Data security

I. Purpose of this privacy policy

Your privacy is very important to us. We therefore comply with the requirements of the Swiss Data Protection Act (FADP) and the other provisions of Swiss data protection law. Where applicable, we also comply with the provisions of the EU General Data Protection Regulation (GDPR). This Privacy Policy provides information about how we process personal data.

II. Your partners

The present website is operated by Medgate AG, Dufourstrasse 49, 4052 Basel, Switzerland.

Telemedical services, such as medical advice over the phone, are provided by Medgate AG as the responsible body.

If you choose to obtain services from a Medgate Mini Clinic, your personal data will be processed by Medgate Mini Clinic AG, Dufourstrasse 49, 4052 Basel in its capacity as a data controller.

Medgate AG, Medgate Health Centers AG, and Medgate Mini Clinic AG shall be referred to as the service providers (the "SP") for the purposes of this privacy policy.

III. Basis of data processing

The SP will process your personal data based on the following grounds:

• On the one hand, on the basis of contractual relationships entered into or initiated between you and the respective healthcare provider, in particular for medical advice and service provision, for which health data (including information on current disorders or medical history) is collected and processed. (The legal basis according to the GDPR - if applicable - is Art. 6 para. 1 lit. b or Art. 9 para. 2 lit. h);
• For the protection of vital interests of the respective SP (see art. 6 para. 1 lit. f GDPR, if applicable). If you have any queries as to the vital interests concerned, please refer to the contact below;
• For the fulfilment of legal obligations. Particularly with regard to health insurance legislation, and any medical storage requirements (see art. 6 para. 1 lit. c, if applicable);
• Based on your explicit consent, if deemed necessary by applicable laws (see art. 6 para. 1 lit. a, if applicable).

IV. Purposes of data processing

The SP may process your personal data for the following purposes:

• To carry out your medical advice and treatment in accordance with the respective contractual relationship between you and the healthcare provider and in general to exercise or claim the associated rights and obligations;
• For the administration of patient records, including the recording of telephone calls in the context of telemedical services. You will be informed about the recording separately at the beginning of each telephone conversation;
• For the purpose of mandatory record keeping, and for archiving purposes;
• In order to contact your health insurer for insurance-related purposes.
• In order to inform you about news, including the realisation of marketing measures, that could be of interest for you;
• For the secure and stable operation of this website;
• For the improvement of the services provided by the relevant SP.

V. Processing of your personal data in particular situations

a) When you visit the website

When you visit our website, the browser on the device you use to access the website automatically sends information to our website server. This information is temporarily stored in a log file. The following information is collected without any action on your part and stored until it is automatically deleted:

• Name of the file accessed
• Date and time of access
• Volume of data transmitted
• Notification of whether file access was successful.
• Description of the type of web browser used
• Operating system used
• Previously visited page
• Provider
• Your IP address

We process the above-mentioned data for the following purposes:

• To successfully establish a connection to the website
• To ensure that our website is easy to use
• To evaluate system security and stability
• For other administrative purposes

The lawful basis for the processing of the data is, where applicable, art. 6 para. 1 lit. f GDPR. Our legitimate interest is based on the data collection purposes listed above. We will never use the data collected to identify your personally. When you visit our website, we also use cookies and analytics and marketing services. You can find more information about these technologies in Section VI of this Privacy Policy.

b) When you use our contact form

We provide a contact form on our website that you can use to contact us with any questions you may have. The form requires you to enter your name and contact details (first and last name, email address, telephone number and address) and a message to enable us to respond. You can also choose to provide other information. The data is processed based on your specific inquiry for the purposes of contacting you in accordance with point art. 6 para. 1 lit. b GDPR, where applicable.

c) When you subscribe to the newsletter

You can also subscribe to our newsletter on our website. The newsletter provides information about our interesting new offers.

Sign-up to our newsletter is completed using a double opt-in procedure. This means that, after you sign up, we will send an email to the email address you provided. The email asks you to confirm that your email address is correct. In addition to the email address you provided, we also store your IP address, the date and time of your subscription, and your confirmation as proof of your subscription and to prevent any misuse of your personal data.

