Data Protection at BodyLab GmbH
Here you will find everything about what we know about you, or rather what we need to know: when and where we record which of your data, what we do with this data, how we process it, who we have to disclose it to, when we delete it, and what you can do about it. We, BodyLab GmbH, including any of our affiliated companies and subsidiaries (hereinafter also "we" or "us"), take data protection very seriously. We try to collect as little personal data as possible—only what can actually be used to provide our services and run our business operations—and avoid anything unnecessary.
1. What is this about?
We, BodyLab GmbH, based in Zurich, Switzerland,
respect the applicable legal data protection provisions;
collect and process personal data (hereinafter also "data") in accordance with this Privacy Policy;
generally observe the principle of necessity, meaning we only collect and process as much data as is necessary for the purpose of fulfilling our services.
In the course of our business activities, we obtain and process data, in particular personal data about people interested in our work, our clients, related parties, visitors to our websites, participants at events, job applicants, recipients of newsletters or other publications, and other third parties (hereinafter also "you").
In addition to this Privacy Policy, we may inform you separately about the processing of your data (e.g., in forms or contract terms).
If you provide us with data about other people, we assume that you are authorized to do so, that this data is accurate, and that you have ensured these individuals are informed about this disclosure to the extent a legal obligation to inform applies (e.g., by bringing this Privacy Policy to their attention beforehand).
Please find out directly from the respective providers about their offers, terms, and how they handle personal data (such as third-party websites and social media), even if they are linked here.
2. Who is responsible?
The controller responsible under data protection law for the processing operations described in this Privacy Policy is:
BodyLab GmbH
Alex Schück, Albulastrasse 50, CH-8048 Zurich
Email datenschutz@bodylab.ch
3. Which law applies?
Our data processing is subject to Swiss data protection law.
For visitors residing in the European Union ("EU") and the European Economic Area ("EEA"): Switzerland and the EU, including the EEA, mutually recognize their data protection legislation as equivalent. In certain cross-border cases, EU law—in particular the EU General Data Protection Regulation ("GDPR")—may also apply complementarily to specific data processing operations.
We do not assume that the GDPR applies generally to data processing carried out by us. However, if the GDPR should exceptionally apply to specific processing activities, the following provisions apply additionally solely for the purposes of the GDPR and the data processing subject to it:
3.1. Details on the scope and applicability of the GDPR
Where the GDPR applies, we base the processing of your personal data in particular on the following grounds:
Necessity for the acquisition, conclusion, fulfillment, administration, and enforcement of contracts (Art. 6(1)(b) GDPR),
Necessity for the protection of legitimate interests pursued by us or third parties, e.g., to communicate with you or third parties, to operate our websites, to improve our electronic offerings and services, to register for specific offers and services, for security purposes, for compliance with law and internal regulations, for our risk management and corporate governance, and for other purposes such as training and education, administration, evidence and quality assurance, organizing, executing, and following up on events, and protecting other legitimate interests (Art. 6(1)(f) GDPR),
Legal obligation or legal permission based on our mandate or position under the law of the EU, EEA, or an EU member state (Art. 6(1)(c) GDPR), or necessity to protect your vital interests or those of other natural persons (Art. 6(1)(d) GDPR);
Your consent to processing, e.g., via a corresponding declaration on our websites (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
Furthermore, you then have all rights granted to you by the GDPR in this regard (alongside the practically equivalent rights under Swiss data protection law): You can request the following actions from us regarding your personal data that we store and process:
Information about it, pursuant to Art. 15 GDPR;
Rectification, to the extent the data is incorrect, pursuant to Art. 16 GDPR;
Erasure, pursuant to Art. 17 GDPR; or restriction of processing where it may not be deleted, pursuant to Art. 18 GDPR (in which case it will be marked to restrict future processing); both subject to overriding legitimate interests on our part or statutory obligations to retain and use the data;
Right to object to the use of your data; provided that no compelling grounds override this objection or that we do not need the data to exercise our rights;
Data portability of the data you provided to us based on your consent, pursuant to Art. 20 GDPR.
The right noted above to object to the processing of your data applies in particular to data processing for direct marketing purposes.
If you do not agree with how we handle your rights or data protection, please let us know (see contact details above). If you are located in the EEA, you also have the right to lodge a complaint with your country's data protection supervisory authority. You can find a list of EEA authorities here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_de#member-de.
