Datenschutzerklärung

Last updated: August 2026

In brief: When you book an appointment online

When you book an appointment through our website or via OneDoc, we require the following information from you:

Your name, date of birth and contact details to manage your appointment and identify you;
Information about your health insurance for billing medical services;
Information about the reason for your appointment so that we can prepare;
Your email address and telephone number for appointment confirmations and reminders.

This information is treated confidentially and protected in accordance with applicable data protection law. Further details can be found in this privacy policy, particularly in Section 19.

This privacy policy explains which personal data we process in connection with our activities and operations and when you use our website.

In particular, we explain which personal data we process, for what purposes, how and where processing takes place, and what rights data subjects have.

Additional privacy policies and other legal documents, such as general terms and conditions (GTC), terms of use or conditions of participation, may apply to individual or additional offers, services and activities.

1. Controller

The controller responsible for processing personal data is:

Oh yes baby yes GmbH
Zähringerplatz 11
8001 Zürich
Switzerland

We indicate where other controllers are responsible for processing personal data in individual cases.

2. Definitions and legal bases

2.1 Definitions

Personal data means any information relating to an identified or identifiable natural person.

A data subject is a person whose personal data is processed.

Sensitive personal data includes, in particular, data concerning health and a person's intimate sphere. In the course of our medical activities, we process health data in particular.

Processing means any handling of personal data, irrespective of the means and procedures used, including, in particular, obtaining, collecting, recording, retaining, storing, using, modifying, disclosing, transferring, archiving, deleting and destroying personal data.

2.2 Legal bases

We process personal data in accordance with Swiss data protection law, particularly the Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO).

Where the European Union's General Data Protection Regulation (GDPR) applies, we process personal data, in particular:

With the data subject's consent;
To perform a contract or take steps prior to entering into a contract;
To comply with a legal obligation;
To protect vital interests;
To pursue our legitimate interests or those of third parties, provided that the data subject's interests or fundamental rights do not override those interests;
On the basis of the applicable legal requirements for processing sensitive personal data or special categories of personal data.

Our legitimate interests include, in particular, the secure and reliable operation of our services, information and data security, communication with patients and other persons, administrative and organisational activities, the improvement of our services, and the establishment or defence of legal claims.

3. Nature, scope and purpose of processing

We process the personal data necessary to carry out our activities and operations securely, reliably, in a user-friendly manner and in compliance with the law.

This includes, in particular, the following categories of personal data:

Surname and first name;
Date of birth;
Address and contact details;
Telephone number and email address;
Communication data;
Appointment and calendar data;
Contract and service data;
Payment and billing data;
Content data;
Health data and other sensitive personal data;
Browser, device and usage data;
IP addresses, metadata and traffic data;
Location data;
Job application and personnel data.

We process personal data, in particular:

To provide our medical and other services;
To communicate with patients and other interested persons;
To handle enquiries;
To schedule and manage appointments;
To prepare for and carry out treatments;
For patient administration;
To bill for our services;
To comply with legal and regulatory obligations;
To ensure information and data security;
To provide, analyse and improve our website;
To send newsletters and other communications;
To measure the effectiveness and reach of our online services;
To process job applications.

Personal data may be collected directly from the data subject, from third parties or from publicly accessible sources, insofar as this is legally permitted.

If you provide us with data about other persons, we assume that you are authorised to do so and that the data is accurate. By submitting data about third parties, you confirm this. Please also ensure that these third parties have been informed of this privacy policy.

4. Health data and medical information

In connection with our medical services, we process health data and other sensitive personal data.

This includes, in particular, information about:

Health complaints;
Pre-existing conditions and diagnoses;
Previous and current treatments;
Medication;
Pregnancies;
Gynaecological information;
Menstrual cycle and menstruation data;
Medical histories;
Laboratory and examination results;
Medical reports and findings;
Matters relating to a person's intimate sphere;
Medical correspondence;
Information from referring or subsequently treating medical professionals.

We process this data, in particular, for medical consultations, examinations and treatment, documentation, patient and appointment administration, billing, and compliance with legal and professional obligations.

