Privacy Notice

Log data

Each time you visit our website, our system automatically collects the following data from the visiting device and stores it in a so-called log file: (i) name of the file accessed, (ii) date and time of the visit, (iii) amount of data transferred, (iv) notification of successful retrieval, type of browser and version used, (v) IP address (identification of the user's device), (vi) operating system of the visiting device, (vii) Internet service provider of the visiting device, (viii) website from which you access our website, and (ix) which pages of our website you access. The legal basis, if needed, for this processing is our legitimate interest.

Hosting

The hosting services used by us for the purpose of operating our website is hosttech GmbH, Richterswil, Switzerland. In doing so hosttech, processes inventory data, contact data, content data, usage data, meta data and communication data of customers, interested parties and visitors of our website and services, on the basis of our legitimate interests in an efficient and secure provision of the website and services in conjunction with the provision of contractual services and the conclusion of the contract for our services. The data itself is hosted by Amazon Web Services, Inc. (USA), but agreed that data processing will take place in Switzerland. If personal data is nevertheless processed in so-called third countries (in particular by Amazon Web Services, Inc., USA), the EU standard contractual clauses apply and/or the transfer takes place under the Data Privacy Framework programme (https://www.dataprivacyframework.gov).

Content Management System

We use the Content Management System (CMS) of WordPress by Automattic Inc to publish and maintain the created and edited content and texts on our website. This means that all content and texts submitted to us is transferred to WordPress. This represents a legitimate interest.

Content Delivery Network

We also use the Content Delivery Network (CDN) of WordPress by Automattic Inc to distribute our online content. Our CDN is a network of regionally distributed servers operated by our technical service providers that are interconnected via the Internet. When you visit our website, your device's browser transmits information to these service providers, which is collected in corresponding server log files. The server log files are usually anonymized and then transmitted without personal reference. The server log files include in particular i) information on the browser and operating system used, ii) the previously visited pages (so-called referral URL), iii) the IP address of the device used, iv) the name of the Internet provider, and v) the date, time of all page views including the amount of data transferred. The legal basis for the processing is our legitimate interest.

Cookies

We use so-called cookies on our website. Cookies are pieces of information that are transmitted from our web server or third-party web servers to your web browser and stored there for later retrieval. Cookies may be small files or other types of information storage. There are different types of cookies: i) Essential Cookies. Essential cookies are cookies to provide a correct and user-friendly website; and ii) Non-essential Cookies. Non-essential Cookies are any cookies that do not fall within the definition of essential cookies, such as cookies used to analyze your behavior on a website ("analytical" cookies) or cookies used to display advertisements to you ("advertising" cookies).

For further information on the cookies we use, please refer to our Cookie Policy. The legal basis for processing is our legitimate interest and your consent.

Cookie consent

Our website uses a cookie consent tool to obtain your consent to the storage of cookies and to document this consent. When you enter our website, the following Personal Data is transferred to us: a) Your consent(s) or revocation of your consent(s); b) Your IP address; c) Information about your browser; d) Information about your device; d) Time of your visit to our website. The basis for processing is our legitimate interest and your consent.

Third-party services and content

We use content or service offers of third-party providers on the basis of our legitimate interests in order to integrate their content and services ("services").

This always requires that the third-party providers of this content are aware of the IP address of the user, as without the IP address they would not be able to send the content to their browser. The IP address is therefore necessary for the display of this content.

The following provides an overview of third-party providers and their content, together with links to their privacy policies, which contain further information on the processing of data and so-called opt-out measures, if any,

• Analytics: Google Analytics by Google LLC,
• Tag Management: Google Tag Manager and Google Site Tag by Google LLC,
• Remarketing and Advertising; by Google Ads by Google LLC,

If you do not wish to participate in our advertising personalisation or retargeting/tracking you can object to behavioral advertising at the following websites: Your Online Choices, Digital Advertising Alliance of Canada, Network Advertising Initiative or AdChoices.

Contact

The processing of personal data depends on the nature of your contact. In addition to your name and email address, IP address or phone number, we usually collect the context of your message, which may also contain certain personal data. The personal data collected when you contact us is used to process your request, and the legal basis, if needed, the performance of a contract or to take steps at the request of the data subject prior to entering into a contract.

We also offer to contact us via the messaging services of WhatsApp. If you contact us via WhatsApp we store and use the mobile phone number, you use and - if provided - your first and last name in accordance with the provision of a contractual or pre-contractual measure to process and respond to your request.

We are present on social media and process data about you in this context. We receive data from you (e.g. when you communicate with us or comment on our content) and from the platforms (e.g. statistics). The social media providers can analyse your use and process this data together with other data they have about you. They also process this data for their own purposes (e.g. for marketing and market research purposes and to administer their platforms) and act as separate controllers in doing so. For more information about processing by the social media operators, please refer to the privacy policies of the respective platforms:

• Facebook: www.facebook.com/privacy/policy
• Instagram: privacycenter.instagram.com/policy
• LinkedIn: linkedin.com/legal/privacy-policy
• Reddit: reddit.com/policies/privacy-policy
• Medium: policy.medium.com/medium-privacy-policy

The legal basis, if needed, for our social media presence is our legitimate interest in marketing our services.

