Privacy Policy

Therawil GmbH
Zürcherstrasse 66, 8800 Thalwil, Switzerland
Email: info@therawil.ch
Telephone: +41 79 899 89 42

For information, rectification and erasure requests, please contact info@therawil.ch. If you would like to send us health data, please use our secure HIN address therawil@hin.ch - ordinary email is unencrypted and not suitable for sensitive information.

We have not appointed a data protection adviser within the meaning of Art. 10 nFADP; we are not required to do so.

We process personal data in good faith, proportionately and only for the purpose stated at the time of collection. We do not collect more data than we need for that purpose and do not keep it longer than necessary.

The legal basis is the Swiss Federal Act on Data Protection (nFADP). Where the European General Data Protection Regulation (GDPR) applies to you, we base the processing, depending on the case, on the performance of a contract (Art. 6(1)(b) GDPR), on a legal obligation (point (c)), on your consent (point (a), and for health data additionally Art. 9(2)(a)) or on our overriding legitimate interest in the secure and functioning operation of our website (point (f)). The treatment itself is based on Art. 9(2)(h) GDPR.

a) Server log data. Every time the site is accessed, technically necessary data is logged: IP address, date and time, page or file requested, volume of data transferred, status code, browser type and version, operating system and, where applicable, the referring page. This data is required in order to deliver the website, detect faults and repel attacks. We do not use it to identify you and do not combine it with other data.

b) Hosting and security. The website runs on a server in Switzerland. Upstream of it is a content delivery and security network that filters malicious traffic, encrypts the connection and speeds up delivery; technically necessary cookies may be set in the process (see section 4). This service is provided by a supplier with a worldwide network, which is why connection data may also be processed outside Switzerland (see section 12). Data processing agreements are in place with the suppliers involved.

c) Visitor statistics with Google Analytics - only with your consent. In order to understand which pages are read and where visitors get stuck, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Cookies are set in the process and usage data - including pages viewed, time spent, approximate location, device and browser - is transferred to Google. Your IP address is used only to derive the approximate location; according to Google, IP addresses of visitors from Switzerland, the EU and the United Kingdom are neither logged nor stored. Data may reach the USA in the process.

This happens only once you have consented. As long as you have not consented, Google’s script is not loaded at all and not a single request goes to Google. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. We have limited data retention to 14 months, the shortest period Google Analytics offers apart from two months. Our Google Analytics account is not linked to any advertising account; we do not use the statistics to serve you advertising.

What we record. Besides the pages viewed and the time spent, we record how far down a page you read, which exercise sheets and forms you download, clicks on links to third-party websites, clicks on our telephone number and our e-mail address, the loading of the map and the appointment calendar, the submission of the contact form and of the newsletter sign-up, changes of language and appearance, and requests for a page that does not exist. Only the fact that the action took place is transmitted, together with the page it happened on. What you type into a form is never sent to Google, including your name and your message.

Google signals. If you have consented, Google supplements the statistics with data from Google accounts. If you are signed in to Google and have agreed to personalised advertising there, Google links your visit to your account and provides us with information on age group, gender and interests, as well as whether the same person visited the website on several devices. We receive this information in aggregated form only and never for individual people; Google withholds it as long as there are too few visits to rule out re-identification. You can view and delete the data Google holds for your account at any time under My Activity.

We do not use advertising networks or social media plug-ins, and we do not serve you advertising.

A cookie is a small text file that your browser stores. We only set cookies and storage entries that are necessary for operation:

The two Google cookies are only set if you have consented; if you withdraw consent, we delete them. The XSRF-TOKEN cookie is set by TBooking itself as soon as the booking calendar loads; it disappears when you close the browser. We cannot delete it, because it is not ours - but you can remove it in your browser at any time. The remaining entries are required for secure operation or are based on your own choice. You can block or delete cookies in your browser generally - the website remains usable, but your language choice will then be determined afresh on every visit.

Third-party content (booking calendar, map) is loaded only after your click. As long as you do not click, no connection is made to these providers and no cookies are set by them. Details in section 7 and 8.

When you call, write to us or send an email, we process the information you give us - usually your name, contact details and the content of your enquiry - in order to answer it. In the case of an enquiry about starting treatment, this may also include health data. We keep the correspondence for as long as is necessary to deal with it and with any follow-up questions, after which we delete it. If the enquiry leads to treatment, it becomes part of the medical record (section 10).