Health data is handled with particular care.

Doctors and other medical professionals are also subject to the applicable statutory and professional duties of confidentiality and secrecy.

5. Patient information system (PIS) and billing through Ärztekasse

We use a patient information system (PIS) provided by Ärztekasse Genossenschaft ("Ärztekasse") for patient documentation, appointment management, practice administration, recording services provided and billing.

The provider is:

Ärztekasse Genossenschaft
In der Luberzen 1
8902 Urdorf
Switzerland

Ärztekasse provides us with the relevant software and the associated infrastructure, operation, data backup and support. Where it processes personal data on our behalf, it does so under the relevant contractual data processing agreements.

The following personal data, in particular, may be processed in the patient information system:

Surname and first name;
Date of birth and sex;
Address and contact details;
Insurance details, insurance number and information about the party responsible for covering costs;
Appointment and calendar data;
Medical histories, diagnoses, findings and treatment progress;
Laboratory and examination results;
Information about medication and prescriptions;
Medical reports and correspondence;
Services provided and tariff items;
Invoice, payment and billing data;
Technical log and access data.

A substantial proportion of this data consists of health data and therefore constitutes sensitive personal data.

Billing through Ärztekasse

Our services are billed through Ärztekasse. In particular, Ärztekasse handles the preparation and dispatch of invoices, payment monitoring, reminders and debt collection on our behalf.

For this purpose, the personal data required for billing is transferred to and processed by Ärztekasse. This includes, in particular, personal details, insurance details and information about the party responsible for covering costs, information about treatment, services provided and tariff items, and, where required for billing and legally permitted, diagnoses and other medical information.

As part of the billing process, personal data is also disclosed to the relevant health insurer or to other parties responsible for covering costs, such as accident, military or disability insurance providers, and to parties engaged by them, such as medical advisers.

The scope of this disclosure is governed by legal requirements, particularly the Federal Health Insurance Act (KVG) and the applicable tariff provisions. The data transferred includes, in particular, information about the person treated, the treatment, the services provided and, to the extent prescribed by law, the diagnosis.

Depending on the billing model, the invoice is sent directly to the insurer (Tiers payant) or to the patient, who then submits it to the insurer (Tiers garant).

Invoice data is generally transferred to insurers electronically via the designated transmission and forwarding services.

Where claims arising from treatment are referred or assigned for debt collection, the personal data required for this purpose may be disclosed to Ärztekasse and other parties entrusted with this task.

According to Ärztekasse, the data processed in this context is stored in Switzerland.

Ärztekasse's privacy policy also applies to its processing of data.

6. Contact and online forms

If you complete a contact, enquiry, registration or patient form on our website, we process the information you enter.

This may include, in particular:

Surname and first name;
Contact details;
Telephone number;
Email address;
Date of birth;
Requested services or appointments;
Personal messages;
Medical information and health data;
Other information provided voluntarily.

We process this data to handle your enquiry, contact you, prepare for an appointment or treatment, or provide the service you have requested.

The technical provision and processing of forms on our website may take place through the infrastructure of Wix.com or OneDoc.

Please only submit information through online forms that is necessary for the relevant enquiry.

7. Communication

When you contact us, for example by post, email, telephone, contact form or other electronic means of communication, we process the information you provide.

This may include, in particular, your name, contact details, the content and time of the communication, and other information provided voluntarily.

For medical matters, this information may include health data and therefore sensitive personal data.

Secure channels for medical communications

For medical questions and sensitive health information, we recommend the following channels:

By telephone on the number provided on our website;
By encrypted email through HIN (Health Info Net), the communication platform for the Swiss healthcare sector: on request, we will send you an encrypted message from our address janku@hin.ch. You can open this message after a one-time verification using an SMS code and reply directly with an encrypted message;
When booking an appointment online via OneDoc, which also uses encrypted data transmission (see Section 19).

Standard email

Standard email communication is not always fully protected by technical means against access by unauthorised third parties. This also applies if you write to our HIN address from a standard email account, such as Gmail, GMX or Bluewin: encryption only applies when you reply to an encrypted message sent by us.

