Data privacy police

As a medical practice, we attach great importance to the protection of your data. Your privacy is of the utmost importance to us. This privacy policy describes how we collect, use, and disclose personal data and what processes we have established to ensure the protection of your data.

Data Collection, Use, and Disclosure

1. What is this privacy policy about?

When you interact with our medical practice and visit this website, personal data concerning you or other persons (so-called "third parties") is obtained and processed. The term "data" is used here synonymously with "personal data".

2. Who is responsible for processing your data?

For the data processing described in this privacy policy, the following data protection officer is responsible under data protection law, unless communicated otherwise in individual cases:

Alexandra Kotthaus
Praktische Ärztin (General Practitioner)
Fachärztin für Psychiatrie & Psychotherapie (Specialist in Psychiatry & Psychotherapy)
Alte Bahnhofstr. 3
CH-9100 Herisau / Switzerland
Tel. +41 (0)71 252 25 50
info@alexandra-kotthaus.com

3. What data is processed?

Various categories of data about you are processed. The most important categories are:

TECHNICAL DATA: When you use our website, the IP address of your end device and other technical data are collected to ensure the functionality and security of these offerings. This data also includes logs in which the use of the systems is recorded. Technical data in itself generally does not allow any conclusions to be drawn about your identity.

COMMUNICATION DATA: When you are in contact with us by email, telephone, letter, or via other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication.

MASTER DATA: Master data refers to the basic data that, in addition to contract data (see below), is required for the execution of contractual and other relationships or for marketing and advertising purposes, such as name, contact details, and information, e.g., about your role and function, your bank details, and your date of birth. We receive master data from you yourself (e.g., recording of patient data), from bodies for which you work (e.g., in the event of an occupational accident), or from third parties such as contract partners, associations, and address brokers, and from publicly accessible sources such as public registers or the internet (websites, social media, etc.).

CONTRACT DATA: This is data that arises in connection with the conclusion or execution of a contract, e.g., details about services to be rendered or rendered, as well as data from the preliminary stage of concluding a contract (such as patient data, details about health insurers, etc.), details required or used for processing, and details about reactions. This data is generally disclosed by you yourself or by contract partners such as OneDoc and third parties involved in the execution of the contract.

4. For what purposes do we process your data?

We process your data in connection with communicating with you as well as for concluding contracts (i.e., providing medical services and therapies), in particular to answer inquiries and to contact you in case of follow-up questions. For this purpose, we primarily use communication data and master data. We retain this data in order to document communication with you, for quality assurance, and for any follow-up inquiries.

5. On what basis do we process your data?

You will be asked for your consent for certain processing of your data (e.g., for processing particularly sensitive personal data such as health data, for marketing mailings, etc.). You will also be informed about the corresponding purposes of processing. Your consent can be revoked at any time with effect for the future by written notification via email to us; the relevant contact details can be found under Section 2. As soon as we have received the notification of revocation, your data will no longer be processed for the purposes to which you originally consented, unless we have another legal basis for doing so. Revocation of your consent does not affect the lawfulness of the processing carried out on the basis of the consent prior to the revocation.

Where you are not asked for your consent for processing, we rely for the processing of your personal data on the fact that the processing is necessary for the initiation or execution of the contract (or the body represented) or that we or third parties have a legitimate interest in doing so, in particular to pursue the purposes and associated goals described above under Section 4 and to be able to carry out corresponding medical services and therapies. Legitimate interests also include compliance with legal regulations, insofar as these are not already recognized as a legal basis by the applicable data protection law anyway.

6. To whom do we disclose your data?

In connection with the provision of medical services, our website, and our offerings, or otherwise to protect our legitimate interests and the other purposes listed in Section 4, we also transfer your personal data to third parties, in particular to the following categories of recipients:

SERVICE PROVIDERS: We work with service providers in Switzerland and abroad who process data about you on our behalf or in joint responsibility, or receive data about you in their own responsibility (e.g., IT providers, login service providers, banking institutions, insurance companies, Ärztekasse).

AUTHORITIES: We may disclose personal data to offices, courts, and other authorities in Switzerland and abroad if we are legally obligated or entitled to do so, or if this appears necessary to protect our interests.

Insofar as medical data subject to professional secrecy under Art. 321 SCC (Swiss Criminal Code) is involved, disclosure to third parties (such as laboratories, Ärztekasse, or other healthcare providers) takes place exclusively on the basis of your explicit consent or a legal authorization or obligation.

7. Is your personal data also transferred abroad?

As explained in Section 6, we also disclose data to third parties. These companies are not located exclusively in Switzerland. Your data can therefore be processed both in Europe and in the USA; in exceptional cases in any country in the world.

If a recipient is located in a country without adequate statutory data protection (unless an adequacy decision such as the Swiss-US Data Privacy Framework applies), we contractually obligate the recipient to comply with applicable data protection, unless the recipient is already subject to a legally recognized framework to ensure data protection, and we cannot rely on an exception clause. An exception may apply in particular in legal proceedings abroad, but also in cases of overriding public interest or if contract execution requires such disclosure, if you have consented, or if the data involved has been made generally accessible by you and you have not objected to its processing.

8. How long do we process your data?

We process your data for as long as required by the purpose of processing, statutory retention periods (in particular the obligation to retain medical records), and legitimate processing interests for documentation and evidence purposes, or as required for technical reasons.

