Skip to main content
Tervisekassa in Begin Tervisekassa in Begin Begin OÜ (registry code 12100876) is an X-tee member and a data-service intermediary. Its subsystem EE/COM/12100876/begin carries Tervisekassa’s employer services for the companies that use Begin. This page is Begin’s intermediation procedure, published under §5.4.6.1 of the X-tee joining contract. It states on what basis Begin intermediates, how it authenticates and authorises the people who use the services through Begin, how it protects the data it receives, and how the resulting logs are archived and kept. Last updated: 27 September 2026.

​
The basis for intermediating

Begin intermediates two Tervisekassa services, both in the kirst subsystem: Tervisekassa has opened both to Begin’s subsystem. Each employer Begin acts for grants Begin a mandate on eesti.ee — Volitused → Tervisekassa alamplokk → Tööandja X-tee teenused, to registry code 12100876. Without that mandate Begin has no right to act for the employer. Every employer is also Begin’s client under Begin’s terms of service, accepted when their workspace is created. The employer a request concerns travels in the request itself. Begin reads it from the workspace that holds the company registry code. One number belongs to one workspace at a time, shared by Tervisekassa and TÖR: saving the number claims it when no other workspace holds it. A claim gives no access. Before either integration can connect, Begin staff verify that the company approved that exact workspace. Connecting requires the verified claim as well as the government’s own mandate. Once a workspace is verified for a number, every other workspace is refused it. A claim nobody has verified does not stop another workspace saving the number, and Begin staff verifying that other workspace releases it.

​
Who may use the services through Begin

A person reaches these services only from inside their employer’s own Begin workspace, and only after passing four checks.
  1. Identity. They sign in to Begin with a verified email address or phone number, by one-time code, or with a passkey.
  2. Membership. The sign-in resolves to one workspace. A person who is not a member of that workspace has no route to its data.
  3. Permission. Their role in that workspace must carry the Manage integrations permission, checked when connecting the integration, mapping certificate types, and sending the employer’s part.
  4. Employer verification. The company comes from the current binding Begin staff verified. Begin checks that binding before dispatch and before applying an asynchronous response. A successful API response does not establish the workspace’s authority.
Sending the employer’s part carries one more requirement: the personal identification code of the person sending it, in the X-tee userId header. Tervisekassa has required it since 15 September 2025. Begin refuses to send when that code is missing from the person’s profile or fails its checksum, so every submission includes a structurally valid personal code from that profile. An employer ends the intermediation by disconnecting the integration in Begin, or by withdrawing the eesti.ee mandate. Disconnecting stops the queries — the next scheduled query and every one after it. Deleting the workspace stops them as well. A request already sent cannot be recalled. Disconnecting does not release the company number or revoke the mandate on eesti.ee. The number moves only when the employer changes it in workspace settings with both government integrations disconnected, when the workspace holding it has been deleted and another workspace claims it, or when Begin staff verify another workspace for a number whose claim nobody has verified. Connection errors, empty results and lost external permissions do not release it. Begin staff revoking a verification disconnects both integrations; the number stays with the workspace, unverified, until staff verify that workspace or another one for it.

​
Logs of authentication and authorisation

Begin records every act that authorises a Tervisekassa query, in the workspace’s own audit log:
  • connecting and disconnecting the integration, and who did it;
  • claiming or releasing the company registration number;
  • Begin staff verifying or revoking the company;
  • recording or withdrawing the eesti.ee mandate confirmation;
  • changing which certificate type becomes which absence;
  • sending the employer’s part — naming the person, the certificate and the figures sent.
Archiving. These entries are not moved to a separate archive. They stay in the workspace’s own audit log, in Begin’s production database, where the employer reads them; the database is backed up as a whole, and a restore restores the log with everything else. There is no export step, no archive medium and no separate archive to request access to — the live log is the archive. Retention. These entries are kept for as long as the workspace exists and are removed with it. When a person’s record is erased, at their request or their employer’s, their personal data is removed from the entries their acts left behind; the entry itself survives without it, because an audit trail that can be emptied is not an audit trail. An employer reads its own audit log in Begin, subject to its plan. Begin’s application logs, which record the outcome of each scheduled query, are kept for the retention period of Begin’s hosting platform and are shorter lived. They are operational records, not the authorisation record. The ledger of company-number claims is kept after workspace deletion as the record of which workspace held which number. A deleted workspace’s claim no longer blocks the number: the next workspace to claim it takes it. The ledger holds company and workspace identifiers, who claimed, verified, revoked or released the number and when. The representative’s identity documents stay with Begin support, not in the ledger.