4. What data do we store?
We primarily process personal data that we receive directly in the context of our contractual relationships with our clients and our activities with third parties, including you as users. In addition, we may receive, collect, or process data from business partners or other involved persons. To the extent permitted and necessary, we also obtain data from publicly available sources (such as public registers, media, internet) or receive data from our clients and their employees, from authorities, and third parties (such as business and contractual partners of our clients, medical institutions, physicians, healthcare staff, health insurers, etc.).
In addition to data we receive directly from you, the categories of personal data we receive from third parties include, but are not limited to:
Master data (e.g., names, addresses, roles, date of birth, organizational affiliation, etc.)
Contact details (e.g., email address, phone number, etc.)
Content data (e.g., text and image files, videos, etc.)
Usage data (e.g., access data)
Health data relevant to treatment (illnesses, accidents, insurance details, health insurer and insurance/claim numbers, biological sex, etc.)
Metadata/communication data (e.g., IP addresses)
Information you disclose to us yourself based on the contractual relationships between us
Information related to your professional functions and activities
Information about you in correspondence and discussions between us or with third parties (e.g., via phone, email, or other channels)
Information via configuration of your user settings, access rights for data, or other interactions with us
Information from public registers (debt enforcement registers, commercial registers, land registries)
Registration for or participation in an event
Information about you from media and the internet (where appropriate in individual cases), as well as references for applications.
Completion of questionnaires, support tickets, or other forms requesting information
If you do not provide us with certain personal data, this may mean we cannot deliver the associated services or conclude a contract. We always indicate which personal data is mandatory.
Information about you provided to us by people around you (family, advisors, legal representatives, etc.) so that we can conclude or fulfill contracts with you or involving you (e.g., references, your address for deliveries, powers of attorney)
5. Where does the data come from?
Data from you
You provide much of the data we process yourself (e.g., when using our website, in connection with our services for you, or when communicating with us). Some of this data is also automatically transmitted to us by your device. You are only required to disclose your data in exceptional cases. However, if you want to enter into contracts with us or use our services, for example, you must provide us with certain data. Using our website is also not possible without a minimum amount of data collection and data processing.
Data from third parties
We may also obtain data from publicly accessible sources (e.g., media or the internet, including social media platforms, public registers, online searches, etc.) or receive it from your treating physician, competent authorities, your employer or client who is in a business relationship with us or otherwise connected, as well as from other third parties (e.g., associations, contractual partners, health insurers, web analytics services). This includes in particular data we process in connection with patient care and treatment, as well as data from correspondence and further communication with third parties, but also all other data categories listed under section 4 "What data do we store?".
Data when communicating with you and on your behalf
Besides in-person meetings, phone calls, postal mail, and email, we use various other ways to communicate with you. We also use third-party software and tools (SaaS) for you and for the internal and third-party communication necessary for your treatment.
Use of AI services
We may use AI-powered services, such as Claude provided by Anthropic, to support internal administrative, organizational, and technical processes. The services currently used are listed below.
The use of AI-powered services occurs exclusively for supporting purposes, such as writing and editing texts, structuring content, general professional research without personal reference, and administrative assistance.
We do not enter any personal data into the service, especially no health data or other particularly sensitive personal data belonging to our patients.
Where data is processed within the scope of using AI-powered services, it is limited to anonymized or abstracted content, general professional questions without clear personal reference, and technical inputs necessary to use the service.
Usage complies with applicable data protection regulations as well as internal policies on data security and confidentiality. Content generated by the service is used purely as support and is reviewed by qualified specialist staff prior to any further use.
For more information on how the provider handles data, please refer to the privacy policy of the respective AI-powered service used.
Below you will find the main services we use:
Managing patient files: Medionline
We use the tool from Ärztekasse Medionline for entries related to patient visits. This applies to all administrative matters (appointments, schedule, time planning, patient visits themselves, patient records, etc.) and generally for all practice software purposes. All necessary documents are filed online and notes are recorded.
