Privacy policy

Introduction

Casanna GmbH (hereinafter "we", "us", or "clinic") operates an online platform for telemedical and other services in the field of Long Covid and ME/CFS at sharpa.health. The protection of your personal data is a central concern for us.

This privacy policy informs you about which personal data we process in connection with the use of our website and our telemedical and other services, for what purposes and on what legal basis this is done, and what rights you have.

The processing of personal data is carried out in accordance with the Swiss Federal Act on Data Protection (FADP), the Data Protection Ordinance (DPO), and, where applicable, other data protection regulations.

Controller

Responsible for the data processing within the meaning of the FADP is:

Casanna GmbH
Brandisstrasse 33
8702 Zollikon
Switzerland

Email: datenschutz@sharpa.health
Phone: +41 78 314 34 11

Data protection adviser

We have appointed the following person as data protection adviser pursuant to Art. 10 FADP: Philipp Schulte

Email: datenschutz@sharpa.health

Personal data we process

When you visit our website

Each time you access our website, the following data is automatically collected (server log data):

• IP address (anonymised where applicable)
• Date and time of access
• Page accessed / URL
• Referrer URL (previously visited page)
• Browser and operating system used
• Amount of data transferred

When subscribing to the newsletter

• First and last name
• Email address
• Your role (a patient, a caregiver or family member, a physician)
• Postal code, or the indication that you live outside Switzerland
• Preferred newsletter language
• Approximate location (country, region, city), derived automatically from your IP address when you submit the form — the IP address itself is neither passed on to our system nor stored

When registering and opening an account

• First and last name
• Email address
• Phone number
• Date of birth
• Gender
• Residential address
• Health insurance details

Within telemedical consultations

When using our telemedical services, we additionally process particularly sensitive personal data within the meaning of Art. 5 lit. c FADP, in particular:

• Health data (symptoms, diagnoses, course of illness)
• Medical history and findings
• Laboratory results and examination reports
• Treatment plans and therapy recommendations
• Communication content from video consultations and chat messages
• Prescribed medications

For payments

• Billing address
• Payment information (credit card data is processed exclusively by our payment service provider)
• Transaction data

Purposes and legal bases of data processing

We process your personal data for the following purposes:

Provision of telemedical services: carrying out online consultations, diagnostics, treatment, and aftercare in the field of Long Covid and ME/CFS. Legal basis: contract performance and consent (for particularly sensitive personal data).

Account management: creation and administration of your patient account. Legal basis: contract performance.

Billing: invoicing, settlement with your health insurance (where applicable). Legal basis: contract performance and statutory obligations.

Communication: answering your enquiries, appointment confirmations, reminders. Legal basis: contract performance and legitimate interest.

Quality assurance and security: improvement of our services, technical security of the platform. Legal basis: legitimate interest.

Statutory obligations: compliance with statutory retention obligations (in particular medical documentation, accounting). Legal basis: legal obligation.

Particularly sensitive personal data

In the context of our telemedical activity, we process health data, which qualifies as particularly sensitive personal data (Art. 5 lit. c FADP). The processing is carried out exclusively on the basis of your express consent and for the performance of the treatment contract. Your health data is also subject to medical professional secrecy pursuant to Art. 321 of the Swiss Criminal Code.

Disclosure of personal data

We only disclose your personal data when necessary for the performance of our contractual or statutory obligations or when you have consented. Possible recipients are:

• Treating physicians and medical staff on our platform
• Laboratories and diagnostic facilities (for ordered examinations)
• Health insurance companies (for billing, with your consent)
• Referral recipients (other physicians, hospitals) on your instruction
• IT service providers and hosting providers (as processors, with a contract pursuant to Art. 9 FADP)
• Vercel Inc. (USA) — operation of this website and cookieless audience measurement
• Cloud infrastructure providers for database and application hosting (server locations in Switzerland and the EU)
• Email delivery service provider (server location in the EU)
• Payment service providers
• Authorities, where required by law

Cross-border data transfer

Your data is stored on servers in Switzerland (Zurich). For individual steps we rely on service providers within the European Economic Area: the application logic runs on servers in Germany (Frankfurt), and our emails are sent via a provider with servers in Ireland. This website is operated and its audience measured — without cookies — via Vercel Inc., based in the USA.

An adequacy decision of the Federal Council exists for the EEA. Where we engage service providers outside Switzerland and the EEA, we ensure an appropriate level of data protection through standard contractual clauses or other suitable safeguards pursuant to Art. 16 ff. FADP.

Cookies and web analytics

Technically necessary cookies: this website sets a single cookie named "sharpa_lang". It stores your language choice so that a return visit takes you straight to the language you selected. It contains no identifier that could be used to identify you, and it expires after twelve months.

Cookieless audience measurement: to understand which content is needed, we measure the use of this website with Vercel Web Analytics (Vercel Inc., USA). No cookies are set and no cross-device identifiers are assigned. We record only the page accessed, the referral source, the approximate region of origin, operating system, browser and device type, along with individual events — specifically a click on the assessment and a successful newsletter signup. Visitors are distinguished by a hash derived from the request, which Vercel discards after 24 hours. Recognition over longer periods or across other websites is therefore ruled out, and your IP address is not stored. The legal basis is our legitimate interest in shaping our offering to meet actual needs.

Because we use neither analytics cookies nor any personalised evaluation, we do not require your consent for this and show you no cookie banner. You can also manage or delete cookies at any time in your browser settings.

Fonts from Google: the fonts on this website are loaded from Google Fonts (Google Ireland Limited, Ireland) each time a page is opened. Your IP address is transmitted to Google in the process. No cookies are set for this.

Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or destruction (Art. 8 FADP). These include, among others:

• Encrypted data transmission (TLS/SSL)
• Encrypted storage of health data
• Access controls and role-based permissions
• Regular security audits and penetration tests
• Staff training on data protection
• Storage of your data on servers in Switzerland (Zurich)

Retention period

We retain your personal data only as long as necessary to fulfil the respective purposes or as required by statutory retention obligations:

Medical documentation: at least 10 years after completion of treatment (in accordance with cantonal health law and Art. 26 of the Medical Professions Act).

Accounting records: 10 years (pursuant to Art. 958f Swiss Code of Obligations).

Server log data: 90 days

Email delivery logs: 30 days

Account data: until deletion of the account, subject to statutory retention periods.

After the retention period has expired, your data is deleted or anonymised.

Your rights

Under the FADP, you have the following rights:

Right to information (Art. 25 FADP): you have the right to request information about whether and what personal data we process about you.

Right to data portability (Art. 28 FADP): you can request the release of your personal data in a common electronic format.

Right to rectification (Art. 32 para. 1 FADP): you can request the rectification of inaccurate personal data.

Right to deletion: you can request the deletion of your data, provided that no statutory retention obligations apply. Special retention periods apply to medical records.

Right to object: you can object to the processing of your data insofar as we rely on a legitimate interest.

Withdrawal of consent: you can withdraw consent given at any time with effect for the future.

To exercise your rights, please contact: datenschutz@sharpa.health.

Right to lodge a complaint

If you believe that the processing of your personal data violates the FADP, you can file a complaint with the Federal Data Protection and Information Commissioner (FDPIC):

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern
Website: www.edoeb.admin.ch

Changes to this privacy policy

We reserve the right to amend this privacy policy at any time to adapt it to changes in the legal situation, new services, or technical developments. The currently valid version applies from the indicated date. We recommend that you review this privacy policy regularly.