In particular, please do not send us any of the following information by standard email:

Detailed descriptions of symptoms or diagnoses;
Information about medication, allergies or intolerances;
Examination or laboratory results;
Other personal or psychological information.

If you nevertheless send us health data by standard email, you accept the associated risks. We generally respond to medical content through a secure channel.

Once received, all communications are handled in accordance with applicable data protection provisions and medical confidentiality.

8. Job applications

We process applicants' personal data insofar as this is necessary to assess their suitability for employment and conduct the recruitment process.

This may include, in particular:

Personal and contact details;
Information about education and professional experience;
Curriculum vitae;
Certificates and diplomas;
Cover letters;
References;
Other documents submitted voluntarily.

If an employment relationship is established, the relevant data may be transferred to the personnel file.

9. Retention and deletion

We process and store personal data for as long as necessary for the relevant purpose or for as long as statutory, contractual or professional retention obligations apply.

The retention period depends, in particular, on:

The duration of the treatment, business or contractual relationship;
Statutory documentation and retention obligations;
Medical documentation obligations;
Potential warranty periods, liability periods and limitation periods;
Regulatory requirements.

Personal data that is no longer needed and is not subject to a retention obligation is deleted or anonymised.

10. Disclosure of personal data to third parties

We may disclose personal data to third parties or have it processed by third parties insofar as this is necessary for our activities and operations or is legally permitted.

Such recipients may include, in particular:

Medical professionals and institutions;
Laboratories;
Pharmacies;
Insurance providers and billing services;
IT and software service providers;
Hosting and cloud providers;
Appointment booking platforms;
Communication and newsletter service providers;
Analytics and statistics service providers;
Banks and payment service providers;
Fiduciary service providers;
Legal and other professional advisers;
Public authorities and courts, where a legal obligation exists;
Other specialised service providers.

Where third parties process personal data on our behalf, we require them to provide an appropriate level of data protection in accordance with legal requirements.

Sensitive personal data is disclosed only insofar as this is legally permitted.

11. Processing personal data abroad

We generally process personal data in Switzerland. However, when we use internationally operating service providers, personal data may also be processed abroad or transferred there.

Processing may take place, in particular, in Switzerland, the European Economic Area, Israel, the United States of America and other countries in which the service providers we use or their subcontractors operate; in exceptional cases, processing may take place in any country in the world.

When disclosing data to countries whose data protection legislation does not ensure a legally recognised adequate level of protection, we ensure appropriate data protection, in particular through:

Recognised standard data protection clauses;
Appropriate contractual safeguards;
Recognised data protection frameworks;
Other protective measures provided for by law.

Disclosure may also take place where a statutory exception applies, for example on the basis of explicit consent or where the disclosure is directly connected with the conclusion or performance of a contract.

12. Data security

We take appropriate technical and organisational measures to protect personal data, in particular against loss, misuse, unauthorised access, unauthorised disclosure, alteration or destruction.

Access to our website is secured using transport encryption via SSL/TLS or HTTPS.

Depending on the nature of the data processing, our security measures include, in particular, technical safeguards, access restrictions and organisational processes.

Despite appropriate security measures, absolute security cannot be guaranteed when information is processed and transmitted electronically.

13. Website and Wix.com

Our website is created and operated using the Wix.com platform.

The provider is, in particular:

Wix.com Ltd.
Nemal St. 40
6350671 Tel Aviv
Israel

Wix provides us, in particular, with the technical platform, hosting infrastructure, databases, security features and other functions for operating our website.

In connection with visiting and using our website, Wix may process, in particular, the following data:

IP address;
Date and time of access;
Browser type and version;
Operating system;
Device information;
Pages and content accessed;
Referrer information;
Technical log and diagnostic data;
Cookie and usage data;
Data entered in forms.

Wix may process personal data through its own companies and contracted service providers in various countries.

Where Wix processes personal data of visitors to our website on our behalf, it does so under the relevant contractual data processing agreements.

