlohn

E-mail: kinderschlaf@medice.de

Authorised representative

Dr. Felix Lambrecht

Internal data protection officer:

If you have any questions about our data protection measures, the processing of your data or the protection of your rights as a data subject, please contact our data protection team as follows:

Medigital GmbH

Data Protection

Medice-Allee 1

58638 Iserlohn

Phone: +49 (0)2371 937 0

E-mail: privacy-medigital@medice.de

For confidential matters relating to data protection, you can contact our data protection officer directly at:

dsb@medice.de

3. Data processing and storage

The data protection term "personal data" refers to all information relating to an identified or identifiable person, such as contact details, age or gender. An IP address can also be considered personal data.

The following personal data is collected and processed from you and your child:

User (parent / guardian, optional: second parent / guardian):

Patient (child):

The personal data is processed for the following purposes:

Obligatory:

Optional - with separate consent:

Processing of personal data when using the app

You have the option of registering in our app by providing personal data.

Your registration enables us to offer you content or services which, due to the nature of the matter, can only be offered to registered users. Registered persons are free to change the personal data provided during registration at any time / have it changed.

We also need your device model name, your operating system version and your app version number so that we can identify any errors in the event of a malfunction of the app.

Second caregiving parent: A primary parent may optionally invite exactly one further guardian by e-mail. The second account does not receive its own activation code; usage rights and training plan follow the primary account. The invitation requires explicit consent to joint use / synchronisation of the personalised training plan. Withdrawal of this consent by the primary account deletes the second account or cancels a pending invitation. [TBD]

Separate/optional consent

Consent to the processing of usage data (tracking) pursuant to §4 (2) sentence 1 no. 4 DiGAV)

Usage and traffic data collected during the use of the hiLuno app (navigation paths through the app, frequency of use of certain features, end system used (product, operating system version), etc.) help us to improve the app and the user experience and, in the event of errors, to better analyse and understand the causes. This data is processed exclusively by us and, as far as possible, this data is processed anonymously for these purposes, i.e. without reference to your identity.

Pursuant to § 4 (2) sentence 1 no. 4 DiGAV, we may process this data on the basis of your voluntary consent pursuant to Art. 6 (1) (a) GDPR for the above-mentioned purposes of permanently ensuring technical functionality, user-friendliness, and the improvement and further development of the app. We ask you for this consent as part of the registration process, as we are dependent on data from real usage scenarios in everyday care to improve the hiLuno app. This consent is optional and you can use the hiLuno app without restrictions if you do not give this consent. You can revoke this consent at any time under "Settings".

Consent to optional extended storage after the end of the prescription period

Optionally, you may consent to app data and the account remaining stored for a further 30 days after the end of the prescription period (activation + 90 days) in a restricted access mode (bridging until a follow-up prescription). Without this consent, the account and stored app data are deleted at the end of the prescription. Legal basis for the optional extension: § 4 (2) sentence 1 no. 4 DiGAV.

Consent to proactive contact by the app manufacturer [TBD]

With your additional consent, we may contact you proactively if our system detects that technical problems occur during the registration process that could prevent successful use of the app. This includes in particular situations in which your user account cannot be properly activated.

Contact is made solely for the purpose of technical support, to enable you to use the application smoothly and to accompany you through the registration process. For this purpose, we process the contact details required for this as well as the technical error information recorded by the system.

Your consent is voluntary and may be revoked at any time informally with effect for the future. A revocation has no effect on the use of the other functions of the application.

User enquiries and making contact

When you contact us (by e-mail, contact form, telephone), personal data such as your e-mail address, your name and telephone number (if applicable), and device data (app version number, model type, operating system version) will be stored and processed for the purpose of responding to your request or for contacting you and for the associated technical administration. This data processing is based on a legitimate interest in processing your request in accordance with Art. 6 (1) (f) GDPR.

Customer support for the hiLuno app is provided by MEDICE Arzneimittel Pütter GmbH & Co. KG, the parent company of Medigital GmbH. For this purpose, there is a corresponding contractual agreement on data processing under joint responsibility pursuant to Art. 26 GDPR between MEDICE Arzneimittel Pütter GmbH & Co. KG and Medigital GmbH.

Information e-mails to registered users

Once you have successfully registered, we will send you regular e-mails. We distinguish between essential and functional e-mails.

