(1) The insurer may only acquire personal health-related data from doctors, hospitals and other health institutions, care homes and nursing staff, other insurers of persons and statutory health insurers, as well as social insurance providers for occupational accidents and public authorities; this is only permissible insofar as the knowledge of the data is necessary to assess the risk to be insured, or the liability, and the affected person has given his or her consent.
(2) The consent required in accordance with subsection (1) may be given prior to the submission of the contractual acceptance. The affected person is informed prior to the data referred to in subsection (1) being acquired; he or she may object to the data being acquired.
(3) The affected person may demand at any time that the data only be acquired if his or her consent has been given in each individual case.
(4) The affected person is notified of these rights, and is notified of the right to object in accordance with subsection (2) when being instructed.