Wix's privacy policy also applies to its processing of data.

14. Server log data

When you access our website, technical information may be collected automatically and stored in server log files.

This may include, in particular:

Date and time of access;
IP address;
Browser and browser version;
Operating system;
Device used;
Page or file accessed;
Volume of data transferred;
Referrer URL;
Technical status and error codes.

This information is required, in particular, to provide our website reliably and securely, detect technical errors and ensure data security.

15. Cookies and similar technologies

Our website uses cookies and similar technologies.

Cookies are small files or data records stored in the browser or on the device.

In particular, we distinguish between:

Necessary cookies
These are required for the technical operation, security and basic functions of our website.

Functional cookies
These enable additional functions and may, for example, store preferences.

Analytics and statistics cookies
These may be used to understand how our website is used and how we can improve it.

Marketing cookies
These may be used to measure the effectiveness of marketing activities or to display more targeted content.

Where required by law, we use non-essential cookies and similar technologies only after you have given your consent.

You can manage your choices through the cookie settings provided on our website and can generally change or withdraw them at any time with effect for the future.

Cookies can also be deleted or blocked through your browser settings. This may restrict certain functions of our website.

16. Wix Analytics and website statistics

We may use the analytics and statistics functions provided by Wix to understand how our website is used.

For example, the following information may be analysed:

Number of website visits;
Pages accessed;
Approximate geographical origin of visits;
Devices and browsers used;
Time spent on the website;
Traffic sources;
Interactions with the website.

This information is used, in particular, to analyse our online services, identify technical problems, and improve content and usability.

Where this involves the use of non-essential cookies or similar technologies, the relevant processing takes place only after you have given your consent, insofar as this is required by law.

17. Google services

We use various services provided by Google.

The providers include, in particular:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

and

Google LLC
1600 Amphitheatre Parkway
Mountain View, CA 94043
USA

In connection with the use of Google services, personal data may be processed, in particular, in Ireland, the USA and other countries.

Google's privacy policy also applies to its processing of data.

17.1 Google Tag Manager

We use Google Tag Manager.

Google Tag Manager allows us to integrate and manage tags and other services on our website centrally.

Such tags can be used to control analytics, statistics, marketing and other technical services in particular.

Google Tag Manager primarily serves to manage and trigger the integrated services. In this process, technical information and log data may be transmitted to Google.

The personal data processed by a service integrated through Google Tag Manager depends on the particular service and is described accordingly in this privacy policy.

Where Google Tag Manager is used to integrate services requiring consent, those services are activated only after the relevant consent has been given, insofar as this is technically and legally required.

17.2 Google Analytics

We use Google Analytics to analyse the use of our website and improve our online services.

Google Analytics can be used, in particular, to analyse information about:

How many people visit our website;
Which pages and content are accessed;
How long visitors spend on individual pages;
Which websites, search engines or campaigns lead visitors to our website;
Which devices, operating systems and browsers are used;
How users interact with our website;
The approximate geographical regions from which visits originate.

In particular, the following data may be processed:

IP address;
Device and browser information;
Technical identifiers;
Usage and interaction data;
Referrer information;
Approximate location information;
Time and duration of visits.

Google Analytics may use cookies and similar technologies.

Where required by law, we use Google Analytics only after you have given your consent. You may withdraw consent at any time with effect for the future through the cookie settings on our website.

We may integrate Google Analytics through Google Tag Manager.

17.3 Google Maps

We use Google Maps to display maps, locations and directions on our website.

When Google Maps is accessed, a connection to Google's servers may be established.

In particular, the following information may be transmitted to or processed by Google:

IP address;
Browser and device information;
Date and time of access;
Website accessed;
Location information, provided that the device or browser permits access to it.

If you are also signed in to a Google account, Google may be able to associate the relevant information with your Google account.

Where consent is required to integrate Google Maps, the service is loaded only after the relevant consent has been given.

17.4 Google Fonts

We use fonts from Google Fonts to give our website a consistent and appealing appearance.

