Privacy Policy

This privacy policy applies to the website evidena.care and to all related services, including telemedicine consultations, appointment booking and the contact form. It applies to all persons who visit our website or make use of our services.

Linked third-party websites (e.g. ArztDirekt, partner pharmacies) are subject to their own privacy policies. We recommend that you read them before use.

Endosana Care AG
Althardstrasse 10
8105 Regensdorf
Switzerland

Email: info@evidena.care

We process personal data that you voluntarily provide to us or that is collected in the course of operating our website, in particular:

• Master data (name, address, date of birth)
• Contact details (email, phone number) for enquiries via our contact form
• Health data in the context of telemedicine consultations
• Technical data (IP address, browser type, operating system, access times) when you visit our website
• Online identifiers (e.g. cookie identifiers)

We process your data in good faith and for the purposes set out in this privacy policy. The legal bases are in particular:

• Your consent (e.g. for the disclosure of health data to pharmacies)
• Performance of a contract or pre-contractual measures (e.g. appointment booking, telemedicine consultation)
• Legal obligations (e.g. retention of medical documentation)
• Legitimate interests, provided your interests do not prevail (e.g. operation and security of the website)

You may withdraw any consent you have given at any time with effect for the future by contacting us at info@evidena.care. Data processing that has already taken place remains unaffected.

We use your data for the following purposes:

• Provision of our telemedicine services
• Responding to your enquiries
• Scheduling and managing appointments
• Improving our website and services
• Ensuring IT security and the operation of our website
• Compliance with legal obligations

When you send us a message via the contact form on our website, we collect the following information:

• First and last name
• Email address
• Phone number
• Content of your message

This data is used exclusively to process your enquiry and is transmitted to our email address via the Mailomat.swiss service. We use a honeypot field for spam protection; no additional personal data is collected in the process. We retain data from contact enquiries for the duration of the correspondence and subsequently for up to 6 months after the enquiry is closed, unless further retention obligations exist.

We disclose your data only in the following cases:

• To partner pharmacies to fill your prescription (with your consent)
• To ArztDirekt GmbH (Germany) as a processor for appointment booking and telemedicine video consultations. In this context, ArztDirekt processes your name, your contact details and the selected appointment. The privacy information of ArztDirekt applies.
• To Exoscale (Switzerland) for hosting our applications and storing data in Swiss data centres.
• To Mailomat.swiss (Switzerland) for sending messages via our contact form. Your name, email address, phone number and message are transmitted in the process.
• Authentication (login) takes place via our own infrastructure in Switzerland. No login data is disclosed to third parties.
• To Railway (EU) as the hosting provider for our content management system, through which blog content and images are delivered.
• Where we are legally obliged to do so

Our data is generally processed and stored in Switzerland. In the context of processing carried out on our behalf, data may be transferred to companies abroad (in particular ArztDirekt GmbH in Germany and Meta Platforms Ireland Limited in Ireland, with possible onward transfer to the USA).

For the transfer to ArztDirekt (Germany), an adequate level of data protection is ensured on the basis of the adequacy decision. If the level of data protection in a country does not correspond to that of Switzerland, we carry out a prior risk assessment and ensure by contract that an equivalent level of protection is guaranteed (e.g. by means of standard contractual clauses).

When you visit our website, our server automatically collects the following technical data, which is required for the operation of the website:

• IP address
• Date and time of access
• Browser type and version, operating system
• Referrer URL

This data cannot be attributed to any specific person and is not merged with other data sources. It is stored to ensure IT security. Server log files are automatically deleted after 30 days.

Our website uses cookies. Cookies are small text files that are stored on your device and do not cause any damage. Some cookies are technically necessary for the website to function.

We use:

• Technically necessary local storage: For the basic functions of the website (e.g. storing your cookie consent status in your browser’s local storage).
• Web analytics: To analyse website usage and improve the user experience, we use a privacy-friendly analytics solution. It collects aggregated, non-personal usage data (e.g. page views, time on page, country of origin). No cookies are set, no IP addresses are stored and no fingerprinting is carried out. The data is processed on servers in Switzerland. Identification of individual visitors is not possible. Legal basis: legitimate interest (Art. 31 para. 1 FADP).
• Meta Pixel: We use the Meta Pixel of Meta Platforms Ireland Limited to measure and improve the effectiveness of our advertising campaigns. Cookies are set in this context (including _fbp) and usage data such as pages visited, IP address and browser information are transmitted to Meta; a transfer to the USA cannot be ruled out. Contents of your enquiries or medical information are not transmitted. Legal basis: legitimate interest (Art. 31 para. 1 FADP). You can prevent this tracking by blocking cookies in your browser or adjusting your Meta ad preferences.

When you visit our appointment page (/en/appointment), a widget of ArztDirekt GmbH is embedded as an iframe. ArztDirekt may set its own cookies and process your IP address in this context. Details can be found in the privacy policy of ArztDirekt.

You can adjust your cookie settings at any time via the "Cookie settings" link in the footer of our website, or deactivate or delete cookies in your browser settings. Instructions can be found here:

• Google Chrome
• Apple Safari
• Microsoft Edge
• Mozilla Firefox

If cookies are deactivated, it may not be possible to use all functions of the website to their full extent.

We store personal data only for as long as is necessary for the stated purposes or as required by statutory retention obligations.

• Medical data: in accordance with the statutory requirements for patient documentation (generally 10–20 years)
• Business communication, contracts and accounting records: up to 10 years (in accordance with Art. 958f of the Swiss Code of Obligations)
• Contact form enquiries: up to 6 months after the enquiry is closed
• Server log files: 30 days
• Cookie consent status: until withdrawn or deleted by you

Where we no longer need data for the provision of our services and no statutory retention obligations stand in the way, the data is deleted or anonymised. Data subject to statutory retention obligations is restricted from further processing and deleted once the retention period has expired.

We do not use automated individual decision-making within the meaning of Art. 21 FADP that produces legal effects concerning you or similarly significantly affects you. Nor does any high-risk profiling take place.

Should we use automated decision-making procedures in the future, we will inform you separately and take the necessary measures in accordance with the FADP.

To exercise your rights, please contact us at info@evidena.care.

We take appropriate technical and organisational measures (TOM) in accordance with Art. 8 FADP to protect your data against unauthorised access, loss or misuse. These include in particular:

• TLS encryption for all data transmission between your browser and our website
• Hosting in Swiss data centres (Exoscale) with physical and logical access controls
• Access rights based on the principle of least privilege
• Regular security updates and monitoring of our systems
• Encrypted storage of sensitive data

Our contractual partners and employees who have access to your data are obliged to comply with data protection regulations. We have concluded corresponding contracts with processors to ensure the protection of your data.

Despite these measures, no data transmission over the internet can be guaranteed to be completely secure. We recommend that you always transmit confidential information via secure channels.

We may amend this privacy policy at any time. The current version is always available on our website. We will inform you of any material changes.

This privacy policy and all matters related to it are governed by Swiss law. The place of jurisdiction is Regensdorf, Switzerland, to the extent permitted by law.