The lawful basis for the processing is your consent in accordance with art. 6 para. 1 lit. a GDPR, where applicable. You may withdraw this consent at any time with future effect using the unsubscribe link provided in the newsletters sent to you.

VI. Cookies

Our website typically uses “cookies” and similar technologies that can be used to identify your browser or your device. A cookie is a small file that is sent to your computer or that is automatically stored on your computer or mobile device by your browser when you visit our website. This way, we can recognize you if you visit the website again, even if we don’t know who you are. In addition to cookies that are only used during a session and are deleted when you leave our website (session cookies), cookies can also be used to store user settings and other information for a specific period such as two years (permanent cookies). You can, however, set up your browser so that it rejects cookies, only stores them for a session or deletes them sooner. Most browsers are set to accept cookies by default.

Necessary cookies:

Certain sections of our website use technically necessary cookies. Such file elements allow your computer to be identified as a technical unit during your visit to this website to facilitate your use of our services. You can generally configure your browser to notify you of cookies so that you can accept or reject them, or you can delete existing cookies. Please use your browser’s help function to find information on how to change these settings. Please note that certain features of our website may not work if you disable the use of technically necessary cookies. Cookies do not allow a server to read private data on your computer or data stored by another server. They do not harm your computer and do not contain viruses. Our use of technically necessary cookies is based on art. 6 para. 1 lit. f GDPR, where applicable: the processing enables our website to work. It is therefore necessary in order to serve our legitimate interests.

Cookie consent with Usercentrics

This website uses Usercentrics cookie consent technology to obtain your consent to the storage of certain cookies on your device and to document your consent in accordance with data protection law. This technology is provided by Usercentrics GmbH, Rosental 4, 80331 Munich, Germany, website: https://usercentrics.com (hereinafter “Usercentrics”).

When you access our website, the following personal data is transmitted to Usercentrics:

• Your consent or the withdrawal of your consent
• Your IP address
• Information about your browser
• Information about your device
• Time of your visit to the website

Usercentrics also stores a cookie in your browser so that it can assign your granted consent or the withdrawal of this consent. This data is stored until you request its erasure, until you delete the Usercentrics cookie yourself or until the purpose for which it was stored no longer applies. Mandatory statutory retention obligations continue to apply.

Usercentrics is used to obtain the legally required consent to the use of cookies. The legal basis for this is point art. 6 para. 1 lit. c GDPR.

Processing contract: We have concluded a processing contract with Usercentrics. This contract is required by data protection law and ensures that Usercentrics processes the personal data of visitors to our website only in accordance with our instructions and the provisions of the GDPR.

Additional cookies

We also use the following cookies to gain an understanding of how you use our website and so that we can show you other advertising that may be of interest to you.

Use of Google Tag Manager

We use Google Tag Manager. This is simply a management system that we can use to integrate the other services described below into our website. Google Tag Manager does not process any personal data. Data is only processed by the other Google services mentioned below and as described below.

Use of Google Analytics

We use Google Analytics, a web analytics service offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies, which are text files stored on your computer, to help analyze your use of the website. The information generated by the cookie about your use of the website is usually transmitted to a Google server in the USA and stored there. However, IP anonymization is enabled on this website so your IP address is first truncated within member states of the European Union or other countries that are party to the Agreement on the European Economic Area. Only in exceptional circumstances will the full IP address be transmitted to a Google server in the USA and truncated there. Google uses this information to analyze your use of the website on our behalf, to compile reports about website activity and to provide us with other services relating to the use of the website and internet usage. The IP address transmitted by your browser as part of the Google Analytics service is not combined with other data held by Google. You can prevent cookies from being stored by configuring your browser software accordingly; however, please note that you may then be unable to make full use of some of the features of this website. You can also prevent Google from storing data generated by the cookie and related to your use of the website (including your IP address) and processing this data by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=en. Please note that the code “gat._anonymizeIp();” has been added to Google Analytics on this website to anonymize users’ IP addresses (IP masking). You can also prevent data capture by Google Analytics by clicking on this link. This will install an opt-out cookie on your device that will prevent future capture of your data while visiting this website. In particular, this is recommended if you access our website from a mobile device. You can find more information on the Terms of Service and privacy at www.google.com/analytics/terms/us.html or https://policies.google.com/privacy?hl=en. Our use of the above-mentioned analytics tools is based on your consent in accordance with art. 6 para. 1 lit. a GDPR, where applicable.