Provider: Ärztekasse Genossenschaft, In der Luberzen 1, 8902 Urdorf
Privacy policy: https://www.medionline.ch
Legal basis: Legitimate interest
2. Video calls
Service: Zoom
Provider: Zoom Video Communications, Inc., 55 Almaden Blvd, San Jose, CA 95113, USA
Privacy policy: https://www.zoom.com/en/trust/privacy/
Legal basis: Legitimate interest
Service: Microsoft Teams
Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA
Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement
Legal basis: Legitimate interest
Service: Apple FaceTime
Provider: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
Privacy policy: https://www.apple.com/chde/legal/privacy/
Legal basis: Legitimate interest
3. Microsoft Office 365
Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA
Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement
Legal basis: Legitimate interest
4. Cloud data services: Google Drive Services
Provider: Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Privacy policy: https://policies.google.com/privacy?hl=ch-DE
Legal basis: Legitimate interest
5. Cloud data services: Apple iCloud
Provider: Apple Inc., One Apple Park Way, Cupertino, CA, USA (headquarters); Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland (European branch, subsidiary)
Privacy policy: https://www.apple.com/chde/legal/privacy/
Legal basis: Legitimate interest
6. Newsletter: Brevo
Provider: Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, DE
Privacy policy: https://www.brevo.com/de/legal/privacypolicy/
Legal basis: Legitimate interest, including your right to unsubscribe at any time
7. Telephony: CTI Client
Provider: WWCOM, Schöngrund 26, 6343 Rotkreuz
Privacy policy: https://wwcom.ch/home/disclaimer
Legal basis: Legitimate interest
8. Telephone system: Nexphone
Provider: Nexphone AG, Alpenstrasse 1, 8803 Rüschlikon
Privacy policy: https://www.nexphone.ch/datenschutzerklaerung.html
Legal basis: Legitimate interest
9. Individual exercise app for patients: PhysiApp
Provider: Physitrack PLC, 140 Aldersgate Street, London, EC1A 4HY, United Kingdom
Privacy policy: https://www.physitrack.com/de/legal/privacy
Privacy and data handling for app users: https://www.physitrack.com/de/legal/physiapp
Legal basis: Legitimate interest, or your consent, which you can revoke at any time, though you will then no longer be able to use PhysiApp.
Note: BodyLab cannot influence the extent of data collected by Physitrack and its appointed sub-processors when using the app. You can find more details directly on Physitrack's website at https://www.physitrack.com/de/legal/physiapp and https://www.physitrack.com/de/legal/data-processing-agreement as well as https://www.physitrack.com/de/legal/data-retention.
10. AI-powered services: Claude
Provider: Anthropic, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA
Privacy policy: https://www.anthropic.com/privacy
Legal basis: Legitimate interest in designing internal work processes efficiently and using modern technologies to support administrative and specialized tasks.
Note: Claude is used in the Pro version and solely to support internal processes (e.g., text creation, content structuring, general research without personal reference). No personal data, in particular no health data or other particularly sensitive personal data, is entered into Claude.
To use the Claude AI service, it is technically necessary for data to be transmitted to servers of the provider Anthropic. Anthropic is a company based in the United States. Therefore, data transfer to a third country without an adequate level of data protection cannot be ruled out.
We cannot influence the extent of data collected and processed by Anthropic and any engaged sub-processors. Data transfer to the United States cannot be ruled out and is extremely likely. Through appropriate internal policies, we ensure that no sensitive or personal data is transmitted.
6. How is data processed and used?
Within our operations, we may process various categories of personal data for different purposes. In particular, we process the personal data about you mentioned in section 4 for the following purposes:
Communication
We process personal data so that we can communicate with you and with third parties via email, phone, letter, or other means. This can also take the form of newsletters and other regular contact (e.g., electronically, by mail, by phone). You can opt out of this communication at any time or refuse/revoke consent to it. In the context of communication, we process in particular the content and metadata of the communication as well as your contact details, but also image and audio recordings of (video) phone calls. In the event of an audio or video recording of the communication, we will alert you separately at the beginning, and you are free to tell us if you do not want a recording, or to end the communication / leave the call. If we need or want to verify your identity, we may collect additional data.
Activities related to contracts, services, and treatments
With a view to concluding a contract with you or your client/employer, we may process in particular your name, contact details, consent declarations, information about third parties (e.g., contact persons, third parties, project participants, etc.), contract contents, and any other data you provide to us or that we legally collect from public sources or third parties.
