Data protection declaration of openmedical AG
openmedical AG (hereinafter also referred to as "we" or "us") obtains and processes personal data that concern you or other persons (referred to as "third parties"). We use the term "data" here synonymously with the term "personal data".
In this privacy policy, we describe what we do with your data if you use mednetpatient.swiss, openmedical.swiss and our other websites or apps (in particular mednet patient) (hereinafter referred to as the "website"), purchase our services or products, otherwise interact with us within the framework of a contract, communicate with us or otherwise deal with us. If necessary, we will inform you by means of a timely written notification of additional processing activities not mentioned in this privacy policy. In addition, we can inform you separately about the processing of your data, e.g., in declarations of consent, contractual conditions, additional data protection declarations, forms and notes.
If you transmit or disclose data to us about other persons, such as family members, work colleagues, etc., we will assume that you are authorized to do so and that this data is correct. By transmitting data via third parties, you confirm this. Please also ensure that these third parties have been informed of this privacy policy.
This privacy policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Data Protection Act ("DSG") and the revised Swiss Data Protection Act ("revDSG"). However, whether and to what extent these laws apply depends on the individual case.
Openmedical AG, Pfeffingerstrasse 19, 4153 Reinach, Switzerland ("openmedical AG") is responsible for the data processing of openmedical AG described in this privacy policy, unless otherwise communicated in individual cases, e.g., in further privacy policies, on forms or in contracts.
For your data protection concerns and the exercise of your rights pursuant to section 11, you can contact us as follows:
openmedical AG
Pfeffingerstrasse 19
4153 Reinach
Switzerland
info@openmedical.swiss
We have created the following additional bodies:
· Data protection representatives in the EU pursuant to Art. 27 GDPR:
SIDD Datenschutz Deutschland UG (limited liability)
Schellingstr. 109a
80798 Munich
For data protection concerns, you can also contact these bodies.
We process various categories of data about you. The most important categories are the following:
· Technical data: If you use our website or other electronic offers, we collect the IP address of your terminal device and other technical data to ensure the functionality and security of these offers. This data also includes logs in which the use of our systems is recorded. We usually keep technical data for 6 months. In order to ensure the functionality of these offers, we can also assign you or your terminal device an individual code (e.g. in the form of a cookie, cf. section 12). The technical data itself does not allow any conclusions to be drawn about your identity. However, in the context of User accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your person).
· Registration data: Certain offers and services (e.g., login areas of our website, newsletter dispatch, etc.) can only be used with a User account or registration, which can be done directly with us or via our external login service providers. You must provide us with certain data and we collect data about the use of the offer or service. We usually keep registration data for 12 months after the end of the use of the service or the termination of the User account.
· Communication data: If you contact us via the contact form, by email, telephone, letter or other means of communication, we collect the data exchanged between you and us, including your contact details and the marginal data of the communication. If we want or need to establish your identity, e.g., in the case of a request for information, a request for media access, etc., we collect data to identify you (e.g., a copy of an ID card). We usually keep this data for 12 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. Emails in personal mailboxes and written correspondence are usually kept for at least 5 years.
· Master data: We define master data as the basic data that we require in addition to the contract data (see below) for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g., about your role and function, your bank account(s), your date of birth, customer history, powers of attorney, signature authorizations and declarations of consent. We process your master data if you are a customer or other business contact or are working for such a person (e.g., as a contact person of the business partner), or because we wish to contact you for our own purposes or the purposes of a contractual partner (e.g., as part of marketing and advertising, with invitations to events, with newsletters, etc.). We receive master data from you yourself (e.g., when you make a purchase or register), from bodies for which you work or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the Internet (websites, social media, etc.). We can also process health data and information about third parties as part of master data. We usually keep this data for 5 years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. In the case of pure marketing and advertising contacts, the period is usually much shorter, usually no more than 2 years since the last contact.
· Contract data: This is data that is collected in connection with the conclusion or processing of a contract, e.g., information about contracts and the services to be provided or performed, as well as data from the run-up to the conclusion of a contract, the information required or used for processing and information about reactions (e.g., complaints or information on satisfaction, etc.). This also includes health data and information about third parties. We usually collect this data from you, from contractual partners and from third parties involved in the processing of the contract, but also from third-party sources (e.g., providers of creditworthiness data) and from publicly accessible sources. We usually keep this data for 5 years from the last contract activity, but at least from the end of the contract. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons.