Essential e-mails are necessary for the secure and proper use of the app and therefore cannot be disabled. This data processing is carried out to fulfil the services contractually agreed with you in accordance with Art. 6 (1) (b) GDPR, as well as to comply with legal requirements in accordance with Art. 6 (1) (c) GDPR.

These e-mails include, among others:

Functional e-mails are optional and help you make the most of the app. This data processing is based on your voluntary consent in accordance with Art. 6 (1) (a) GDPR, as well as our legitimate interest in assisting you in making the best use of our app in accordance with Art. 6 (1) (f) GDPR.

These e-mails include, among others:

You may withdraw your consent at any time without giving reasons and unsubscribe from the functional e-mails. For this purpose, a corresponding link/contact details can be found in every e-mail.

Place of processing

The personal data entered in the app (including health data) is processed on access-protected servers of the Telekom Healthcare Cloud in Germany. [TBD]

Access and processing rights to the files to be processed are exclusively reserved for designated, authorised employees of MEDICE Arzneimittel Pütter GmbH (as the parent company of Medigital GmbH), Medigital GmbH, and the processors listed under "Services used" who are subject to the instructions of Medigital GmbH (pursuant to Art. 28 GDPR).

The personal data collected following separate consent to tracking is processed on access-protected servers of the Telekom Healthcare Cloud in Germany. [TBD]

Access and processing rights to the data are restricted exclusively to designated, authorised employees of MEDICE Arzneimittel Pütter GmbH (as the parent company of Medigital GmbH), Medigital GmbH, and the processors listed under "Services used" who are subject to the instructions of Medigital GmbH (pursuant to Art. 28 GDPR).

The data transmitted to us when you contact us is processed and stored in the CRM system of MEDICE Arzneimittel Pütter GmbH & Co. KG on the servers of salesforce.com Germany GmbH in Frankfurt a.M.

Access and editing rights to the files to be processed are restricted exclusively to designated, authorised employees of MEDICE Arzneimittel Pütter GmbH (as the parent company of Medigital GmbH), Medigital GmbH, and the processors listed under "Services used" (pursuant to Art. 28 GDPR).

Billing data collected from you when using the app as a privately insured person is processed on the servers of our payment service provider Stripe Payments Europe Limited Inc. (Stripe). Further information on Stripe can be found under "The following services are used in the app". [TBD]

Storage and deletion periods

We process and store your personal data and your child's data only for the period necessary to achieve the purpose of the hiLuno application.

Personal data is deleted by Medigital GmbH after expiry of the prescription/usage period and the respective user account is deactivated. 2 weeks, as well as 2 days and 1 day before expiry of the prescription/usage period, we will send you corresponding reminder notifications with information on account deletion at the end of the prescription/usage period and a note on your right to data portability. With your separate consent for the purpose of "user-friendliness" pursuant to §4 (2) sentence 1 no. 4 DiGAV, you may extend the storage period of the data by 30 days beyond the usage period.

When using the service as a privately insured person or self-payer, you may during this transition period extend the usage period by a further 90 days by purchasing the app again. You will only regain access to the app's functions after activation of the additional usage period. An extension of the usage period by purchasing the app again is possible without limit within the transition period. After expiry of the transition period, a new user account must be created. [TBD]

When using the service as a DiGA, you may for the bridging period until a follow-up prescription extend the storage period of the data, with your separate consent for the purpose of "user-friendliness" pursuant to §4 (2) sentence 1 no. 4 DiGAV, by 30 days beyond the prescription period. During this bridging period, the data is locked and cannot be edited/used.

The data collected in the course of contacting us will be deleted after final processing of your enquiry. This is the case when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

4. Legal basis

The legal bases for the processing of your personal data and your child's data are your informed, voluntary consent pursuant to Art. 6 (1) (a) in conjunction with Art. 9 (2) (a) GDPR — and in the event of use of the service as a DiGA pursuant to §33a SGB V — the requirements of §4 (2) of the Digital Health Applications Ordinance (DiGAV), as well as the provision of the digital service contractually agreed with you pursuant to Art. 6 (1) (b) GDPR.

