Hallo Marco Hallo Marco

Addendum for professional secrecy holders

Addendum to the contract for Hallo Marco and to the data processing agreement between the customer who is subject to a professional duty of confidentiality ("secrecy holder") and Bavarian Valley UG (haftungsbeschränkt), Passauer Str. 21, 81369 Munich, Germany ("Bavarian Valley", "we"). Version 1.2, as of 27 October 2026.

This English text is a translation for convenience. Only the German version at hallomarco.de/berufsgeheimnis is legally binding.

The addendum is concluded in text form (§ 126b German Civil Code, BGB): the secrecy holder accepts it in the application, we store the version, time and person and send the secrecy holder the text of the addendum with our confirmation by email. On request, we also sign it.

1. Purpose and scope

  1. This addendum applies to customers who are obliged to keep third-party secrets confidential, in particular under § 203(1) of the German Criminal Code (StGB): for example doctors, dentists, psychotherapists, pharmacists and members of other health professions, lawyers, patent attorneys, notaries, tax advisers, auditors and sworn accountants, and their professional assistants.
  2. When Marco answers calls or replies to messages for the secrecy holder, we may learn secrets entrusted to the secrecy holder, for example that someone is a patient or client, and the reason for their request. We thereby assist in the professional activity of the secrecy holder (other assisting person within the meaning of § 203(3) sentence 2 StGB).
  3. This addendum is intended to enable the secrecy holder to fulfil its obligations under § 203(3) and (4) StGB and its professional law, in particular § 43e of the Federal Lawyers' Act (BRAO), § 39c of the Patent Attorneys' Act (PAO), § 26a of the Federal Notaries' Act (BNotO), § 62a of the Tax Advisers' Act (StBerG), § 50a of the Public Accountants' Act (WPO) and § 9 of the (Model) Professional Code for Doctors in the version applicable to the secrecy holder.

2. Obligation of confidentiality

  1. We undertake to keep secret all third-party secrets that become known to us when providing the service. The obligation applies without time limit, also after the end of the contract.
  2. We obtain knowledge of third-party secrets only to the extent necessary to provide the service. Our staff only view conversation content where necessary for setup, support, troubleshooting or at the secrecy holder's request; every access is logged.
  3. We do not use the secrets for our own purposes and only pass them on where necessary for the service under section 4 or where the secrecy holder agrees.

3. Information on the criminal consequences

The secrecy holder informs us, and we acknowledge:

  • Anyone who, as an assisting person, discloses without authorisation a third-party secret that became known to them in the course of or on the occasion of their activity is liable to prosecution under § 203(4) sentence 1 StGB. The offence is punishable by imprisonment of up to one year or a fine; if committed for payment or with the intention of enrichment or causing harm, under § 203(6) StGB by imprisonment of up to two years or a fine. Using a third-party secret without authorisation is punishable under § 204 StGB.
  • Under § 203(4) sentence 2 no. 2 StGB, an assisting person who uses a further assisting person without having ensured that this person was bound to secrecy is also liable to prosecution if that person discloses a secret without authorisation.
  • As an assisting person, we may have a right to refuse to testify under § 53a of the German Code of Criminal Procedure (StPO); the secrecy holder decides on its exercise.

4. Use of further service providers

  1. The secrecy holder agrees that we use the sub-processors named in Annex 2 to the data processing agreement, as far as they are needed for the features it uses. For new or changed sub-processors, section 8 of the data processing agreement applies.
  2. We bind people we use to confidentiality in text form and inform them of the criminal consequences of a breach. For sub-processors who may take note of secrets, we ensure a contractual obligation of confidentiality. Large providers use standard contract terms for this (confidentiality clauses in their data processing agreements) that do not contain an express reference to German criminal law; we point out the confidentiality of the data to them where possible.
  3. Some processing steps take place outside the EU, in particular in the USA (AI language model, parts of speech recognition and speech output; WhatsApp and SMS where switched on). Under § 43e(4) BRAO, § 62a(4) StBerG and comparable rules, secrecy holders may only give service providers abroad access to secrets if the protection of secrets there is comparable to the protection in Germany, unless the protection of the secrets does not require this. This assessment is the secrecy holder's responsibility. We provide it with the information in Annex 2 and, on request, the contract terms of the providers.

5. Recommended settings

For secrecy holders, the industry templates are preset to: no recording of calls and no WhatsApp. We also recommend:

  • a short retention period (30 days),
  • asking only for the information needed for the callback or appointment in request types, and no details of complaints, diagnoses or legal questions,
  • defining blocked topics Marco does not talk about, such as medical or legal assessments,
  • having emails only drafted for approval and not loading patient or client files into the knowledge,
  • sending notifications only to people who are themselves bound to confidentiality.

The secrecy holder decides on its settings itself and remains responsible for ensuring that the use is compatible with its professional law.

6. Requests from authorities and courts

If an authority or court requests data of the secrecy holder from us, we inform the secrecy holder without undue delay, as far as legally permitted, and only hand over data if we are obliged to. We point out any exemption from seizure and any right to refuse to testify.

7. Term and precedence

  1. This addendum applies for the term of the contract for Hallo Marco. The obligation of confidentiality continues beyond that without time limit.
  2. It takes precedence over the data processing agreement and the terms with regard to the protection of secrets. German law applies. The German version prevails.