According to Wix, when Google Fonts are used in the standard way within Wix, the relevant font files are provided locally through Wix's infrastructure. In this case, loading the fonts does not establish a direct connection between the user's browser and Google's servers.

If Google Fonts are loaded directly from Google's servers through a custom or external integration, the browser may establish a connection to Google. In this process, the IP address and technical browser and device information, in particular, may be transmitted to Google.

17.5 Google Search Console / Google Webmaster Tools

We use Google Search Console, which was previously known, among other names, as Google Webmaster Tools.

We use Google Search Console, in particular, to:

Monitor the visibility of our website in Google Search;
Statistically analyse search queries and search rankings;
Identify technical problems with the indexing of our website;
Obtain information about how our website appears in search results;
Improve the technical quality and search engine optimisation of our website.

Google Search Console is generally not an analytics tool that tracks the behaviour of individual visitors through additional tracking code on our website.

Through Google Search Console, we receive, in particular, aggregated information or information provided by Google about the visibility and performance of our website in Google Search.

Google's processing of data in this context is governed by Google's privacy policy.

18. Newsletters through Wix

We send newsletters and other electronic communications to provide information about our offers, services, news, events and other relevant content.

We use Wix.com functions to manage and send our newsletters.

When you subscribe to our newsletter, we process, in particular:

Your email address;
Your name, where applicable;
The date and time of your subscription;
Information about your consent;
Technical information about your subscription;
Information about your use of our newsletters, where applicable.

We generally send newsletters on the basis of your consent, unless another legal basis applies.

18.1 Measuring effectiveness and reach

Newsletters may contain technical elements that can be used, in particular, to determine:

Whether a newsletter was delivered;
Whether a newsletter was opened;
Which links within a newsletter were clicked.

This information may be used for statistical analysis and to improve our newsletters.

18.2 Unsubscribing

You can unsubscribe from the newsletter at any time.

Each newsletter generally includes an option to unsubscribe.

By unsubscribing, you withdraw your consent to receive future newsletters.

This does not affect communications required to provide our services or comply with legal obligations.

19. Online appointment booking through OneDoc

We use OneDoc for online appointment booking.

Patients can use OneDoc to book, manage, reschedule or cancel appointments with us online.

In connection with appointment booking, the following personal data, in particular, may be processed:

Surname and first name;
Date of birth;
Email address;
Telephone number;
Requested appointment;
Type of treatment or service requested;
Information about the treating professional;
Comments provided voluntarily;
Medical information and health data, where applicable;
Technical usage and connection data.

This data is processed to arrange and manage appointments, communicate in connection with the appointment and, where applicable, prepare for treatment.

As booking an appointment may allow conclusions to be drawn about health concerns, or health data may be collected directly, the data may constitute sensitive personal data.

OneDoc as a medical appointment booking system

OneDoc is specifically designed for appointment management in healthcare. According to OneDoc:

Data is hosted in Switzerland;
Data is stored in encrypted form and transmitted over encrypted connections (SSL/TLS);
OneDoc is certified under ISO 27001 (information security) and the Swiss data protection certification scheme (VDSZ);
OneDoc upholds medical confidentiality.

OneDoc's privacy policy also applies when using OneDoc.

If OneDoc is embedded in our website or accessed via a corresponding link, technical information, including, in particular, the IP address, browser and device information, and the time and type of access, may be transmitted to OneDoc.

Using OneDoc to book appointments online is voluntary. Appointments can also be arranged through the other contact options we provide.

19.1 Handling cancellations and missed appointments

If an appointment is cancelled, rescheduled or missed, or an appointment request does not result in a booking, we retain the relevant appointment data only for as long as necessary for appointment management, any follow-up enquiries and any billing.

If no consultation has taken place, this data does not form part of the patient documentation. It is generally deleted no later than 12 months after the appointment concerned.

If an invoice has been issued for an appointment that was not cancelled or was cancelled too late, we retain the data required for this purpose in accordance with the statutory retention obligations for business records, generally for 10 years.

If a consultation takes place, the data becomes part of the patient documentation and is retained in accordance with statutory documentation and retention obligations (see Section 9).