· Behavioral and preference data: Depending on the relationship we have with you, we try to get to know you and better tailor our products, services and offers to you. For this purpose, we collect and use data about your behavior and your preferences. We do this by evaluating information about your behavior in our area, and we may also supplement this information with information from third parties including from publicly accessible sources. Based on this, we can calculate, for example, the probability that you will use certain services or behave in a certain way. Some of the data processed for this purpose is already known to us (e.g., if you use our services), or we collect this data by recording your behavior (e.g., how you navigate on our website). We anonymize or delete this data when it is no longer relevant for the purposes pursued, which may be the case after 24 months, for example (in the case of product and service preferences), depending on the type of data. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. How tracking works on our website is described in section 12.
· mednet patient: As part of the mednet patient services, we provide you with a secure area for your medical data. As a patient, you decide which data is processed in it. This includes data that a doctor, pharmacist or other health care provider uploads to your file, as well as data that you upload yourself. Data can therefore include, as an example, findings, recipes, diagnoses, X-ray and MRI images, blood counts, etc. The data that we process within the framework of mednet patient will not be shared with others by default, unless you actively share it, i.e., release certain data to a doctor or other health care providers. The data is processed as long as you use the mednet patient service, i.e., you have an active account. You can delete individual data from the record at any time as well as delete the complete record or terminate mednet patient. We only keep your data as long as you actively use mednet patient, i.e., if you have not logged in within three years despite being notified, your account will be deleted.
· Other data: We also collect data from you in other situations. In connection with official or judicial proceedings, for example, data (such as files, evidence, etc.) is collected, which may also relate to you. For reasons of health protection, we may also collect data (e.g., as part of protection concepts). We may receive or produce photos, videos and sound recordings in which you may be recognizable (e.g., at events, through security cameras, etc.). We may also collect data about who enters certain buildings when or has corresponding access rights (including in the case of access controls, based on registration data or visitor lists, etc.), who participates in events or campaigns when or who uses our infrastructure and systems when. The retention period of this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and usually a few weeks for contact tracing data, to visitor data that is usually stored for 3 months, to reports on events with images that can be stored for several years or longer.
You provide us with much of the data 3 mentioned in this section yourself (e.g., via forms, in the context of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g., as part of binding protection concepts (legal obligations). If you conclude contracts with us or want to claim services, you must also provide us with data, in particular master, contract and registration data, as part of your contractual obligation in accordance with the relevant contract. The processing of technical data is unavoidable when using our website. If you want to gain access to certain systems or buildings, you must provide us with registration data. However, in the case of behavioral and preference data, you generally have the option of objecting or not giving consent.
We process your data for the purposes we explain below. Further information for the online area can be found in sections 12 and 13. These purposes and the underlying objectives represent our legitimate interests and, where applicable, those of third parties. You will find further information on the legal basis of our processing in section 0.
We process your data for purposes in connection with communication with you, in particular to answer inquiries and to assert your rights (section 11) and to contact you if you have any questions. We use communication data and master data in particular for this purpose and also registration data in connection with offers and services you use. We keep this data to document our communication with you, for training purposes, for quality assurance and for inquiries.
We process data for the establishment, management and processing of contractual relationships.
We process data for marketing purposes and to maintain relationships, e.g. to send our customers and other contractors personalized advertising about our products and services and those of third parties (e.g. advertising contractors). This can be done, for example, in the form of newsletters and other regular contacts (electronically, by mail, by telephone), via other channels for which we have your contact information, but also as part of individual marketing campaigns (e.g., events, etc.). You can reject such contacts at any time (see at the end of this section 4) or refuse or revoke consent to contact for advertising purposes. With your consent, we can target our online advertising on the Internet more specifically to you (see section 12).
We process your data for market research, to improve our services and our operations and for product development.
We may also process your data for security purposes and for access control.
We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations ("compliance").
We also process data for the purposes of our risk management and as part of prudent corporate management, including operational organization and corporate development.
We may process your data for other purposes, e.g., as part of our internal processes and administration or for training and quality assurance purposes.
As part of mednet patient, we process your data to fulfil the contract, i.e., to provide our services and metadata to optimize our product.