Use of Google Ads conversion and remarketing

We use Google Ads conversions provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that we can use ads (Google Ads) on external websites to draw attention to our attractive offering. We can determine the success of individual advertising measures on the basis of the advertising campaign data. We do so to serve our interest in showing you ads that may be of interest to you, to make our website more engaging for you and to calculate advertising costs in a fair manner. This advertising is delivered by Google using ad servers. In this context, we use ad server cookies that allow certain performance parameters to be measured, such as ad impressions or the number of clicks by users. If you access our website by clicking on a Google ad, Google Ads stores a cookie on your device. These cookies generally expire after 30 days and are not designed to identify you personally. The analysis data stored in this cookie usually includes the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (indicating that the user no longer wishes to be contacted). These cookies enable Google to recognize your web browser. If a user visits certain pages of the website of an Ads customer and the cookie stored on their computer is still valid, Google and the customer can recognize that the user clicked on the ad and was redirected to this page. A different cookie is assigned to each Ads customer. Therefore, cookies cannot be tracked across Ads customers’ websites. We do not collect and process personal data in the context of these advertising measures. Google only provides us with a statistical analysis that we can use to identify which of the advertising measures are particularly effective. We do not receive any other data from the use of advertising and we cannot identify users on the basis of this information. Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We do not have any influence on the amount of data that is collected by Google through the use of this tool, nor on how the data will be used. The following information is therefore provided based on our current knowledge: through the integration of Ads conversion tracking, Google is informed that you have accessed a particular part of our website or clicked on one of our ads. If you are registered with a Google service, Google can connect your visit with your account. Even if you are not registered with Google or if you are not logged in, the provider may be able to detect and store your IP address.

We also use Google Ads remarketing. Using the remarketing function, we can display ads based on our users’ interests on other websites in the Google Network (in Google search results pages or on YouTube, “Google Ads” or on other websites). Users’ interaction with our website, e.g. which services a user has shown interest in, is analyzed for this purpose so that users can be shown targeted advertising on other websites after their visit to our website. Google stores a number in the browsers of users who visit certain Google services or websites in the Google Display Network. This number referred to as a “cookie” is used record this user’s visits. The number acts as a unique identifier for a web browser on a particular device and does not identify a person; no personal data is stored.

You can prevent your participation in this tracking process in various ways: a) by changing the relevant settings in your browser software (specifically, rejecting third-party cookies will result in you not receiving ads from third-party providers); b) by installing the plug-in provided by Google (https://www.google.com/settings/ads/plugin); c) by disabling interest-based advertising from providers who are signed up to the “About Ads” self-regulation campaign using the link http://www.aboutads.info/choices (this setting will be deleted if you delete your cookies); d) via permanent deactivation in your Firefox, Internet Explorer or Google Chrome browser using the link http://www.google.com/settings/ads/plugin; e) by adjusting your cookie settings accordingly; f) by clicking on this link. This will install an opt-out cookie on your device that will prevent future capture of your data while visiting this website. Please note that you may then be unable to make full use of some of the features of this website.

You can find more information on privacy at Google at http://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats/en.html. Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at http://www.networkadvertising.org.

The lawful basis for this use is your consent in accordance with art. 6 para. 1 lit. a GDPR, where applicable.