Contract administration and patient care
We process personal data so that we can fulfill our contractual obligations toward our contractual partners (e.g., suppliers, service providers, patients) and, in particular, provide and demand contractual services. This includes data processing for managing patient records and data processing for enforcing contracts, accounting, and communication—both with our patients and with third parties as well as publicly. For this purpose, we process in particular data we received or collected during client acquisition and contract conclusion, as well as data we generate within the scope of our contractual services or collect/receive from public sources or other third parties. This data includes, in particular, meeting notes, memos, internal and external correspondence, contract documents, third-party patient records, communications from healthcare institutions and physicians, documents we create and receive in connection with patient care, background information about you or other persons, image and sound recordings, as well as other patient-related information, documents, proofs of service, invoices, and financial and payment information. Where necessary for treatment, we may also collect and process particularly sensitive personal data during these activities. Otherwise, especially regarding the recording of master patient data, we follow the recommendations of the Swiss associations of osteopaths and physiotherapists. Where recommendations from these associations are missing, we mostly align with the recommendations of the FMH (Swiss Medical Association).
Security purposes, access controls, video surveillance
We process personal data to ensure and continuously improve the appropriate security of our IT and other infrastructure. This includes, for example, monitoring and controlling electronic access to our IT systems and entry to our premises, analyses and tests of our IT infrastructure, system and error checks, and creating backups.
For documentation and security purposes (both preventive and to resolve incidents), we also use surveillance systems ("System") on our premises, especially for our own security. We indicate the presence of surveillance systems to you at the respective locations using appropriate signs.
Although we use a video surveillance system in the generally accessible practice rooms, no recordings are made in individual treatment rooms. This ensures no compromising footage of our patients is created.
Personal data generated in recordings of our premises by the System is processed to protect people and property from potential attacks, theft, robbery, damage, vandalism, and similar offenses, and also serves fire safety, workplace safety, and the pursuit of our legitimate interests through evidence collection and further organizational requirements.
Collected recordings are not used to monitor activities carried out by employees, except to detect unlawful or fraudulent conduct subject to criminal penalties. In general, we have set up the System so that data collection and processing are minimized as much as possible, keeping potential risks for data subjects minimal. For example, using the System, we do not collect any statistical data from visitors, not even in anonymized form.
Recordings are made during normal opening hours as well as after closing and while premises are empty, for the reasons mentioned above.
The data is reviewed exclusively via electronic means by BodyLab's management and processed if necessary.
For video surveillance, we use software from the service provider Ubiquiti Networks. The data is stored physically on BodyLab's internal servers, which are accessible only via VPN or app using two-factor authentication.
Video surveillance recordings are kept for a maximum of 7 days and then deleted, unless they are required for special needs in connection with investigative activities or other statutory or permissible duties, such as work by the police or judiciary. Personal data is not disclosed or communicated to third parties, except for the necessities mentioned above.
Risk management and corporate governance
We process personal data within the framework of risk management and corporate governance. This includes, among other things, our business organization (e.g., resource planning, employee data) and corporate development.
Job applications
When you apply for a job with us, we process the relevant data to evaluate and assess the application, manage the application process, and, for successful applications, prepare and conclude an employment contract. In addition to your contact details and information from related communications, we process data contained in your application documents, criminal record extracts if applicable, and data we may additionally obtain about you, such as from professional social networks, the internet, media, and references (if you consent to obtaining references). Data processing relating to the employment relationship is governed separately.
Operation of our websites
To operate our website securely and stably, we collect technical data such as IP address, information about your device's operating system and settings, your region, time, and type of use. We also use cookies and similar technologies in part. You can find more information about this in the corresponding section below.
Improving our electronic services
To continuously improve our website and electronic offerings (e.g., newsletter), we collect data about your behavior and preferences, for example by analyzing how you navigate our websites and how you interact with our social media profiles and other electronic services (e.g., newsletter).
Registration
To use certain offers and services (e.g., newsletter), you must register. For this, we process the data you provide during registration. Furthermore, we may collect personal data about you while you use the offer or service. If necessary, we will provide you with further information on the processing of this data.
Data backup
To protect your data from loss and ensure data integrity, we create regular encrypted backup copies of all practice data. Data backups take place across multiple tiers:
Local backup on NAS within the practice premises.
All practice data is backed up regularly and in encrypted form on a Network Attached Storage (NAS) physically located in our practice premises. Access to this system is restricted to management and IT.Mirroring to an external NAS of the management.
