How we handle your data — and why we can sleep at night.
A plain-language overview of where helpwave runs, how patient data is isolated per customer, and which certifications cover the providers underneath. Compiled by our Chief Legal Officer, Dr. med. Ludwig Maidowski, Dipl.-Jur.
Email Ludwig directly for any question on data protection, the data processing agreement (AVV) or regulatory requirements — he replies in writing.
ludwig.maidowski@helpwave.deFrequently asked questions
These answers reflect our current setup. The signed contract is always the binding source of truth.
Where is helpwave actually running?Germany only. Patient data sits on a BSI C5-certified German cloud provider — not a hyperscaler.
All helpwave workloads that process patient or otherwise sensitive health data run from data centres in Germany, on a specialist German cloud operator that holds a current BSI C5 attestation (Cloud Computing Compliance Criteria Catalogue, BSI). It is deliberately not a public hyperscaler.
The result: data residency, operator access and regulatory supervision all sit inside the German legal framework.
Is my patient data mixed with another clinic’s?No. Every customer with patient data gets its own dedicated instance — own cluster, own database, own keys.
Per-tenant isolation is structural, not a configuration toggle:
- Each tenant is a separate deployment on the C5-certified provider.
- Backups, encryption keys and access controls are scoped to a single tenant.
- Support access is granted per tenant and audited — no blanket cross-tenant privilege.
A misconfiguration or data subject request affecting one customer cannot, by design, touch another customer's patient records.
What about shared services like customer.helpwave.de?Same C5-certified provider, but zero patient data — only operational data needed to run the service.
Some surfaces are operated as shared infrastructure: customer.helpwave.de, marketing pages, the docs portal, status pages. They run on the same C5-certified German provider — but they intentionally do not contain patient data.
What we do process there is limited to what those surfaces need to operate: admin accounts, billing data, support tickets, telemetry. None of it is health data of a treated person — so it can safely co-exist in one environment without compromising the per-tenant isolation we apply to patient data. We treat this as a deliberate quality of the architecture, not a downside.
Are you ISO 27001 / C5 certified yourselves?Not yet. We inherit C5 from the provider today and are working toward our own ISO 27001 and helpwave-scoped C5.
By running on a provider that already holds BSI C5, helpwave inherits the externally audited control evidence for that scope (physical security, network segregation, change management, incident response, key management, personnel screening). Customers benefit today, without waiting for helpwave to finish every own certification first.
We treat this as a current state, not an end state. helpwave is actively working on its own certifications — including ISO/IEC 27001 and a helpwave-scoped BSI C5 attestation — plus adjacent frameworks where they bring real value (e.g. medical-device and information-security standards). Each certification will be announced when it lands.
Do you sign a data processing agreement (AVV)?Yes — with tailored technical and organisational measures (TOM) per customer.
Every customer engagement that involves personal or patient data is governed by a data processing agreement (Auftragsverarbeitungsvertrag, AVV) under Art. 28 GDPR, with an attached TOM document.
For customers under specific regulatory regimes — for example hospitals subject to §75c SGB V or KRITIS-relevant operators — we are happy to provide a tailored TOM and discuss the contractual setup directly with our Chief Legal Officer.
Who can access our data?Only authorised helpwave engineers, on the specific tenant, for the specific reason — audited end to end.
Operator access to a customer instance is granted per-tenant, scoped to a specific support or maintenance reason, and logged. There is no standing cross-tenant access for engineers; encryption keys, credentials and backups are scoped to a single tenant.
For customers that require additional controls — break-glass workflows, on-call approval windows, restricted operator pools — we configure those as part of the TOM.
Is this page legally binding?It is an overview, not a contract. Where this page and a signed agreement differ, the signed agreement prevails.
This page is an informational overview written so clinical leadership, procurement and IT teams can follow it. It does not, by itself, replace the contractual documents that govern an individual engagement — in particular the AVV and the attached TOM.
For a binding written statement on a specific scenario, contact our Chief Legal Officer below. For the formal data-protection statement, see our privacy policy; for corporate information, the imprint.
This overview is updated whenever the underlying infrastructure, providers or certifications change in a relevant way. For a binding written statement about a specific setup, please reach out to Dr. med. Ludwig Maidowski.