9. How do we protect your data?

We take appropriate security measures to maintain the confidentiality, integrity, and availability of your personal data, to protect it against unauthorized or unlawful processing, and to counteract the risks of loss, unintentional modification, unwanted disclosure, or unauthorized access.

10. What rights do you have?

Applicable data protection law grants you, under certain circumstances, the right to object to the processing of your data, in particular processing for direct marketing purposes, profiling carried out for direct advertising, and other legitimate interests in processing. To facilitate your control over the processing of your personal data, you have the following rights in connection with data processing:

    The right to request information as to whether and what data is being processed;

    the right to have us correct data if it is incorrect;

    the right to request the deletion of data;

    the right to request from us the surrender of certain personal data in a common electronic format or its transfer to another controller;

    the right to revoke consent, insofar as processing is based on your consent;

    the right to receive, upon request, further information necessary to exercise these rights;

    the right to enforce your claims in court or to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) (www.edoeb.admin.ch).

If you wish to exercise the above-mentioned rights, please contact us by email. Our contact details can be found in Section 2. In order for us to exclude abuse, we must identify you (e.g., with a copy of an ID card, insofar as this is not otherwise possible).

Please note that conditions, exceptions, or restrictions apply to these rights under applicable data protection law (e.g., to protect third parties or business secrets).

11. Are online tracking technologies used?

Various technologies are used on the website, such as:

PERFORMANCE COOKIES: To optimize this website and corresponding offerings and to better tailor them to the needs of users, cookies are used to record and analyze the use of the website, potentially beyond the session. This is done through the use of analysis services from third-party providers. These are listed below. Before such cookies are used, you will be asked for your consent. You can revoke this at any time via the cookie settings. Performance cookies have an expiration date of up to 24 months. Details can be found on the website of the respective third-party provider.

We may integrate third-party offerings on the website, in particular from social media providers or software providers. These offerings are deactivated by default. As soon as you activate them (e.g., by clicking a button), the corresponding providers can establish that you are on our website. If you have an account with social media providers, they can assign your details and thus track your use of online offerings. Social media providers process this data under their own responsibility.

We currently use offerings from the following service providers and advertising contract partners (insofar as they use data from you or cookies set by you for advertising control):

GOOGLE ANALYTICS: Google Ireland (based in Ireland) is the provider of the "Google Analytics" service and acts as our processor. Google Ireland relies on Google LLC (based in the USA) as its processor (both "Google"). Google tracks visitor behavior on the website (duration, frequency of page views, geographic origin of access, etc.) through performance cookies (see above) and prepares reports on website usage on this basis. The service is configured so that visitors' IP addresses are shortened by Google in Europe before being forwarded to the USA and therefore cannot be traced back. The settings "Data sharing" and "Signals" are switched off. Although it can be assumed that the information shared with Google is not personal data for Google, it is possible that Google may draw conclusions about the identity of visitors from this data for its own purposes, create personal profiles, and link this data to the Google accounts of these individuals. If you agree to the use of Google Analytics, you explicitly agree to such processing, which also includes the transfer of personal data (in particular website and app usage data, device information, and individual IDs) to the USA and other states. Information on data protection for Google Analytics can be found here [https://support.google.com/analytics/answer/6004245], and if you have a Google account, further details on processing by Google can be found here [https://policies.google.com/technologies/partner-sites?hl=de].

ONEDOC: Appointment bookings are processed via the software from OneDoc, a company based in Switzerland that specializes in online appointment bookings for medical practices. OneDoc secures user data in accordance with the revised Swiss Data Protection Act (revDSG) by storing data on servers in Switzerland, encrypting it, and handling it according to ISO 27001 and VDSZ standards. The company places particular emphasis on the protection of medical data and medical confidentiality, as the security of personal information is the top priority.

12. What data is processed on social media pages?

We may operate pages and other online presences on social networks and other platforms operated by third parties ("channels", "profiles", etc.) and collect the data described in Section 3 and below about you there. We receive this data from you via the respective platforms when you contact us via the online presence. At the same time, the platforms evaluate your use of the online presences and link this data with other data about you known to the platforms (e.g., usage behavior and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g., to personalize advertising) and to manage their platforms (e.g., which content they display to you).

INSTAGRAM: Here we operate the page https://www.instagram.com/newhumanmedicine/. The responsible entity for operating the platform for users from Europe is Meta Platforms Ireland Limited, Dublin 4, Ireland. Their privacy notices are accessible at https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect. Some of your data is transferred to the USA. Settings management, terms of use, and security can be found at [suspicious link removed].

YOUTUBE: Responsible for operating the platform is YouTube. Here you can learn more about data protection at YouTube: https://www.youtube.com/intl/de_be/howyoutubeworks/our-commitments/protecting-user-data/.

FACEBOOK: The responsible entity for operating the platform for users from Europe is Meta Platforms Ireland Limited, Dublin 4, Ireland. Their privacy notices are accessible at https://www.facebook.com/privacy/policy/#. Some of your data is transferred to the USA.
13. Can this privacy policy be changed?

This privacy policy is not part of the contract with you. It can be adapted at any time. The version published on this website is the currently applicable version.

Last update: September 2026