To ensure availability even if local infrastructure fails, data backed up on the NAS within our practice is mirrored in encrypted form via a secure network connection (tunneling) to another external NAS owned by BodyLab's management. This system is also accessible exclusively to BodyLab's management and IT.Cloud backup on Synology C2.
In addition, password-protected backups are made to an external Synology server within the Synology Cloud using the Synology C2 Backup solution (https://c2.synology.com/de-de). Synology C2 uses server-side encryption and enables client-side encryption using private keys. Synology C2 data centers are certified according to ISO 27001 and SOC 2 Type II. A European data center (currently Germany) is chosen as the storage location. For more details on data security and privacy at Synology C2, see https://c2.synology.com/support.
The backup measures mentioned serve exclusively data security and business continuity purposes. External third parties have no insight into the backups. The legal basis for processing data within data backups is our legitimate interest in the availability, integrity, and recoverability of practice data in accordance with the requirements of Swiss data protection law (revFADP) and our statutory retention obligations.
Other purposes
Other purposes include, for example, training and educational purposes, as well as administrative purposes (such as accounting). In addition, we may process personal data to organize, carry out, and follow up on events, such as participant lists and contents of presentations and discussions, as well as image and audio recordings created during these events. Protecting other legitimate interests also forms part of other purposes that cannot be listed exhaustively.
7. What data is collected and processed when you visit our website?
General settings and internal guidelines
Nature and depth of data, links to service providers
Terms of use and privacy policies of the services we use may change continuously, along with the nature and depth of data collected by the service provider. For this reason, we do not list data potentially collected by each service in detail. However, we provide the relevant link to the privacy policy for each referenced service. We periodically review the links to these services and their privacy terms and strive to keep them up to date. Nevertheless, individual links may become outdated. If you come across an outdated link, please let us know immediately.
Selection of service providers, server locations, Data Privacy Framework
We generally aim to use service providers where data is stored in data centers in Switzerland or the EU, where selectable. Where data is stored in the US, on CDN servers (and thus globally), or in other countries, we choose providers from countries with an adequate level of data protection like Switzerland (for US providers, for example, those covered by the Swiss-U.S. Data Privacy Framework ["SDPF", https://www.dataprivacyframework.gov/]). For the US providers we use, almost all fall under the SDPF. You can view their compliance with the Privacy Framework or Swiss data protection via the search mask at https://www.dataprivacyframework.gov/list and check details via the available records at any time.
Data processors, DPA, SCC, level of protection
Where necessary, we have entered into a data processing agreement, usually based on EU Standard Contractual Clauses (Standard Contractual Clauses of the European Commission, "SCC"), or a Data Privacy Addendum ("DPA") with external data processors (or the latter is often made a legally binding part of the contract through the third-party provider's terms and conditions) to ensure adequate security. In these agreements, the provider typically guarantees to process personal data even outside Switzerland and the EU in accordance with the requirements and protection levels of Swiss and European data protection laws.
Within our company, only selected employees have access to such data according to the principle of necessity. All employees accessing personal data must comply with internal rules, processes, and any regulations regarding the processing of personal data to protect it and ensure its confidentiality.
Security, encryption (external)
We have taken appropriate technical and organizational security measures to protect your personal data collected when visiting the website against unauthorized, accidental, or unlawful use.
To protect the security of data transmission, we use standard encryption (e.g., SSL) via HTTPS.
Administration
We manage our website ourselves. CarigietSolutions, Männedorf, acts as the webmaster for our website on our behalf (www.carigiet-solution.ch).
Cookies
When using our websites (including newsletters), data is generated and stored in log files (particularly technical data). In addition, we may use cookies and similar technologies (e.g., pixel tags or fingerprints) to recognize website visitors, evaluate their behavior, and identify preferences. A cookie is a small file sent between your system and the server that enables recognition of a specific device or browser.
You can usually configure your browser to automatically reject, accept, or delete cookies. You can also deactivate or delete cookies individually, or decline cookies generally for our website. You can find instructions on how to manage cookies in your browser's help menu.
Neither the technical data we collect nor cookies generally contain personal data. However, personal data that we or third-party providers commissioned by us store about you (e.g., if you have a user account with these providers or are still logged into the third party's service while visiting our website) may be linked to technical data or information stored in and derived from cookies, and thus potentially to you personally.