If we ask you for your consent for certain types of processing (e.g., for the processing of particularly sensitive personal data, for marketing mailings, for the creation of personalized movement profiles and for advertising control and behavior analysis on the website), we will inform you separately about the corresponding purposes of the processing. You can revoke consent at any time by written notification (by post) or, unless otherwise stated or agreed, by email to us at any time with effect for the future; our contact details can be found in section 2. For the revocation of your consent to online tracking, see section 12. Where you have a User account, a revocation or contact with us may also be carried out via the relevant website or other service. Once we have received the notification of the revocation of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The revocation of your consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.
Where we do not ask you for your consent to process your personal data, we will base the processing of your personal data on the fact that the processing is necessary for the initiation or processing of a contract with you (or the body you represent) or that we or third parties have a legitimate interest in doing so, in particular to pursue the purposes described above under section 4 and related objectives and to be able to carry out appropriate measures. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognized as a legal basis by the applicable data protection law (e.g., in the case of the GDPR, the law in the EEA and in Switzerland). However, this also includes the marketing of our products and services, an interest in better understanding our markets and the safe and efficient management and further development of our company, including its operations.
If we receive sensitive data (e.g., health data, information on political, religious or ideological views or biometric data for identification), we may also process your data based on other legal bases, e.g., in the event of disputes due to the necessity of processing for a possible process or the enforcement or defense of legal claims. In individual cases, other legal reasons may apply, which we will communicate to you separately if necessary.
We do not use profiling and automated individual decisions.
In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:
· Service providers: We work with service providers in Germany and abroad who process data about you on our behalf or under joint responsibility with us or who receive data about you from us under their own responsibility. Your data within the framework of mednet patient will only be processed within Switzerland.
· Contractual partners including customers: This initially refers to customers (e.g., service recipients) and other contractual partners of ours, because this data transfer arises from these contracts. If you work for such a contractual partner, we may also transfer data about you to them in this context. The recipients also include contractual partners with whom we cooperate.
· Authorities: We may transfer personal data to offices, courts and other authorities in Germany and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. The authorities process data about you that they receive from us under their own responsibility.
· Other persons: This refers to other cases where the involvement of third parties arises from the purposes according to section 4, e.g., service recipients, media and associations in which we participate or if you are part of one of our publications.
All these categories of recipients may, in turn, involve third parties, so that your data may also become accessible to them. We may restrict processing by certain third parties (e.g., IT providers), but not those of other third parties (e.g., authorities, banks, etc.).
We also allow certain third parties to collect personal data from you on our website and at our events (e.g., media photographers, providers of tools that we have integrated into our website, etc.). Insofar as we are not decisively involved in these data collections, these third parties are solely responsible for them. If you have any concerns and to assert your data protection rights, please contact these third parties directly. See section 12 for the website.
As explained in section 7, we also disclose data to other bodies. These are not only located in Switzerland. Your data may therefore be processed both in Europe and, in exceptional cases, in any country in the world. Data within the framework of mednet patient will only be processed in Switzerland.
If a recipient is located in a country without adequate legal data protection, we contractually oblige the recipient to comply with the applicable data protection (for this, we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?) unless it is already subject to a legally recognized set of rules to ensure data protection and we cannot rely on an exemption provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or if the processing of a contract requires such disclosure, if you have given your consent or if the data in question has been made generally accessible by you and you have not objected to its processing.
We process your data for as long as our processing purposes, the legal retention periods and our legitimate interests in processing for documentation and proof purposes require or storage is technically necessary. Further information on the respective storage and processing time can be found in each case for the individual data categories in section 3 or for the cookie categories in section 12. If there are no legal or contractual obligations to the contrary, we will delete or anonymize your data after the storage or processing period has expired within the framework of our usual processes.
Within the framework of mednet patient, we process your data until you delete your account or no longer actively use it.
We take reasonable security measures to protect the confidentiality, integrity and availability of your personal data, to protect it against unauthorized or unlawful processing and to counteract the risks of loss, unintentional modification, unwanted disclosure or unauthorized access.
the right to request information from us as to whether and what data we process from you;
the right for us to correct data if it is inaccurate;
the right to request the deletion of data;
the right to request from us the disclosure of certain personal data in a common electronic format or its transfer to another data controller;
the right to revoke consent, insofar as our processing is based on your consent;
the right to request further information necessary for the exercise of these rights;
If you wish to exercise the above rights vis-ΰ-vis us, please contact us in writing by email, unless otherwise stated or agreed; our contact details can be found in section 2. So that we can rule out misuse, we must identify you (e.g., with a copy of your ID, if this is not otherwise possible).