Onboarding

We process your first name, last name, e-mail address, and the data related to your contract with us data to handle the contractual relationship between you and us. We also require you verify your email account and send you a verification code per email. The data provided will be used for the purposes of creating and using the account and providing and/or using our services. This processing is necessary for the performance the contract with you or in order to take steps at your request prior to entering into a contract.

Profile

As a registered user, you have the opportunity to create a user profile with just a few clicks and details. Of course, you can change the information at any time via the settings in your profile. The legal basis for the processing of your Personal Data is the establishment and implementation of the user contract for the use of the service. If you enter data that we do not require for contract processing, you do so voluntarily and we therefore process this data with your consent.

Second opinion (including Health data)

We process various data in the context of the provision of our services, issuing a second opinion and for the initiation and execution of the contractual relationship existing between you and us.

If you have contracted us to provide a service, we process your data (if provided: Name, contact details (email address and telephone number), address, and all information required in the context of the performance of the services including health data exclusively for the purpose of processing and handling the contractual relationship. Such processing of health data is necessary for medical diagnosis and the provision of health treatment.

For data management and customer support, we store the data related to your contract with us in our customer relationship management system InOne Health provided by Swisscom Health (Swisscom (Schweiz) AG). PACSonWEB is our Picture Archiving and Communication System – the system used to transfer, store and make medical images (MRI, CT, X-ray) available for diagnosis. The data is hosted by Swisscom. We have concluded a data processing agreement with the software operator, DH Healthcare GmbH, as well as with Schenk Röntgenbedarf AG, the distributor of PACSonWEB.

This data processing is necessary for diagnostics and the performance of the contract with you. It is also carried out in our legitimate interest in providing our customer service.

Financial Accounting and Payments

Payments are processed via the payment service provider Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). The Stripe forms are opened in a separate browser tab or window. Stripe collects the following personal data: IP-address and browser data, Unique ID of the user (this is to identify the user between us and Stripe), name of the cardholder, Country, credit card details, date and time of the transaction, transaction amount, name of the provider. Stripe assumes a dual role as controller and as our processor. As the controller, Stripe uses your transmitted data to fulfil regulatory obligations. We have no influence on this process. We have concluded a data processing agreement with Stripe. The Data Privacy Framework Programm (https://www.dataprivacyframework.gov) applies and/or EU standard contractual clauses (SCCs) are used for international transfers, namely to Stripe Inc, San Francisco, California, USA. Further information on data processing can be found at: https://stripe.com/privacy-center/legal

When payments are made between us, names/company names, addresses and account details are also processed by our bank, our external accountant and the cloud provider Bexio AG. Our accounting records may also be processed by external auditors. This data is stored for 10 years. The processing serves, on the one hand, to fulfil legal obligations (e.g. accounting, payment of taxes) and, on the other hand, to execute the contract with you.

Payment Data

If you make a purchase your payment will be processed via our payment service provider. Payment data will solely be processed through our payment service provider and we have no access to any Payment Data you may submit. This processing is necessary for the performance the contract.

Marketing

If you have given us your separate consent to process your data (usually contact data) for marketing and promotional purposes, we are entitled to contact you for these purposes through the communication channels for which you have given your consent.

You may give us your consent in a variety of ways, such as by checking a box on a form asking for permission to send you marketing information, or sometimes your consent is implied from your interactions or contractual relationship with us. In cases where your consent is implied, it is based on the assumption that you could reasonably expect to receive a marketing communication based on your interactions or contractual relationship with us.

Direct marketing is typically by email, but may include other less traditional or new channels. These forms of contact are managed by us or by our contracted service providers. Any direct addressed marketing sent or conducted by us or on our behalf will provide you with the opportunity to opt out.

IT providers

The personal or secondary data communicated to us by e-mail or telephone/video conference are also processed by the corresponding providers. The electronically stored data is also processed by our computer server provider. Our external IT service provider may also have access to personal data. These data processing operations are generally carried out in Switzerland. It may happen that a service provider, in particular its employees, obtains knowledge of personal data outside Switzerland and also outside the EU/EEA. If, exceptionally, data is transferred to countries that do not have adequate data protection, this is performed under standard data protection clauses and/or the Data Privacy Framework programme applies (https://www.dataprivacyframework.gov).

How long will my data be stored?

To the extent necessary, we process and store your personal data for the duration of our business relationship, which includes, for example, the initiation and execution of a contract as well as until the expiry of the relevant limitation periods for asserting claims. Medical data and related contractual data is stored for 20 years. Accounting data is stored for 10 years. Log files are stored for no longer than 12 months.