Social networks
We do not currently use social media plugins (small software modules) that establish a direct connection between your visit to our websites and a third-party provider; instead, we only link to content on social media platforms.
A social media plugin informs the third party that you visited our websites and can send cookies that the provider previously placed on your web browser. You can find more information about how these third parties use your personal data collected via their social media plugins in their respective privacy policies.
In addition, we use our own tools and third-party services (which may themselves use cookies) on our websites, in particular to improve the functionality or content of our websites (e.g., embedding videos or maps), compile statistics, and run advertisements.
Personal data on our social network pages
We maintain online presences on social networks and other platforms operated by third parties and process data about you in this context. In doing so, we receive data from you (e.g., when you communicate with us or comment on our content) and from the platforms (e.g., statistics). The platform providers can analyze your usage and process this data together with other data they have about you. They also process this data for their own purposes (e.g., marketing and market research purposes and managing their platforms), acting as separate controllers for this purpose. For more details on processing by platform operators, please refer to the privacy policies of the respective platforms.
Third-party services used when visiting our website
1. Hosting, CMS, web design, search function, cookies
Provider: Framer B.V., Rozengracht, 1016 LZ Amsterdam, Netherlands ("Framer")
Privacy policy: https://www.framer.com/legal/privacy-statement/
Legal basis: Legitimate interest; you can adjust your consent to the various cookie categories before and during your visit to our website. Cookie Script is provided by the CMS Framer for running websites created with Framer.
2. Calendar features, appointment booking
We use OneDoc as an integrated tool for finding and scheduling appointments. Data exchanged via OneDoc is encrypted both during transmission and at rest, and is decrypted upon retrieval. The access rights are subject to OneDoc's Terms and Conditions, which we cannot influence. No data other than patient details, address, and information entered by the therapist is stored; in particular, our internally recorded patient data concerning sensitive personal data and medical history is not transferred to OneDoc. For automated notifications from OneDoc to the patient, your name, mobile phone number, and email address are always stored, where known.
Service: OneDoc
Provider: OneDoc SA, Chemin des Mines 15 bis, CH-1202 Geneva
Privacy policy: https://privacy.onedoc.ch/de/privacy-policy
Legal basis: Your consent, which you grant by using the booking feature.
3. Google Services
Our website uses various services from subsidiaries of the US company Alphabet Inc. (see table). As a rule, these services all refer to the same privacy policy, which can be found at https://policies.google.com/privacy.
When the IP anonymization feature is activated, your IP address is truncated by Google prior to transmission to the US. The full IP address is only sent to a Google server in the US and truncated there in exceptional cases. Google uses this transmitted information to evaluate your usage, compile analytics reports on these activities, and provide other services to us, such as map services.
Provider/Headquarters: Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (unless noted otherwise and separately)
General privacy information for Google services: https://policies.google.com/privacy
(if further relevant privacy notices are provided for a specific service, these are noted separately. Otherwise, Google's general privacy policy applies)
Service: Google Analytics
Privacy notice: https://support.google.com/analytics/topic/2919631?hl=en&ref_topic=1008008&sjid=11159380926726341526-EU
Information for Google Accounts: https://policies.google.com/technologies/partner-sites?hl=en
Legal basis: Your consent, which you give in advance and can withdraw at any time later.
Service: Google Maps
Legal basis: Legitimate interest or your consent, which you give in advance and can withdraw at any time later.
Service: Google Looker Studio
Legal basis: Your consent, which you give in advance and can withdraw at any time later.
Service: Google Tag Manager
Legal basis: Your consent, which you give in advance and can withdraw at any time later.
Service: Google Ads
Legal basis: Your consent, which you give in advance and can withdraw at any time later.
Service: Google Marketing Platform
Legal basis: Your consent, which you give in advance and can withdraw at any time later.
Service: Google My Business
Legal basis: Legitimate interest
Service: YouTube
Provider: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA
Legal basis: Legitimate interest
4. Social network links
We only allow you to access linked entries on various social networks. Links to our own presences on social media platforms are also set up in this format. While these links are placed on our website and actively lead to the respective platforms, we do not use active cookies from platform operators or tools like the Facebook Pixel. However, we cannot guarantee that platform operators cannot draw certain conclusions about you or your user/browsing behavior when you click a link.