OneDoc's retention rules also apply to booking data stored by OneDoc.

19.2 Waiting lists

If your preferred appointment is unavailable, you can ask to be placed on a waiting list. For this purpose, we process, in particular, your name, contact details and preferred appointment.

If a slot becomes available, we notify you by email or telephone.

Your data remains on the waiting list for a maximum of 3 months. Before this period expires, we may ask whether you are still interested. If you confirm that you are, the period is extended by a further 3 months.

Your data is removed from the waiting list if:

You have been given an appointment;
The period has expired and you have not confirmed your continued interest;
You ask to be removed from the waiting list or request deletion of your data.

You can ask to be removed from the waiting list at any time.

19.3 Video consultations through Microsoft Teams

We conduct video consultations through Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, a subsidiary of Microsoft Corporation (USA).

Data processing

To establish the connection and conduct the video consultation, technical data such as the IP address, device and browser information, the displayed name and the time of participation is transmitted to Microsoft;
We do not record the video consultation or store any audio or video recordings;
Medical confidentiality applies in full during video consultations as well.

Your surroundings

Please take part in the video consultation from a quiet, private place where no one can inadvertently overhear or see the consultation. You are responsible for ensuring a private environment on your side.

Recordings by patients

Recordings of the video consultation, whether audio, video or screen recordings, are permitted only with our prior express written consent. Recording a non-public conversation without the consent of all participants may violate personal rights and constitute a criminal offence.

Data protection at Microsoft

Microsoft's privacy policy (https://privacy.microsoft.com/de-ch/) also applies to its processing of data. Microsoft may also process data outside Switzerland, particularly in the EU and the USA (see Section 11).

20. Social media

We may maintain a presence on social media and other online platforms to provide information about our activities and services and communicate with interested persons.

When you visit these platforms, the respective operators generally process personal data as independent controllers.

In this context, personal data may also be processed outside Switzerland.

The respective platform operators' terms of use and privacy policies also apply.

21. Third-party content and services

Our website may contain or integrate additional content and services from third-party providers.

It may be technically necessary for the relevant third-party provider to receive technical information, such as the user's IP address, at least temporarily.

Where such services are not technically necessary and consent is required by law, they are activated only after the relevant consent has been given.

The respective third-party providers' privacy policies also apply to their processing of data.

22. Rights of data subjects

Under applicable data protection law, persons whose personal data we process have, in particular, the right to:

Request information about whether we process their personal data and, if so, which data;
Have inaccurate personal data corrected;
Request the deletion of personal data, provided that no statutory retention obligations or other legal grounds prevent this;
Request the delivery or transfer of certain personal data, provided that the legal requirements are met;
Withdraw consent with effect for the future;
Object to specific data processing where this is provided for by law.

The exercise of these rights may be restricted, postponed or excluded by law, particularly where statutory or medical retention and documentation obligations apply.

To exercise your rights, you can contact the controller named in Section 1.

We may request appropriate proof of your identity.

Data subjects may also contact the competent data protection supervisory authority.

In Switzerland, this is the:

Federal Data Protection and Information Commissioner (FDPIC)

23. Questions about data protection

If you have questions about the processing of your personal data or this privacy policy, you can contact us at:

Oh yes baby yes GmbH
Zähringerplatz 11
8001 Zürich
Switzerland

You can find our electronic contact options on our website.

24. Changes to this privacy policy

We may amend or supplement this privacy policy at any time, particularly if our data processing activities, the services we use or legal requirements change.

In particular, we reserve the right to expand this privacy policy if we introduce new activities, business areas, offers, services, distribution channels or technical functions. Examples include operating an online shop, selling products, online payment functions, customer accounts, booking or advisory services, mobile applications and other digital services.

In such cases, we may supplement this privacy policy with the relevant processing purposes, data categories, recipients and service providers used, or provide additional or separate privacy policies and other legal documents, such as general terms and conditions.

The current version published on our website applies in each case.

For significant changes, we may also provide notification in an appropriate form.