If you do not agree with our handling of your rights or data protection, please inform us (section 2). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to complain to your country's data protection supervisory authority.
On our website, we use various techniques with which we and third parties engaged by us can recognize you when you use it and, under certain circumstances, also track you over several visits. In this section, we will inform you about this.
At its core, it is important for us to be able to distinguish your access (via your system) from access by other Users so that we can ensure the functionality of the website and carry out evaluations and personalization. We do not want to infer your identity, even if we can, as far as we or third parties engaged by us can identify you by combination with registration data. Even without registration data, however, the techniques used are designed in such a way that you are recognized as an individual visitor every time you visit our website, for example, by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called "cookie").
We use such techniques on our website and allow certain third parties to do the same. You can program your browser to block, deceive, or delete certain cookies or alternative techniques. You can also expand your browser with software that blocks tracking by certain third parties. You can find further information on this on the help pages of your browser (usually under the keyword "data protection") or on the websites of the third parties, which we list below.
The following cookies (techniques with comparable functions such as fingerprinting are included here) are distinguished:
Necessary cookies: Some cookies are necessary for the functioning of the website as such or certain functions. They ensure, for example, that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies only exist temporarily ("session cookies"). If you block them, the website may not work. Other cookies are necessary so that the server can store decisions or entries made by you beyond a session (i.e., a visit to the website) if you use this function (e.g. selected language, consent given, the function for automatic login, etc.). These cookies have an expiry date of up to 12 months.
We may operate pages and other online presences ("fan pages", "channels", "profiles", etc.) on social networks and other platforms operated by third parties and collect the data about you described in section 3 and below. We receive this data from you and the platforms when you come into contact with us via our online presence (e.g., when you communicate with us, comment on our content or visit our presence). At the same time, the platforms evaluate your use of our online presences and link this data to other data about you known to the platforms (e.g., about your behavior and your preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g., to personalize advertising) and to control their platforms (e.g., what content they show you).
We process this data for the purposes described in section 4, in particular for communication, for marketing purposes (including advertising on these platforms, cf. section 12) and for market research. For the corresponding legal basis, see section 0. We may redistribute content published by you (e.g., comments on an announcement) ourselves (e.g., in our advertising on the platform or elsewhere). We or the operators of the platforms may also delete or restrict content from or about you in accordance with the usage guidelines (e.g., inappropriate comments).
For further information on the processing of the platform operators, please refer to the platform data protection notices. There, you can also find out in which countries they process your data, what rights of access, deletion and other data subject rights you have and how you can exercise these or obtain further information. We currently use the following platforms:
LinkedIn: This is where we run the site: https://www.linkedin.com/company/openmedical-ag. The responsible body for the operation of the platform is LinkedIn Ireland Unlimited Company, Ireland, for Users from Europe. With regard to the data collected and processed when visiting our site for the creation of "Page Insights", we are jointly responsible with Wilton Place, Dublin 2, Ireland. As part of Page Insights, statistics are created about what visitors do on our site (comment on posts, forward content, etc.). This is described at https://legal.linkedin.com/pages-joint-controller-addendum. It helps us understand how our site is used and how we can improve it. We only receive anonymous aggregate data.
For X (Twitter), the X User agreement is the authoritative document. It includes the terms of use (https://twitter.com/en/tos?wcmmode=disabled#intlTerms), its privacy policy (https://twitter.com/privacy) and the X rules and guidelines (https://help.twitter.com/en/rules-and-policies#twitter-rules).
We receive the following data from X: reach (tweets, retweets, impressions, page views, unique Users, access to subpages), target group (demographic information), interaction (impressions, reactions, click rate, likes, shares, comments, (link) clicks, engagement rate), target group (demographic/geographical information).
For X, you can manage your privacy settings here: https://help.twitter.com/en/personalization-data-settings
You can reach X's data protection officer via the online contact form provided by it: https://help.twitter.com/en/forms/privacy/question
YouTube (provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The following documents apply to YouTube: privacy policy (https://support.google.com/youtube/answer/2801895?hl=en), terms of use(https://www.youtube.com/t/terms) and the agreement on processing as a data controller (https://business.safety.google/controllerterms/)
In connection with the operation of our YouTube and Google pages, we use the dashboard overview of Google (the provider of the services), by means of which Google provides us with statistical data about the use of our YouTube page, which is anonymous to us, i.e. the personal data of individual Users or visitors is not visible to us. You can find out which data Google uses for usage analysis in connection with our YouTube page and which information Google provides for data processing in connection with the implemented functions here: https://policies.google.com/privacy?gl=CH&hl=en#infocollect.