5. Data transfer

Personal data may be transmitted to the following third parties:

To this end, a corresponding contractual agreement on joint responsibility for data processing pursuant to Art. 26 GDPR was concluded between Medigital and MEDICE as companies of MEDICE Health Family Holding GmbH, with MEDICE as the parent company. In addition, corresponding agreements on data processing on behalf of others pursuant to Art. 28 GDPR were concluded with all service providers used.

All processors and sub-processors are subject to written agreements ensuring that personal data is processed only in accordance with the controller's instructions and under appropriate technical and organisational safeguards.

Medigital GmbH guarantees that your data will only be passed on to entities that can demonstrate an appropriate data protection concept in accordance with the applicable regulations and laws and with which, if necessary, appropriate contractual agreements pursuant to Art. 26 or Art. 28 GDPR exist.

Deutsche Telekom Healthcare Cloud [TBD]

Deutsche Telekom Healthcare and Security Solutions GmbH, Friedrich-Ebert-Allee 140, 53113 Bonn (operator of the Telekom Healthcare Cloud) is responsible for hosting the application. Our app uses the Telecom Health Cloud to manage the backend and for secure data storage. The Telecom Health Cloud offers an infrastructure specially developed for healthcare data that meets the highest security standards. All stored data is encrypted and subject to strict data protection guidelines in accordance with the EU General Data Protection Regulation (GDPR). Data processing takes place exclusively on servers within the European Union to ensure compliance with data protection regulations. For this purpose, corresponding contractual agreements have been concluded with the service provider pursuant to Art. 28 GDPR.

Further information on the Telekom Healthcare Cloud can be found at: https://www.telekom-healthcare.com/cloud-und-sicherheit/cloud-plattform-gesundheitswesen/healthcare-cloud

salesforce

Our parent company, MEDICE Arzneimittel Pütter GmbH & Co. KG, which is responsible for first-level support for the app, uses CRM solutions from salesforce.com Germany GmbH, Erica-Mann-Str. 31-37, 80636 Munich, Germany. The CRM platform (customer relationship management platform) is used for managing customer and consent data, sales and marketing management, and providing customer support.

When you contact customer support (by e-mail, contact form, or phone), the following personal data may be collected and processed:

All stored data is encrypted and subject to strict data protection guidelines in accordance with the EU General Data Protection Regulation (GDPR). Data processing takes place exclusively on servers within Germany.

The parent company of salesforce.com Germany GmbH, salesforce.com Inc., is a US company certified under the EU-US Privacy Framework, which means the adequacy decision of the EU Commission pursuant to Art. 45 GDPR applies and thus confirms an adequate level of data protection. Corresponding contractual agreements have been concluded with the service provider pursuant to Art. 28 GDPR on the basis of the European Commission's standard contractual clauses.

For more information on salesforce's privacy policy, please visit: https://www.salesforce.com/de/company/privacy/

Sendinblue

We use the Brevo solution for sending e-mails in this app. The provider is Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany.

Brevo enables us to send transactional e-mails such as registration confirmations, two-step authentication (2FA), password reset e-mails, status updates from the app (module progress in the training plan), account inactivity notifications and other notifications securely and reliably. The e-mail addresses of our users are processed for this purpose. Brevo stores and processes this data on servers in Germany and complies with the requirements of the GDPR.

The shipping service provider is used on the basis of an order processing contract pursuant to Art. 28 GDPR.

You can find more information about Brevo's privacy policy at: https://www.brevo.com/de/datenschutz-uebersicht/.

MEDKONNEKT - electronic patient record (ePA)

To fulfil the DiGA requirements for providing a TI connection (telematics infrastructure) and for connecting the app to the ePA (electronic patient record), we use the product solutions of MEDKONNEKT GmbH, Schleißheimer Straße 91A, 85748 Garching b. München. Operation and provision of the KIM specialist service is carried out by Arvato Systems Perdata GmbH, Martin-Luther-Ring 7-9, 04109 Leipzig, as a subcontractor of MEDKONNEKT GmbH. The remaining processing activities are provided by Research Industrial Systems Engineering (RISE) Forschungs-, Entwicklungs- und Großprojektberatung GmbH, Concorde Business Park F, AT-2320 Schwechat, as the parent company of MEDKONNEKT GmbH. For this purpose, corresponding contractual agreements have been concluded with the service provider pursuant to Art. 28 GDPR.

