Personal Data Protection Declaration

Purpose

emedSwiss SA (“emedSwiss”, “we”, “us” or “our”) attaches particular importance to the protection of personal data.
This Privacy Notice explains how we process personal data in accordance with the Swiss Federal Act on Data Protection (“FADP”) and, where applicable, the European Union General Data Protection Regulation (“GDPR”).

Roles of emedSwiss

emedSwiss’s role depends on the processing activity concerned :

SaaS Services

When providing its SaaS services, emedSwiss processes personal data, including health data, on behalf of its clients, in particular healthcare professionals and healthcare institutions.

In this context:

• the client is the data controller;
• emedSwiss acts as a data processor;
• emedSwiss processes personal data in accordance with the client’s instructions and the applicable contractual agreements.

The client determines, in particular, the purposes of the processing, the categories of data processed and the applicable retention periods.

emedSwiss’s Own Activities

emedSwiss acts as a data controller for its own activities, including:

• managing relationships with clients, suppliers and partners;
• contract management, invoicing and accounting;
• handling enquiries and contact requests;
• managing prospects and commercial communications;
• operating and securing its website and systems;
• complying with its legal obligations.

Personal Data Collected Directly by emedSwiss

When you visit our website or interact with us, we may process information such as:

• your first name, surname and contact details;
• your position and organisation;
• our correspondence with you;
• contractual and invoicing information;
• your IP address and certain technical connection data;
• your communication preferences.

We may collect this information directly from you, from your organisation, from partners or from publicly available sources.

Purposes of Processing

When acting as a data controller, we process personal data to:

• respond to your requests;
• prepare, enter into and perform contracts;
• provide and improve our services;
• manage invoicing and business relationships;
• ensure the security of our systems;
• comply with our legal obligations;
• establish, exercise or defend legal claims;
• send authorised commercial communications.

Where processing is based on consent, you may withdraw your consent at any time. Such withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Service Providers and International Transfers

We may use service providers for purposes such as hosting, maintenance, security, communication and the administration of our services.

Where emedSwiss acts as a data processor, it engages sub-processors in accordance with the agreements entered into with its clients.

Personal data is primarily processed in Switzerland or within the European Economic Area. If data is transferred to a country that does not provide an adequate level of data protection, we implement the safeguards required by applicable law, including appropriate contractual clauses.

Data Retention

When acting as a data controller, we retain personal data for as long as necessary to fulfil the stated purposes, perform our contracts and comply with our legal obligations.

Personal data processed through our SaaS services is retained, returned or deleted in accordance with the client’s instructions and the applicable contractual provisions.

The client remains responsible for determining the retention periods applicable to its patients’ data.

Security

We implement appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised disclosure and unauthorised access.

These measures include, in particular, access controls, encryption, backups, logging, security monitoring and staff awareness training.

Your Rights

Data Processed Through Our SaaS Services

If your request concerns personal data processed in the emedSwiss solution by your doctor, medical practice or healthcare institution, please contact that person or organisation directly.

The client, as data controller, is responsible for handling your request. emedSwiss provides the client with the necessary assistance in accordance with its contractual obligations.

Data Processed Directly by emedSwiss

For processing activities for which emedSwiss acts as data controller, you may, subject to applicable law, request:

• access to your personal data;
• the correction or deletion of your personal data;
• restriction of processing;
• the disclosure or portability of certain data;
• to object to certain processing activities;
• to withdraw your consent.

We may verify your identity before responding to your request.

Contact

For any questions concerning data protection, please contact:

emedSwiss SA
Place des Perrières 2
1296 Coppet
Switzerland
dpo@emedswiss.ch

You may also contact the competent data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC).

Amendments

We may amend this Personal Data Protection Declaration to reflect changes to our services, processing activities or legal requirements. The version published on our website is the current version.

Version dated September 15th 2026