We are entitled, but not obliged, to review content before or after publication on our online presences, delete content without prior notice, and report it to the provider of the relevant platform if necessary.
Service: LinkedIn
Provider: LinkedIn Ireland Unlimited Company or LinkedIn Corporation
Privacy notices: https://www.linkedin.com/legal/privacy-policy
Legal basis: Your consent, which you give in advance and can withdraw at any time later.
Service: Facebook
Provider: Meta Inc., 1 Meta Way, Menlo Park, CA 94025, USA
Privacy notices: https://www.facebook.com/privacy/policy
Legal basis: Your consent, which you give in advance and can withdraw at any time later.
Service: Instagram
Provider: Meta Inc., Menlo Park, CA 94025, USA
Privacy notices: https://privacycenter.instagram.com/policy
Legal basis: Your consent, which you give in advance and can withdraw at any time later.
5. Fonts
Provider: Google Fonts, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Provided through: Framer (see point 1)
Privacy policy: https://developers.google.com/fonts/faq/privacy?hl=de
Legal basis: Legitimate interest
8. Who is data disclosed to?
As part of our business activities, we may share your personal data based on the principle of necessity or your explicit consent, for the stated purposes and where deemed appropriate, with third parties (such as affiliated companies, authorities, healthcare professionals, suppliers, auxiliary persons—in particular independent specialists—and other business partners as well as other individuals) and with service providers processing data on our behalf (e.g., IT providers). We may also be required to disclose your personal data to comply with statutory or regulatory obligations. Recipients may be based in Switzerland, the EU, or anywhere else in the world.
When we transfer data to a country without an adequate statutory level of data protection, we ensure an adequate level of protection as provided by law (in particular based on SCCs or DPAs) or rely on statutory exemptions such as consent, contract performance, establishing, exercising, or enforcing project-related legal claims, or overriding public interests.
9. How and how long do we store data?
The personal data we collect is stored only for as long as necessary to conduct the contractual relationship (from initiating the business relationship through to termination of a contract or duration of treatment), or for other purposes pursued by processing, or where a statutory retention and documentation obligation exists, where an overriding private or public interest applies, or where storage is technically necessary (e.g., in the case of backups or document management systems). As soon as the personal data we collected is no longer required for the above purposes, it will be deleted or anonymized in accordance with our standard procedures, our retention practice, and applicable law.
10. Where is the data stored?
General information on data storage location
Depending on the scope of your interactions with our offerings, your personal data may be stored or accessed in several countries. Whenever we transfer personal data to other countries, we ensure to the best of our knowledge that the data is transferred in accordance with this Privacy Policy and applicable data protection legislation.
For visitors to our website
Your data is stored at the locations of our above-mentioned external data processors in accordance with the services used and corresponding configurations based on the principle of necessity.
For business partners and third parties
Your data is stored partly at the locations of our above-mentioned external data processors and in particular internally with us.
11. What personal rights do you have?
Under Swiss law, you have the following rights:
Right of access
To know whether we have stored personal data about you, and to request copies of this personal data along with information on how it is processed;Right to rectification
The right to have inaccurate personal data about you corrected;Right to erasure
The right to demand the erasure of personal data about you that is no longer necessary for the purposes underlying processing, or that is processed based on withdrawn consent or in violation of applicable legal provisions;Restriction of processing
The right to ask us to restrict the processing of your personal data where the processing is inappropriate, and to object to the processing of personal data;Right to data portability
The right to request the transfer of personal data that you provided to us;
If you wish to exercise these rights, you can contact us at any time using our stated contact address. It may take up to 30 days for us to respond to your request.
If you consented to the processing of your personal data for a specific purpose, you can revoke your consent at any time, and we will stop further processing of your data for that purpose.
Complaints and supervisory authority
If you feel that we have not adequately addressed your complaints or concerns, you have the right to file a complaint with a competent data protection authority.
12. Supplementary provisions
Right to make changes
This Privacy Policy is not part of any contract with you. We may amend this Privacy Policy at any time. The version published on this website is the current version.
Legal validity, applicable language
Where we provide privacy policies in languages other than German, these are generally machine-translated; these non-German versions of the Privacy Policy are provided to you solely for informational purposes and better understanding. Only the German-language Privacy Policy is legally binding.