data-protection-declaration

Controller

What data we process

In the course of our work as a specialist medical service and in operating this website, we process the following categories of personal data:

Website usage data: When you visit our site, technical connection data is recorded — in particular your IP address, browser type and version, operating system, the pages you visit, the date and time of access, and the referring page. This data is stored in server log files and serves to ensure secure operation.

Contact data: If you contact us via a contact form or by e-mail, we process the details you provide, such as your name, e-mail address and the content of your message.

Appointment booking data: When you book an appointment online, we record in particular your name, contact details and information about the appointment requested.

Payment data: When you book a consultation, a deposit is processed through our payment service provider. This involves, in particular, your name, e-mail address, means of payment and transaction-related data.

Health data: In connection with the preparation and conduct of the consultation, when contacting us through our website and via the patient forms we provide, you may share information about your state of health with us — in particular medical history, laboratory values and symptoms. Such data is classified as sensitive personal data and is treated with heightened care.

The purposes for which we process data

• Operating and technically securing our website
• Answering your enquiries submitted via contact forms or e-mail
• Arranging and administering appointments
• Processing payment for booked consultations
• Preparing, conducting and following up the medical online consultation
• Analysing website usage, where you have given your consent
• Meeting statutory and contractual obligations

Principles of data processing

We process your personal data to the extent necessary for communicating with you, arranging appointments, processing payment, providing medical treatment, meeting statutory obligations and operating our website securely. Where individual processing activities require consent, we obtain it separately.

Patient data is disclosed to third parties only with your consent, on a statutory basis, or where we have been released from professional secrecy under Article 321 of the Swiss Criminal Code.

Who we may disclose data to

• Laboratories and external diagnostic providers
• Referring or subsequently treating specialists and hospitals
• Health insurers and other payers
• IT and hosting providers
• Authorities, where a statutory obligation exists

Disclosure takes place only to the extent necessary and in compliance with the applicable legal requirements.

Transfer abroad

As a rule, your data is processed and stored in Switzerland. Some of the service providers we use — namely Cloudflare, Google, Zoom and Stripe — may process data in countries that do not offer an equivalent level of data protection. In such cases we ensure through appropriate contractual and organisational safeguards that your data remains adequately protected.

How long we retain data

We retain personal data only for as long as the respective purpose requires or statutory retention periods demand. Medical records are subject to cantonal retention rules, generally at least ten years. Once the applicable periods have expired, the data is deleted or anonymised.

Services used on this website

Hosting (Infomaniak)

This website is hosted by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Geneva, Switzerland. Infomaniak operates its data centres in Switzerland. Technical connection data is recorded in server log files each time a page is accessed. Further information: Infomaniak privacy policy.

Security and performance (Cloudflare)

To protect against cyberattacks and to accelerate page delivery, we use Cloudflare, Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. Traffic between your browser and our server is routed through the Cloudflare network. Cloudflare may temporarily process your IP address. Further information: Cloudflare privacy policy.

Content management system (WordPress)

This website is built on WordPress. In regular operation, the system processes technical connection data on our own server at Infomaniak.

Web analytics (Google Analytics)

Where you have given your consent in the cookie notice, we use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service uses cookies and collects information about your use of the website, in particular a truncated IP address, the pages you visit, time spent and the referring page. This data may be transmitted to Google servers in the United States. You can withdraw your consent at any time via the cookie settings. Further information: Google privacy policy.

Fonts (Google Fonts)

Google Fonts, a service provided by Google Ireland Limited, is used to display typefaces. When a page loads, your browser establishes a connection to Google servers, transmitting your IP address. Further information: Google privacy policy.

Contact forms (WPForms)

The contact forms on this website are operated using the WPForms plugin. The data you enter is processed on our own systems as a matter of principle. It is disclosed only where technically necessary or legally permissible.

Maps (Google Maps)

Google Maps is embedded on individual pages. When you open these pages, a connection to Google servers is established and technical data — in particular your IP address — is transmitted to Google. If you are logged in to a Google account, this data may be associated with your account.

Online appointment booking (Calendly)

For online appointment booking we use Calendly, Calendly LLC, 271 17th St NW, Suite 1000, Atlanta, GA 30363, USA. When you book, the data you enter — in particular your name, contact details and appointment information — is transmitted to Calendly. Calendly acts as a processor. Further information: Calendly privacy policy.

Patient forms (arzt-direkt)

To collect patient forms, in particular medical history information, we use arzt-direkt, Zollsoft GmbH, Vor dem Kreuzberg 28, 72070 Tübingen, Germany. The data you enter, including health data, is transmitted to arzt-direkt. Zollsoft acts as a processor. Where health data is concerned, processing is based on your consent. Further information: arzt-direkt privacy policy.

Payment processing (Stripe)

To process the deposit we use Stripe, Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, with its group headquarters in the United States. When you make a payment, the necessary data — namely your name, e-mail address, means of payment and transaction-related details — is transmitted directly to Stripe. Stripe acts as an independent controller. Further information: Stripe privacy policy.

Online consultation (Zoom)

Medical consultations are conducted as video consultations via Zoom, Zoom Video Communications Inc., 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. This involves processing technical connection data as well as the content exchanged during the conversation — video, audio and chat. Zoom acts as a processor. We do not record consultations. Further information: Zoom privacy policy.

Encrypted e-mail (HIN)

To transmit sensitive data we use the Swiss service HIN, Health Info Net AG, Pflanzschulstrasse 3, 8400 Winterthur, Switzerland. HIN enables end-to-end encrypted e-mail communication and acts as a processor. Further information: HIN privacy policy.

Cookies

Our website uses technically necessary cookies to ensure that the site functions. These are permitted without consent.

In addition, we use cookies for web analytics. These are set only once you have given your consent in the cookie notice. You can change or withdraw your choice at any time via the cookie settings in the footer. You can also prevent cookies from being stored in your browser; this may limit the functionality of the website.

Encryption

Data is transmitted between your browser and our website over an SSL or TLS encrypted connection, indicated by “https://” in the address bar. For sensitive data sent by e-mail we use HIN. Please note that unencrypted e-mail can carry security risks.

Your rights

Under the Swiss Federal Act on Data Protection you have, in particular, the following rights:

• Access: You may request information about whether and which personal data concerning you we process.
• Rectification: You may request that inaccurate data be corrected.
• Erasure: Under certain conditions you may request the deletion of your data.
• Data portability: You may request your data in a common electronic format.
• Objection: Under certain conditions you may object to processing.
• Withdrawal: You may withdraw consent you have given at any time with effect for the future.

To exercise your rights, please contact the controller named at the beginning of this policy.

If you wish to lodge a complaint, you may contact the Federal Data Protection and Information Commissioner: www.edoeb.admin.ch.

Changes

This privacy policy may be amended at any time. The version published on this website at the relevant time applies.