Privacy policy

Controller

The revised Swiss Federal Act on Data Protection (revFADP) applies. Where persons from the European Economic Area are concerned, the GDPR also applies.

Principle

We process personal data only to the extent necessary for the stated purpose and only for as long as required. Health data are sensitive personal data — we process them solely with your explicit consent or within a treatment relationship.

What data we process

We do not collect data in advance, and we do not use contact details for unsolicited advertising.

Consent and withdrawal

Where we rely on your consent, we obtain it explicitly and record the time and version of the consent text. You can withdraw at any time — informally to info@cmd-klinik.ch. The withdrawal applies to the future; it is permanently recorded so that you are not contacted again.

Processors and disclosure

We only pass on data where necessary to provide our services, and we bind processors by contract.

Disclosure abroad only takes place to countries with adequate protection or on the basis of appropriate safeguards. This concerns Germany (operation of the website), the USA (call transcripts without names, Anthropic, bound by contract) and, only with your consent, Ireland and the USA (Google Analytics, Meta Pixel; certified under the Data Privacy Framework).

No disclosure of contact or health data for advertising purposes. No sale of data.

Your rights

• Access
• Rectification
• Erasure
• Restriction
• Objection to direct marketing
• Release or transfer of your data

Please contact info@cmd-klinik.ch. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

Cookies, audience measurement and advertising

• ✓Only with your consent
• ✓No form content to third parties
• ✓No self-test answers to third parties
• ✓Withdraw at any time

On your first visit, we ask whether we may use statistics and marketing services. Without your consent, we do not set any cookies from these services. We store your choice locally in your browser (local storage, key “cmd-consent”) for twelve months; after that we ask again. You can change or withdraw your consent at any time via “Cookie settings” in the footer of every page. The legal basis is your consent (Art. 6 para. 6 revFADP; for visitors from the EU Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG).

Google Analytics 4 (statistics)

With your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics shows us which pages are visited, how visitors find us (for example via a search engine) and which steps are triggered: starting and completing the self-test, submitting a form, clicking on the phone number, email address or route planner, and search terms used in the website search. For this, cookies are set (_ga, _ga_*, stored for up to two years) and information about device, browser, approximate location (country, region) and usage behaviour is processed. Google Analytics 4 does not store full IP addresses. Google Signals and ad personalisation are disabled. We retain event data for 14 months.

We do not transmit to Google any form content, names, email addresses or phone numbers, nor any self-test answers or results. For the self-test, we only record whether it was started and completed and whether it was filled in for yourself or for a child.

We use Google’s Consent Mode. If you decline statistics, Google sets no cookies; Google then only receives signals without an identifier (such as time, page visited, browser type and the note that no consent was given), which Google uses for statistical modelling. Recognition across several visits is therefore not possible.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework; standard contractual clauses also apply. Further information: Google privacy policy.

Meta Pixel (marketing)

For ads on Facebook and Instagram, we may, with your consent, use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”). It measures whether someone visits our website and submits an enquiry after seeing an ad, and makes it possible to show ads to people with similar interests. For this, cookies are set (_fbp, stored for up to three months), and Meta may link this information to your Facebook or Instagram account if you are logged in there.

We only transmit to Meta that a page was visited and, without any further details, that the self-test was completed or the contact form was submitted. Pages about symptoms, causes and treatment do not load the Meta Pixel at all. Meta’s automatic capture of buttons and page content and advanced matching are switched off. We do not transmit any form content, self-test answers or results, treatments, email addresses or phone numbers. The legal basis is your consent; you can withdraw it at any time in the footer under “Cookie settings”. We are jointly responsible with Meta for collection and transmission (Art. 26 GDPR); Meta is responsible for further processing. Data may be transferred to Meta Platforms, Inc. in the USA; Meta is certified under the Data Privacy Framework. Further information: Meta privacy policy.

Origin of enquiries (marketing)

If you consent to marketing cookies, we store in your browser (local storage, key “cmd-attr”) for up to 90 days which ad or campaign brought you to us: campaign parameters (utm), Meta or Google ad and click IDs, the referring website, the first page you visited and the date. When you submit a form, we send this information together with your enquiry to our customer system (Twenty), so we can see which ads lead to enquiries. Without consent nothing is stored. You can withdraw your consent at any time in the cookie settings.

Our own visitor counter

Independently of your consent, we count page views with our own counter on our server. It sets no cookies, stores nothing in your browser and only records daily totals per page. No data is passed to third parties.

Self-test in the browser

While you complete the self-test, it stores your answers locally in your browser (local storage) so that the evaluation appears immediately. This information does not leave your device — unless you explicitly request the evaluation by email. You can clear this storage at any time via your browser settings.

Medical confidentiality

YouTube

We publish videos on our channel youtube.com/@CMD-Klinik. Our server uploads only our own, internally approved videos through the YouTube API Services. The YouTube Terms of Service and the Google Privacy Policy apply.

Through this interface we do not process any data of visitors to our website or of other YouTube users. We store only the ID and publishing status of our own videos and the authorization for our channel, on our server in Germany.

Deletion: we delete a video's ID when the video is removed from the channel, and the authorization as soon as it is revoked. Access can be revoked at any time in the Google security settings.

If someone clicks the YouTube icon in one of our e-mails, we count only the total number of clicks per type of e-mail, without any link to a person. On the website we record such clicks only with your consent (see “Cookies and advertising”).

Phone calls

To get better on the phone, we transcribe calls on our own server. Before the text is stored, we remove your name, as far as we know it, as well as phone numbers, e-mail addresses, dates of birth and addresses. The text is not linked to your details with us; it only shows the date, the hour, the approximate duration and the name of our staff member. Only she and the practice management can read it.

We delete the audio as soon as the text is available, at the latest after seven days; it is never included in a backup. The text is pseudonymous, not anonymous: circumstances such as your job or where you live may remain in it. We keep it for two years.

If we want to keep a record of a call linked to you, you first hear: «This call is being recorded for quality assurance purposes.» Only from this notice onwards do we store audio and text with your details, for two years. You can object at any time; then nothing is recorded and no text is created.

The phone number, time and duration of every call are kept in our call list for 31 days so that we can call you back. For summaries and the review of how we handle calls, the text is sent to Anthropic (USA) without your name.

Changes

We update this policy when processing or the legal situation changes. The version published on this page is authoritative. In case of doubt, the German version prevails.