Privacy policy

The controller responsible for processing your personal data on this website is:

For questions about data protection and to exercise your rights, it is best to write to us at info@spitex-medimex.ch (subject “Data protection”) or by post to the address above.

Every person has the right to privacy and to protection against the misuse of their personal data (Art. 13 of the Federal Constitution). This privacy policy explains how we put this into practice: for our website spitex-medimex.ch and for requests you send us via the website, by e-mail or by phone.

How we process personal data in the course of nursing care and support itself – for example in the care records or when billing health insurers – we explain to our clients separately.

The governing law is the Swiss Federal Act on Data Protection (FADP) in its revised version, in force since 1 September 2023. Where the General Data Protection Regulation of the European Union (GDPR) applies in an individual case – for example if you are in the European Economic Area – its provisions also apply. You will find the GDPR notes at the end of each section.

Personal data is any information relating to an identified or identifiable person. Information about health is considered sensitive personal data (Art. 5 let. c FADP). We handle it with particular care.

• Contact details: title, first name and last name, phone number and e-mail address.
• Details of your request: who you are looking for support for, which services you would like, canton of residence, preferred start date, preferred callback time and your message. These may reveal information about your health or the health of another person.
• Technical data: IP address, date and time of access, the page visited and information about your browser and operating system.
• Where your visit came from: landing page, referring website, campaign parameters and click IDs from ads (see Where your visit came from).
• Usage data – only according to your cookie choice: which pages you visit and which features you use, for example a click on the phone number or submitting a form (without its content).
• Your settings: your cookie choice and the text size you chose.
• Donations: the details your bank sends with a donation (see Donations).

We process this data to answer your requests and prepare nursing care and support, to operate our website securely and reliably, to understand how it is used, to measure the success of our ads and to meet legal obligations, such as bookkeeping.

Under the FADP, processing is permitted if it complies with the principles of the Act. Where necessary, we rely on your consent or on an overriding interest (Art. 31 FADP), for example in operating the website securely.

We treat personal data confidentially. We do not sell it and do not pass it on to third parties for advertising purposes.

GDPR The legal bases are answering your request and preparing a contract (Art. 6(1)(b) GDPR), legal obligations (point (c)), our legitimate interests (point (f)) and your consent (point (a)) – for health information, your explicit consent (Art. 9(2)(a) GDPR). You can withdraw your consent at any time with effect for the future.

Our website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare delivers the pages via a worldwide network of data centres and protects them against attacks. Technical data is processed with every request: IP address, date and time, the address requested, the referring website and information about your browser and operating system.

This data is needed to deliver the website, ensure its security and fix faults. Cloudflare processes it on our behalf; we do not analyse it ourselves in a way that identifies individuals.

The connection to our website is encrypted (HTTPS).

We deliver fonts, images and the map of our area from our own server. Visiting a page therefore does not create any connections to Google Fonts, map services or picture agencies. The only exception is Google Tag Manager (see Google services).

GDPR Art. 6(1)(f) GDPR – legitimate interest in a secure and functioning website.

If you send us a request using a form – for example “Request care”, the contact form or a callback request – we process the details you enter. Required fields are marked; to reply, we need your name and a phone number or e-mail address.

Your request is sent to our server in encrypted form and forwarded from there by e-mail to our office. We use the Resend service (Resend, Inc., USA) to send these e-mails. We do not store requests on the website itself: our server logs only contain a reference number, the type of request, the canton, whether the request followed an ad click, and the delivery result – no names, contact details or messages.

With the request, we also send the language, the page from which you sent it, your answers in the “What kind of support suits you?” guide (if you used it) and the information on where your visit came from.

Health information: the services you select and your message may contain information about your health. We use it exclusively to answer your request and to prepare a needs assessment. By ticking the box for the privacy policy, you consent to this processing. Please only tell us what is necessary for your request – we are happy to discuss everything else in person.

Requests on behalf of others: if you send a request for a relative, please let that person know. Professionals – for example from doctors’ practices, hospitals or social services – make sure that they are allowed to pass on patient data.

We treat information about your health confidentially. Our nurses are also bound by professional secrecy (Art. 321 of the Swiss Criminal Code).