For the YouTube platform, you can manage your privacy settings here: https://support.google.com/youtube/answer/2531367?hl=en
You can reach Google's data protection officer via the online contact form provided by it: https://support.google.com/policies/contact/general_privacy_form
- For Facebook and Instagram, the operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland (hereinafter also "Meta Platforms" or "Facebook").
For your use of the Instagram platform and the data processing by Facebook, the terms of use (https://facebook.com/legal/terms/) and the privacy policy (https://facebook.com/about/privacy) of Facebook as well as the terms of use (https://help.instagram.com/581066165581870) and the privacy policy (https://help.instagram.com/519522125107875) of Instagram are decisive.
You can reach the data protection officer of Facebook and Instagram via an online contact form provided by it: https://facebook.com/help/contact/540977946302970.
With regard to Page Insights data, we are jointly responsible for data processing with Facebook and have concluded a joint responsibility agreement ("Page Insights Addendum" https://facebook.com/legal/terms/page_controller_addendum), which sets out our respective obligations. We have agreed that
o we are jointly responsible with Meta Platforms for the processing of Page Insights data;
o Meta Platforms assumes primary responsibility and is principally responsible for providing you with information about the joint processing and enabling you to exercise your rights
o It is only Meta Platforms that can make and, if necessary, implement decisions about the processing of page view data and the fulfilment of its data protection obligations;
o Meta Platforms is solely responsible for the processing of other personal data in connection with Page Insights that is not covered by the Page Insights addendum.
o The Irish data protection supervisory authority (https://www.dataprotection.ie) is the lead authority for the supervision of processing under this joint responsibility.
If you, as a User, have linked your Instagram account to your Facebook account, you can control the extent to which your User behavior may be collected and used by Facebook (on Facebook and Instagram pages) in the settings of Facebook's advertising preferences (https://facebook.com/ads/preferences).
To safeguard your rights, please read:
o The Facebook privacy policy (https://facebook.com/about/privacy).
o To gain access to your data stored on Facebook (https://facebook.com/help/1701730696756992/)
o To download a copy of your data stored on Facebook (https://facebook.com/help/212802592074644)
o To object to or restrict certain types of processing of your data (https://facebook.com/help/contact/1994830130782319).
As a Facebook User, you can control the extent to which your User behavior may be collected and used by Facebook in the settings for advertising preferences (https://facebook.com/ads/preferences); further objection/opt-out and setting options can be found in the general Facebook settings (https://facebook.com/settings in particular under "Privacy")
As a User of Instagram, you can make adjustments, in particular, in the privacy settings of Instagram (https://www.instagram.com/accounts/privacy_and_security). Further information can be found directly on the Instagram platform: https://help.instagram.com/116024195217477.
Tiktok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland):
TikTok processes the data of Users of its services (e.g., personal information, IP address, etc.) for its own business purposes. Further information on TikTok's data processing can be found in TikTok's privacy policy at: https://www.tiktok.com/legal/privacy-policy-eea?lang=de
TikTok provides us with so-called page insights (analytics) for our TikTok page: https://www.tiktok.com/analytics. This is aggregate data that helps us understand how people interact with our site. Page insights may be based on personal data collected in connection with a visit to or interaction with people on or with our page and its content.
You can object to the processing of your data for the aforementioned purposes at any time by changing your settings for advertisements in your TikTok User account accordingly by adjusting the "personalized advertising" in the settings under "Settings and Privacy". Further information on these points is available on the following TikTok support pages: https://support.tiktok.com/en
You can find out more about the possibility of viewing your own data at TikTok here: https://support.tiktok.com/en/account-and-privacy/account-information
Information on the existing personalization and privacy setting options can be found here: https://support.tiktok.com/en/account-and-privacy/account-privacy-settings
Furthermore, you have the option of requesting information via the TikTok privacy form or the archive requirements: https://www.tiktok.com/legal/report/privacy?lang=en
This privacy policy is not part of a contract with you. We may adjust this privacy policy at any time. The version published on this website is the current version.