Use of DoubleClick

This website uses the DoubleClick online marketing tool offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. DoubleClick uses cookies to display ads that are relevant to users, improve campaign performance reports and ensure that a user does not see the same ad too many times. Google uses a cookie ID to record which ads have been displayed in which browser and can thus prevent these ads from being displayed too many times. DoubleClick can also use cookie IDs to record “conversions” in relation to ad requests. For example, a conversion is recorded if a user sees a DoubleClick ad and then later visits the advertiser’s website using the same browser and makes a purchase. Google states that DoubleClick cookies do not contain any personal data.

Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We do not have any influence on the amount of data that is collected by Google through the use of this tool, nor on how the data will be used. The following information is therefore provided based on our current knowledge: through the integration of DoubleClick, Google is informed that you have accessed a particular part of our website or clicked on one of our ads. If you are registered with a Google service, Google can connect your visit with your account. Even if you are not registered with Google or if you are not logged in, the provider may be able to detect and store your IP address.

You can prevent your participation in this tracking process in various ways: a) by withdrawing your consent with future effect by clicking on this link; b) by disabling cookies for conversion tracking by changing the settings in your browser so that cookies from the domain “www.googleadservices.com” are blocked; c) by disabling interest-based advertising from providers who are signed up to the “About Ads” self-regulation campaign using the link http://www.aboutads.info/choices (this setting will be deleted if you delete your cookies); d) via permanent deactivation in your Firefox, Internet Explorer or Google Chrome browser using the link http://www.google.com/settings/ads/plugin. Please note that you may then be unable to make full use of some of the features of this website.

The lawful basis for this processing is your consent in accordance with art. 6 para. 1 lit. a GDPR, where applicable. You can find more information on DoubleClick by Google at https://www.google.com/doubleclick and http://support.google.com/adsense/answer/2839090

Use of Facebook pixels

The website also uses the Facebook Custom Audiences remarketing function provided by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). This allows users of the website to be shown interest-based advertising when they visit the Facebook social network or other websites that also use this process (“Facebook ads”). We use this function to serve our interest in showing you ads that may be of interest to you, to make our website more engaging for you. Due to the marketing tools used, your browser automatically establishes a direct connection with the Facebook server. We do not have any influence on the amount of data that is collected by Facebook through the use of this tool, nor on how the data will be used. The following information is therefore provided based on our current knowledge: through the integration of Facebook Custom Audiences, Facebook is informed that you have accessed a particular website or clicked on one of our ads. If you are registered with a Facebook service, Facebook can connect your visit with your account. Even if you are not registered with Facebook or if you are not logged in, the provider may be able to detect and store your IP address and other identifiers. The Facebook Custom Audiences function can be disabled here and, as a logged in user, at https://www.facebook.com/settings/?tab=ads#_. The lawful basis for this processing is your consent in accordance with art. 6 para. 1 lit. a GDPR, where applicable. You can find more information on privacy at Facebook at https://www.facebook.com/about/privacy.

Userlike Unified Messaging

Our website uses live chat software provided by Userlike UG (haftungsbeschränkt), Probsteigasse 44-46, 50670 Cologne, Germany. This allows you to contact us directly via live chat. Userlike cookies are used to provide this service. Userlike processes the following data on our behalf and in accordance with our instructions: date of access, time of access, your browser type and version, your operating system, the address of the previously visited website, the volume of data processed, an individual user ID and the name and email address you provided.

The lawful basis for this processing is your consent in accordance with art. 6 para. 1 lit. a GDPR, where applicable. You can withdraw your consent with future effect by clicking on this link.

You can find more information on privacy at Userlike here: https://www.userlike.com/en/terms#privacy.

Use of YouTube

We have embedded YouTube videos in our website. These videos are stored on https://www.youtube.com. They are displayed on our website using “framing technology” and can be played here directly. The videos are integrated into our website in privacy-enhanced mode, meaning that your data is not transmitted to YouTube until you give your consent by playing the video. When you play a video, data is transmitted to YouTube, a company of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have no control over the transmission of this data. The data transmitted includes the information that you visited the relevant page of our portal, as well as your IP address, the date and time of the request, your time zone, the content of your request, access status, the volume of data transferred, the browser you used and the type and version of your operating system.