To protect against spam, every form contains an invisible check field and a time check.

E-mail and phone

If you e-mail or call us, we process your details to deal with your enquiry. E-mails are usually sent unencrypted; please do not send us detailed medical documents by e-mail. Our e-mail mailboxes are operated by a service provider on our behalf. We do not record phone calls.

How long we keep requests

Requests that do not lead to an assignment are deleted once they have been dealt with, at the latest after twelve months. If an assignment results, we transfer the necessary details to your client file.

GDPR Art. 6(1)(b) GDPR (request and preparation of a contract); for health information, Art. 9(2)(a) GDPR (explicit consent).

We would like to know how people find us – for example via an ad on Google or via Google Search. For this purpose, your browser remembers the following when you first open a page in a session:

• the landing page and the referring website (without its parameters),
• any campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content),
• click IDs from ads (gclid, gbraid, wbraid, msclkid, fbclid) and
• the time.

This information is kept in your browser’s session storage and deleted when you close the browser tab. Only if you have expressly consented to measuring the success of advertising is it kept in local storage for up to 90 days. If you withdraw your consent, it is deleted there immediately.

If you send us a request, this information is sent with it. This lets us see whether a request came about via an ad. If your request leads to a care assignment, we can report the click ID and the time to Google Ads (“offline conversion”) so that Google can count the success of the ad – without your name, your contact details or information about your health.

We do not send Google any e-mail addresses or phone numbers – not even in encrypted (hashed) form.

GDPR Art. 6(1)(f) GDPR (legitimate interest in measuring our advertising); storage beyond the session only with your consent (Art. 6(1)(a) GDPR).

Cookies are small text files that your browser stores. Your browser’s local storage and session storage work in a similar way. Our website itself does not set any cookies; it only uses your browser’s storage for the purposes listed below. Cookies may be set by Google services according to your choice and by Cloudflare for security reasons.

On your first visit, you can choose in a small window: “Accept all”, “Necessary only” or your own selection. For visitors from Switzerland, statistics and measuring the success of advertising are switched on by default until you choose otherwise; Swiss law allows this if we inform you and you can refuse it (Art. 45c Telecommunications Act). For visitors from the European Economic Area and the United Kingdom, both remain switched off until you consent.

We do not use your data for personalised advertising (remarketing).

We store your choice in your browser. You can change or withdraw it at any time – with the button below or via “Cookie settings” at the bottom of every page. You can also delete or block cookies and website data in your browser.

What is stored in your browser

The names and lifetimes of the Google and Cloudflare cookies are set by these providers and may change.

GDPR Necessary storage: Art. 6(1)(f) GDPR. Statistics and advertising: only with your consent (Art. 6(1)(a) GDPR).

We use services from Google. For people in Switzerland and the European Economic Area, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible. Data may also be transferred to Google LLC in the USA (see Disclosure abroad).

Google Tag Manager and consent mode

Google Tag Manager loads and controls the Google services on our website. It does not create user profiles itself, but it does process your IP address when it loads. Before it even loads, we tell Google your cookie choice (“consent mode”). Without consent, the Google services do not set cookies and only send limited signals without identifiers; advertising data is also redacted. So that an ad click can still be counted, the click ID is passed on in the address (URL) when you move between our pages.

Google Analytics 4

Google Analytics helps us understand how our website is used: which pages are visited, how visitors arrive, which devices they use and which features they use – for example clicks on the phone number, opening frequently asked questions, the steps of the “What kind of support suits you?” guide or submitting a form.

We do not send any names, contact details or form contents. The guide and submitted requests only report who the request was for, the type of service wanted and the canton. Google Analytics 4 does not store IP addresses. The event data is deleted after 14 months.

Google Ads

We place ads via Google Ads and measure whether an ad click is followed by a request or a call (conversion measurement). For this, we use cookies and the ad’s click ID (see Where your visit came from). We do not use remarketing, audiences from customer lists or any other personalised advertising.

To measure calls, Google may display a forwarding number on our website. If you call this number, the call is forwarded to our office and Google records details such as the date, duration and area code of the call.

