Privacy notice
Gesundheitsdatenraum Schweiz
1. Controller
The controller for processing personal data in data2u is Verein Gesundheitsdatenraum Schweiz (GdS), c/o Ernst Hafen, Hochstrasse 95, 8044 Zürich, Switzerland, UID CHE-434.667.859. Contact: privacy@gesundheitsdatenraum.ch.
2. Processors
GdS uses the following processors under contractual instructions and confidentiality obligations:
- 44ai AG, Industriestrasse 78, 4600 Olten, Switzerland, info@44ai.ch, for the retained technical/API and AI structuring service.
- Didit Identity Spain, S.L., Calle Nápoles 227, P. 1, 08013 Barcelona, Spain, privacy@didit.me, for identity verification.
- Infomaniak Network SA, rue Eugène-Marziano 25, 1227 Les Acacias, Switzerland, for hosting and infrastructure.
3. What we process
Depending on the features you use, this includes account and contact details, identity and verification evidence, health documents that you request or upload, authorization and signature evidence, device and security logs, and support communications.
4. Why we process it
We process data to create and secure your account, verify that you are the person requesting records, obtain health documents from providers on your instructions, store and display them to you, add technical metadata and AI-assisted structure, operate the service, and respond to support requests.
5. Your authorization
Before requesting records, the app shows a Vollmacht identifying you and GdS. Didit verifies your identity. You may review the authorization and provide an electronic signature in the app. The resulting PDF includes the verified identity, consent and technical evidence. It is a simple electronic signature (SES), not a qualified electronic signature (QES).
6. Storage and transfers
Production application and document storage are hosted in Switzerland. Didit processes verification data through its European contracting entity. If a transfer outside Switzerland or the EEA is required for a processor, GdS applies the safeguards required by applicable data-protection law and records the relevant transfer information.
7. Retention and deletion
We retain data only for as long as needed for the stated purposes, legal obligations, dispute handling, and security. You may request access, correction, deletion, restriction, or a copy of your data, and may withdraw consent for future processing where applicable. Contact privacy@gesundheitsdatenraum.ch.
8. Updates
We may update this notice as the pilot evolves. The version and date above identify the notice shown for this release.
9. Contact
Verein Gesundheitsdatenraum Schweiz (GdS)
c/o Ernst Hafen
Hochstrasse 95
8044 Zürich, Switzerland
privacy@gesundheitsdatenraum.ch