​
Logs of X-tee queries

Every message between Begin and Tervisekassa passes through Begin’s security server, operated on Begin’s behalf by Novian Eesti OÜ. The server’s message log is the authoritative record of each query and each response, and it is signed. Begin keeps no separate copy of it. Archiving. The security server operator packages and exports the message log once an hour, and removes the archived messages from the security server itself after one day. The exported archive is held by the operator: backed up four times a day, copied monthly to an archive medium, and copied again to a second archive medium for long-term storage. Retention. The security server operator keeps the archived message log for four years. Access to the archive. A request to read the archive from Tervisekassa, from RIA or from a supervisory authority is addressed to Begin at support@begin.eu; Begin obtains the records from the security server operator. An employer may ask for the records of its own queries on the same route. Only the operator’s own staff handle the archive, and the operator provides the records that answer the request rather than releasing a whole message log. Retrieving them takes the operator time to process, so no fixed turnaround is stated here. The archiving procedure, the retention period and the access route above describe what the security server operator does at the time of writing, as the operator states it. The operator may change them, and Begin updates this page when it does. Begin also holds, per certificate, the outcome of the query that fetched it: when it was last synchronised, and whether the employer’s part was sent and by whom. That record lives with the certificate and is deleted with it. The audit log entry for sending the employer’s part stays in the workspace’s audit log, as described above.

​
Data protection

Roles. The employer is the controller: it decides to connect the service and holds the statutory duty the data serves. Begin OÜ is the processor and acts on the employer’s documented instructions under Article 28 GDPR. Tervisekassa is a separate controller of its own register. Begin’s sub-processors for this processing are Novian Eesti OÜ, which operates the security server the messages pass through, and Convex, which hosts Begin’s production database. Notices about a certificate reach the people who manage integrations inside Begin only, never by email. Purpose and legal basis. The processing lets the employer meet its duty under Estonian health-insurance law to supplement a closed certificate within seven days, and records the absence on the schedule. The employer’s basis is Article 6(1)(c) GDPR, a legal obligation, with Article 9(2)(b) permitting the health data involved. What Begin receives. For each certificate: its kind, its reason code, its period, when it was opened and closed, its status, its number and Tervisekassa’s identifier for it, and the employee’s name and personal identification code. Tervisekassa’s answer also carries fields Begin does not keep, such as the doctor’s conditions for lighter duty and any breach of the treatment regime; Begin’s application discards them when it reads the answer. Like every message, the full answer stays in the security server’s archived message log for its retention period. Begin fetches only certificates that are open or waiting for the employer’s part. No diagnosis is fetched, sent or stored, and the service does not offer one. Begin still treats the whole record as health data, because the kind and the reason code describe health. What Begin sends. For the employer’s part: the certificate it answers; the pay figures the employer enters; how the person actually worked during the certificate, any lighter-duty period and any period with no right to benefit, with its reason; a contact name, phone number and email address when the employer gives one; and the personal identification code of the person sending it. Who sees what. The certificate itself stays behind the Manage integrations permission. The absence it books is shown like any other time off. A colleague without the View others’ time-off details permission sees only that the person is away, unless the employer has turned on Show the leave type to colleagues for that absence type. The reason code reaches the absence, where people holding View others’ time-off details see it on the schedule and in reports. The absence’s history records that it came from Tervisekassa, and anyone who can open the absence sees that entry, even where the leave type is hidden. The employee’s name and personal identification code are encrypted at rest, separately for each workspace. Retention. Begin keeps a settled certificate for seven years from 31 December of the year its period ends in, the period Raamatupidamise seadus § 12 sets for the employer’s accounting records. A certificate that is still open, or still waiting for the employer’s part, stays until it settles. The reason code is removed from Begin’s copy of the certificate once Tervisekassa takes the case over or closes it. When the last certificate of a case reaches the end of that period and is deleted, the reason code is removed from the absence and the time-off request it was copied to as well. When an employer deletes its Begin account, Begin erases that employer’s certificates after a recovery period of 90 days; the employer takes any records it must keep before then. Where the data is kept. Begin’s production database is hosted in the EU, on AWS in Ireland. The security server is in Estonia. Data subjects’ rights. An employee exercises their rights through the employer, which is the controller. Begin forwards any request it receives to the employer. When the employer removes a person from Begin, their certificates are deleted at the end of the 90-day recovery period. When a person asks for their data to be removed and the employer must keep their employment records, Begin removes the name and personal identification code from their certificates instead. The certificate’s kind, dates, number and payroll details remain until the retention period ends; they can still be linked to the person through the employer’s other records, so they stay personal data. A wrong certificate is corrected by the doctor at Tervisekassa, and Begin fetches the corrected one.

​
Contact

Begin keeps a register of the clients whose Tervisekassa queries it intermediates and provides it to Tervisekassa on request. For anything about this procedure, write to support@begin.eu.