This information is transmitted regardless of whether you have a user account with YouTube. If you are logged in via a Google account, your data will be associated directly with this account. If you do not want this to happen, you will need to log out from your user account before playing the video. YouTube stores the data transmitted to it in the form of user profiles and uses this data for advertising and market research purposes and to personalize its website. This analysis allows YouTube to generate tailored advertising (even if you are not logged in) and to inform other YouTube users about your visit to our portal. You can object to the creation of this user profile. You will need to direct your request to YouTube.

You can learn more about data processing by YouTube and your rights and settings options to protect your data at http://www.google.com/intl/en/policies/privacy and you can also change your settings there. Google also processes personal data in the USA. Google has signed up to the EU-US Privacy Shield: https://www.privacyshield.gov/welcome.

The lawful basis is your consent in accordance with art. 6 para. 1 lit. a GDPR, where applicable.

VII. Your rights

Applicable data protection laws provide for a variety of rights in favour of the data subject. However, please note that the type and extent of such rights may vary depending on the data protection regime effectively applicable to you:

• Information: You have the right to request information about which of your personal data is being processed by the respective SP, and how it is being processed. Please feel free to file a request for information.
• Rectification: If your personal data, which is being processed by the respective SP, is somehow inaccurate, you may request for the rectification of such personal data.
• Withdrawal of consent: Your personal data will usually not be processed solely based on your consent, without any connection to a contractual relationship. However, if that were the case, you might withdraw your consent at any time. Please note that such withdrawal shall only be effective for the future, and that such withdrawal shall not affect any processing activity which may be based upon further grounds.
• Right to object: You might object to any data processing which is based upon the protection of vital interests of the respective SP, if you find yourself in a particular situation which justifies such withdrawal. However, please note that possible overriding interests of the respective SP may remain reserved. Furthermore, you have the right to object to any processing of your personal data for direct marketing purposes. However, please note that your objection shall not affect any processing activity which may be based upon further grounds.
• Restriction: Under certain circumstances, you may have the right to request that the processing of your personal data shall be restricted. This might be the case if you doubt that your personal data are accurate. Please be advised that such restriction may limit or prohibit the further provision of the Foundation's or the SP's services.
• Data portability: If provided for by applicable law, you have the right to request that your personal data, which you provided to us, will be handed out to you in the form required by law. In this case, you may also wish to pass such data on to a new controller. However, overriding, conflicting interests may remain reserved.
• Right to erasure: See point X hereinafter.
• Complaint: Depending on the data protection regime applicable to you, you might be eligible to lodge a complaint with the competent data protection authority, if you feel that your personal data is not being treated adequately.

VIII. Orther recipients of your personal data

The respective SP may engage auxiliary persons (particularly other members of the Medgate Group) when processing your personal data. This may particularly be true as far as commercial/administrative services, or IT-services are concerned. Such auxiliary persons will process your personal data on behalf of the respective SP, and they shall be bound by the medical secrecy and the applicable data protection requirements the same way as the Foundation or the respective SP are.

IX. Place of data processing

Your personal data will usually be processed in Switzerland. However, particularly the provision of telemedical services may take place from abroad. Any transborder data flow shall be limited to countries with data protection laws that are found to be equivalent to Swiss data protection standards, or where specific guarantees exist. If you have any queries relating to that, please refer to the contact below.

X. Erasure/retention periods

Generally speaking, we delete your personal data upon completion of the contract, or when the purpose for which it was gathered has ceased to exist. If you legitimately object to the processing of your personal data, or if you withdraw your consent, we shall delete your personal data. However, the processing of your personal data for compulsory statutory reasons, for the exercise or enforcement of legal claims, and for the defence against any claims shall remain reserved.

The SP shall retain your personal data in each case for as long as deemed necessary for the fulfilment of the contract for medical treatment. However, statutory retention periods, particularly those provided for by public healthcare law, or by insurance law, as well as internal record keeping measures shall remain reserved.

XI. Contact details

We have appointed an internal data protection officer to safeguard the protection of personal data.

