Privacy statement: Eltern-Kind-Pass and log-in with ID Austria

This statement provides information under Art. 13 and 14 of the General Data Protection Regulation (GDPR) on how kinderarzt.org processes personal data when you use the Eltern-Kind-Pass on kinderarzt.org and log in with ID Austria for this purpose. For the other parts of the website (calculators, professional accounts, feedback), the following applies: general privacy statement.

1. Controller

Mag. Bernd Peter
Gabelsbergergasse 3, 2700 Wiener Neustadt, Austria
Email: info@kinderarzt.net

For all questions on data protection and on exercising your rights, please contact this address.

2. What this is about

In the Eltern-Kind-Pass on kinderarzt.org, parents can keep their child's examinations according to the Eltern-Kind-Pass examination program, keep track of appointments and answer the child examination questionnaire beforehand. Pediatricians and general practitioners selected by the parents see this information and document the examinations. The service is private. It is not connected to the official (electronic) Eltern-Kind-Pass of the Republic of Austria and does not replace it.

3. Log-in with ID Austria

Parents and physicians log in with ID Austria. In doing so, you are forwarded to the ID Austria log-in service, which the Federal Ministry of the Interior operates as a separate controller; its privacy information can be found at id-austria.gv.at. You enter your credentials (password, Handy-Signatur, app) only there; kinderarzt.org never receives them.

After a successful log-in, ID Austria transmits only the following to kinderarzt.org:

• First name and family name,
• Date of birth,
• the area-specific personal identifier (bPK) for the area of kinderarzt.org – an identifier that is valid only in our area and does not allow any conclusions about your base number (Stammzahl) or your identifiers in other areas,
• the indication whether you are registered as a health service provider in the eHealth directory service (eHVD), together with the role recorded there (e.g. physician) – for persons without such an entry, this item remains empty,
• technical information on the log-in (time, assurance level).

We do not request further attributes (e.g. address, citizenship or social security number) from ID Austria and do not receive them.

Purpose: unambiguous and secure log-in, protection against misuse of other people's identities, recognition of your account at every log-in (via the bPK) and comparison of the social security number you entered with your date of birth. The health service provider information serves solely to distinguish physician accounts from parents' accounts and to verify whether a person opening a physician account is actually registered as a health service provider; for parents it is neither evaluated nor stored. If this information is not available, we check the name against the public list of physicians of the Austrian Medical Chamber before the account is approved.

Legal basis: Art. 6 para. 1 point (b) GDPR (provision of the service you use) and Art. 6 para. 1 point (f) GDPR (legitimate interest in protecting health data against unauthorized access).

Until you have completed registration, the data transmitted by ID Austria remain in your session for at most 30 minutes; if you cancel, they are not stored.

4. Which data we process

Parents and carers: Name, date of birth and bPK from ID Austria (or, for an invitation by your physician, name and e-mail address); your social security number; optionally your e-mail address; your relationship to the child (e.g. mother, father, person with custody); for log-in with a password, a non-reversible hash of the password; the time and version of your consent.

Children: First and last name, sex, date of birth, social security number; optionally information on the birth (week of gestation, birth weight, length, head circumference); the entries on the examinations of the Eltern-Kind-Pass (e.g. findings of the hip ultrasound and hearing screening, assessment of the state of health, counseling topics).

Questionnaire for the third child examination: voluntarily the carer's answers on psychosocial and socioeconomic stressors (questionnaires PHQ-2, EPDS, GAD-2 and GAD-7 as well as questions on income and stress). These are health data of the person who answers the questionnaire.

Physicians: Name, date of birth and bPK from ID Austria, the indication from the eHealth directory service that you are registered as a health service provider, academic title, specialty, physician number, practice with postal code and town, e-mail address, time and result of the verification.

Access log: who viewed, edited or exported a child's pass, and when.

5. Purposes and legal bases

• Maintaining the Eltern-Kind-Pass and disclosure to the physicians you have selected: for your child's health data and the answers in the questionnaire, your explicit consent (Art. 9 para. 2 point (a) GDPR in conjunction with Art. 6 para. 1 point (a) GDPR), which you give at registration; for the other information, Art. 6 para. 1 point (b) GDPR.
• Medical documentation of the examinations by the physicians you have selected: your consent and Art. 9 para. 2 point (h) GDPR (preventive health care and treatment by persons subject to professional secrecy).
• Verification and approval of physician accounts, also based on the health service provider information from ID Austria: Art. 6 para. 1 points (b) and (f) GDPR (only persons who are actually licensed to practice should see health data).
• Access log, protection against misuse (limiting of log-in attempts, security challenge): Art. 6 para. 1 point (f) GDPR and Art. 32 GDPR.
• E-mails (invitations, confirmation and password links, requests between parents and physicians): Art. 6 para. 1 point (b) GDPR.

You can withdraw your consent at any time with effect for the future – by deleting your child's pass or your account in the portal, or by e-mail to the address given above. The lawfulness of the processing carried out until the withdrawal remains unaffected.

6. Who sees the data

• A child's pass can be seen only by the person who created it, further carers whose request this person has confirmed, and the physicians whom the parents have selected or whose request they have confirmed. Parents can end any physician's access at any time.
• The answers in the stress questionnaire are visible only to the person who answered it and to the assigned physician – not to the other parent.
• Physicians gain access only after verification by the controller and see only the children assigned to them.
• Processor: Operation (web server, database, e-mail dispatch) is carried out by easyname GmbH in Austria on the basis of a data processing agreement pursuant to Art. 28 GDPR.
• There is no disclosure to other third parties, no transfer to countries outside the EU or the EEA, no advertising and no profiling. There is no automated decision-making within the meaning of Art. 22 GDPR.

7. Retention period

• A child's pass, entries and access log: until the pass is deleted. If the only carer deletes their account, the pass is deleted with all entries; if there are further confirmed carers, it remains available to them.
• Accounts of parents and physicians: until deletion by the account holder (My account → Delete account) or on request.
• Invitation and password links: seven days and two hours respectively, after which they are invalid.
• Records of failed log-in attempts: one day, with the IP address kept only as an encrypted check value.
• Statutory retention obligations of physicians for their own documentation remain unaffected; they concern the records held in their practice.

8. Security

The connection is encrypted throughout with TLS. Social security numbers and all entries on the examinations are encrypted in the database with AES-256-GCM; the key is not stored in the database. A session ends after 30 minutes of inactivity. The portal sets only one technically necessary session cookie and does not integrate any analytics, tracking or advertising services.

9. Obligation to provide data

Use is voluntary. Without log-in, social security number and consent, however, the Eltern-Kind-Pass cannot be maintained, because the child could otherwise not be assigned clearly and securely. Answering the stress questionnaire is voluntary in every case; any question may be left blank.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21), as well as the right to withdraw consent at any time (Art. 7 para. 3). To do so, contact info@kinderarzt.net.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

As of 29 September 2026