More information: Google’s privacy policy (opens in a new window) and how Google uses information from sites that use its services (opens in a new window).

GDPR Art. 6(1)(a) GDPR (consent).

Map: the map of our area is based on geodata from swisstopo and is embedded directly in our pages. No data is sent to map services.

Google Maps: we link to the location of our office on Google Maps. Only when you open the link are you taken to Google; Google’s privacy policy applies there.

Links to other websites: the operators of linked websites – for example our website on family caregiving, apmedimex.ch – are responsible for them. Their privacy notices apply.

Search: the search on our website runs in your browser. If you have consented to statistics, the search term is sent to Google Analytics as an event. Please do not enter any personal information in the search field.

If you transfer a donation to us, we receive the payment details from your bank – usually your name, your address, your account number (IBAN), the amount and any message. We use them for our accounts and, where appropriate, to thank you. We keep accounting records for ten years (Art. 958f of the Swiss Code of Obligations).

The QR code on our donation page only contains our account details. No data is sent to us when you scan it.

We only pass on personal data where this is necessary for the purposes described – to:

• Cloudflare (operating the website, security and the server function of our forms),
• Resend (sending the request e-mails to our office),
• our e-mail provider,
• Google (Tag Manager, Analytics and Ads – according to your cookie choice),
• service providers who look after our website technically, and
• authorities and courts, where we are legally obliged to do so.

Our service providers process the data on our behalf and according to our instructions. Under its own terms, Google may also use certain data for its own purposes, such as improving its services.

Some of these providers also process personal data outside Switzerland, in particular in EU and EEA countries and in the USA. In the view of the Federal Council, EU and EEA countries provide an adequate level of data protection. For the USA, we rely on the Swiss-U.S. Data Privacy Framework where the provider is certified under it (recognised by the Federal Council since 15 September 2024), and otherwise on the European Commission’s standard contractual clauses as recognised by the FDPIC. You can request a copy of these safeguards from us.

GDPR Transfers to the USA are covered by the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or by standard contractual clauses (Art. 46(2)(c) GDPR).

We only keep personal data for as long as is necessary for the purpose in question or required by law:

• Requests without an assignment: until they have been dealt with, at the latest twelve months.
• If you become our client, the statutory retention periods for the client file and the care records apply.
• Accounting records, for example for donations: ten years (Art. 958f CO).
• Information on where your visit came from in your browser: until the end of the session; with your consent to advertising, up to 90 days.
• Event data in Google Analytics: 14 months.
• Your cookie choice and your text size: until you change or delete them.

We protect your data with appropriate technical and organisational measures – for example encrypted transmission (HTTPS), access restrictions, carefully selected service providers and forms whose contents do not end up in logs. In close cooperation with our service providers, we protect the data as well as possible against unauthorised access, loss, misuse and falsification. However, nobody can guarantee absolute security for transmission over the internet.

Under the Federal Act on Data Protection, you have the following rights in particular:

• Access: you can find out whether and which personal data we process about you (Art. 25 FADP).
• Correction: we correct inaccurate data (Art. 32 FADP).
• Erasure and objection: you can ask us to delete data or to stop processing it, unless a legal obligation prevents this (Art. 30 and 32 FADP).
• Data portability: on request, you will receive the data you gave us in a common electronic format, or we will transfer it to another body (Art. 28 FADP).
• Withdrawal: you can withdraw consent at any time with effect for the future – your cookie choice directly in the cookie settings.

To do so, write to us at info@spitex-medimex.ch or by post. To make sure nobody unauthorised obtains information about you, we may ask for proof of identity. We usually reply within 30 days; access is generally free of charge.

GDPR You have the rights under Art. 15 to 21 GDPR, including the right to restriction of processing.

Complaints to a supervisory authority

In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC): Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch (opens in a new window). In the European Economic Area, the data protection authority of the country where you are located is responsible.

No automated decisions

We do not make any decisions based solely on automated processing that significantly affect you (Art. 21 FADP, Art. 22 GDPR).

We adapt this privacy policy when our website, our services or the law change. The version published here applies; the date at the top shows when it was last updated. It replaces the privacy notice of our previous website from 2018.