For questions relating to the processing of your personal data, or for requests concerning for the exercise of your legal rights, please refer directly to our data protection officer: Medgate, Datenschutzbeauftragter, Postfach, 4020 Basel, Schweiz.

Due to the medical secrecy issues we must ask you to place any requests in writing, and to attach a copy of your valid passport to your request. We might reserve the right to ask for additional identification measures, if deemed appropriate. Thank you for your understanding.

Our representative for the European Union according to the GDPR is: Dr. Christian Borchers, Managing Director of datenschutz süd GmbH, Wörthstraße 15 97082 Würzburg. Phone: +49 931 30 49 76 0.

Basel, June 2023

Applicability

A patient of Medgate is any person whose medical care is involved. The patient may or may not be the same as the person who contacts Medgate.

The patient is the person who receives medical services from Medgate. The patient is entitled to issue instructions; medical services are provided for his benefit and his information is covered by medical confidentiality.

Capacity to make decisions

Persons who make use of medical services at their own responsibility must have the legal capacity to make decisions. A person is capable of making decisions if he can act rationally in relation to a specific issue. Adolescents are capable of making decisions with regard to medical issues unless they must make exceptional decisions of extraordinary significance. If a patient enters into commitments (this applies particularly to responsibility for costs), he must also have the legal capacity to act. Persons aged 18 and over have the capacity to act. Patients who do not have the legal capacity to make decisions or act require the agreement of their legal representative (parent) for all relevant decisions.

Website

Anyone can visit Medgate’s website, /, without providing any personal information. The web server only registers site usage data and does not record any personal information. These log files include data on the IP address, the last page visited, the browser used, the date and time of access and the file that was requested. These anonymous data are only used internally and help us to optimize our services. Such usage data are not linked with any personal data that may be available.

Personal information is required if special services are used on the website. Medgate undertakes to treat these personal data carefully, i.e. to use such data exclusively for the purposes intended.

WebDoctor

Medical questions can be asked online via Medgate’s WebDoctor. The following conditions apply for medical questions to the WebDoctor. The dialogue is transmitted using an encryption protocol (SSL). Information is stored in a protected database, treated as confidential and protected by the requirements of medical confidentiality. No confidential data are sent by email.

Website

The content of the website ‘/’ is in no way a substitute for personal medical consultations or treatment. Medgate recommends that all visitors to the website consult a physician if they have a medical concern. It is also unwise to start, change or discontinue any treatment independently or without consulting a physician.

The content of the website ‘/’ is not a suitable basis for making an independent diagnosis or selecting a form of treatment. Medgate accepts no direct or indirect responsibility for any injuries or health concerns that may arise from the use or misuse of the information.

The authors of the Medgate website have taken care to ensure that any information on applications, medications or dosages corresponds to the current state of knowledge. However, the authors can give no absolute guarantee for this. Please note that information on medicines does not constitute an endorsement. Each dosage or application is carried out at the user’s own risk.

Medgate’s webpages may contain direct or indirect links to third-party websites, but it cannot accept responsibility for the content or legitimacy of their webpages. This applies to all links and references in Medgate’s own website as well as to entries by third parties in Medgate’s guest books, discussion forums, social media accounts and mailing lists.

Disclaimer of liability and rights

This disclaimer of liability is to be regarded as an integral part of Medgate’s Internet services, which refer to this page. Insofar as parts or individual phrases of this text are not, no longer, or not completely legally valid, the content and validity of the remaining parts of the text remain unaffected.

All rights to the contents of this website are vested in Medgate or are indicated by an appropriate reference to the source. The authors have made every effort to respect the copyright of the graphics, audio files, video clips and texts presented on the website, or to use appropriate copyright-free material. All brands and trademarks referred to on this website and possibly protected by third parties are subject without restriction to the provisions of applicable trademark law and the ownership rights of the respective registered owner. Reproduction or other use (in particular commercial use) of such graphics, audio files, video clips and texts in other electronic or printed publications is only permitted with the explicit written permission of Medgate or its authorized representatives.