As soon as technically possible, you may independently transmit the health data of your child entered in the app (sleep-related data from the sleep diary as well as information from questionnaires and bedtime routine) to your child's ePA. [TBD]

In this case, the transmission of your child's personal data takes place only with your consent and in encrypted form.

If you have questions about the personal data in your child's ePA and your child's data subject rights in this context, please contact your responsible health insurance fund.

Further information on RISE and MEDKONNEKT can be found at: RISE DIGA (rise-diga.de)

Azuma - GesundheitsID

To fulfil the DiGA requirements for implementing an interface for using the GesundheitsID within the app, we use the product solutions of azuma healthtech GmbH, Lindenstraße 4g, 81545 Munich.

As soon as technically possible, you may log in to the app with your GesundheitsID. In this case, your personal data (master personal data, e-mail address, health insurance number) is stored only briefly by Medigital GmbH in a web token for the purpose of identification and is deleted immediately after successful login. Medigital GmbH and azuma healthtech GmbH have no access to your personal data in this process. For this purpose, corresponding contractual agreements have been concluded with the service provider pursuant to Art. 28 GDPR.

Further information on Azuma's privacy policy can be found at:

https://legal.azuma-health.tech/privacy_policies/pp_apps_de

Billing

Noventi

For billing in the context of using the app as a digital health application, we use the service provider NOVENTI HealthCare GmbH (Division Other Service Providers), Berg-am-Laim-Str. 105, 81673 Munich. This billing office is subject, like ourselves and our staff, to the provisions on confidentiality and data protection. Noventi will only process your data to the extent necessary to fulfil its performance obligations for billing with your health insurance fund. For this purpose, corresponding contractual agreements have been concluded with the service provider pursuant to Art. 28 GDPR.

Stripe [TBD]

We use the payment service provider Stripe of Stripe Payments Europe Limited Inc. (SPEL), 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, to process payment when using our app as a privately insured person or self-payer. In this case, your payment data is processed for billing purposes on the service provider's servers in Ireland.

The parent company Stripe Inc. is a US company certified under the EU-US Privacy Framework and thus guarantees a level of data protection adequate to the GDPR. This means the adequacy decision of the EU Commission pursuant to Art. 45 GDPR applies. The service provider is used on the basis of an order processing contract pursuant to Art. 28 GDPR.

Further information on Stripe's privacy policy can be found at:

https://stripe.com/de/legal/privacy-center.

6. Data security

The security of your personal data and your child's data is very important to us. We therefore only process the data you provide and your child's data with your explicit consent.

Any collection, storage, use and transmission of data involves confidentiality risks (e.g. the possibility of identifying the person concerned). These risks cannot be completely ruled out and increase the more data can be linked together. Medigital GmbH assures you that it will do everything possible in accordance with the state of the art to protect your data.

To this end, we take the following technical and organisational measures, among others:

7. Your rights

When processing your personal data and your child's data, our aim is to guarantee your data protection rights at all times. Our service times and all contact options can be found under point 2 "Contact" of this privacy policy.

You can exercise the following rights in relation to your personal data and your child's data:

You and your child will not suffer any disadvantages in the event of a cancellation/objection. The cancellation is effective for the future; the previous data transfers remain lawful.

When using the service as a DiGA, withdrawal of consent pursuant to § 4 (2) sentence 1 nos. 1-3 DiGAV ends use of the application; all data is deleted and your user account is deactivated. Withdrawal of consent pursuant to § 4 (2) sentence 1 no. 4 DiGAV ends processing for the manufacturer's purposes; this does not entail any restrictions on usable functionality.

If you have any further questions about the handling of your personal data and your child's data or would like to exercise your rights, you can do so via the in-app contact form or the service e-mail address kinderschlaf@medice.de. Or you can contact our data protection team at:

Medigital GmbH

Data Protection

Medice-Allee 1

58638 Iserlohn

Phone: +49 (0)2371 937 0

E-mail: privacy-medigital@medice.de

For confidential matters relating to data protection, you can contact our data protection officer directly at:

dsb@medice.de

If there is a basis for complaint, you can lodge a complaint with the competent data protection authority at:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2 - 4 40213 Düsseldorf

Phone: 0211 38424-999

E-mail: poststelle@ldi.nrw.de

The contact details of the data protection supervisory authorities of all federal states can be found at the following internet address:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html