Contact form. A form is available on the contact page. What you enter is transmitted: name, email address, your telephone number if you wish, and your message, together with the language version and the page from which you sent it. We use no third-party form service for this - the enquiry runs via our own server in Switzerland and goes from there as an email to our practice mailbox.

On the server the enquiry is processed solely for forwarding and is not stored permanently: the content remains there for around one hour at most and is then deleted automatically and permanently. If delivery fails, the enquiry stays in the error log for up to 14 days so that we can fix the fault; after that it too is deleted automatically. Your enquiry then exists only as an email in our mailbox and is kept like the rest of our correspondence. To prevent automated misuse, the form contains a field that is invisible to you, and the number of submissions per IP address is limited; no further data is collected.

Please do not send us health data by ordinary email, via WhatsApp or through this form. Use therawil@hin.ch or the telephone instead.

You can subscribe to our newsletter on this website. For this we process first name, surname and email address - nothing more. We additionally record which language version you signed up in and at which point on the website, as well as the time of sign-up and of confirmation.

Double confirmation. After you submit the form you receive an email with a confirmation link. Only once you click it do we add you to the distribution list. This ensures that nobody enters someone else’s address, and allows us to demonstrate that the consent came from you. If you do not click, the sign-up remains unconfirmed and is deleted after 30 days.

The legal basis is your consent. You may withdraw it at any time and without giving reasons - via the unsubscribe link in every newsletter email or informally to info@therawil.ch. After withdrawal we delete your details, unless we still have to keep them as evidence of the earlier consent.

The details are held in a database on our own server in Switzerland. We use no mailing service provider such as Mailchimp or Brevo; your address does not leave our infrastructure and is neither sold nor passed on. Dispatch runs via our Swiss email provider (see section 11). No performance measurement takes place: we do not count opens and do not track clicks.

If you tick the newsletter box in the contact form, the same procedure applies. The box is never pre-ticked, and your enquiry will of course be answered even if you leave it empty.

For appointment booking we use the TBooking service (tbooking.ch), operated by Pharmed Solutions AG, Binzmühlestrasse 97, 8050 Zurich. The calendar is loaded as an embedded window from www.tbooking.ch.

We load this window only once you have consented - either in the notice that appears on your first visit, or with a click on the area where the calendar would be. Without consent no connection is made. As soon as it loads, TBooking receives your IP address and technical details about your browser and can set its own cookies. The details you enter in the calendar - name, contact details, preferred appointment and possibly a reason - are stored at TBooking and made available to us. The purpose is solely the arrangement, confirmation of and reminder about your appointment. According to the provider, the data is hosted in Switzerland.

The TBooking privacy policy additionally applies.

You can arrange an appointment by telephone or email at any time without using the service.

On the contact page we offer a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is loaded only after your consent - either in the notice that appears on your first visit, or with a click on the area where the map would be. A connection to Google is then made; Google receives your IP address in the process and can set cookies. If you are logged in to a Google account at the same time, Google can associate the request with your account. Data may be transferred to the USA in the process.

The legal basis is your consent. You may withdraw it at any time - most simply with the switches in section 3c of this policy; a “Consent” link in the footer of every page leads straight there. The map, the booking calendar and visitor statistics can be switched on and off individually, and every change takes effect immediately.

Information from Google: policies.google.com/privacy

You can find us without the map as well - the travel directions on the contact page contain everything you need.

You can download the documents offered in the “For referrers” section without registering. We collect no personal data in the process; the download appears only in the server log data described in section 3.

Once you are in treatment with us, we process the data required for careful therapy: personal particulars, contact details, insurance and billing data, medical prescription, findings, therapy goals, progress documentation, reports and correspondence. This constitutes sensitive personal data (Art. 5(c) nFADP).

Purpose and basis. The processing serves assessment, treatment, documentation and billing. It is based on the treatment contract with you as well as on legal obligations, in particular the duty to keep a medical record under the Health Act of the Canton of Zurich.

Professional secrecy. We are bound by professional secrecy under Art. 321 of the Swiss Criminal Code. Disclosure to third parties takes place only if you release us from it, if there is a legal duty or authorisation, or if the competent authority releases us from it.

Practice software. For appointment scheduling, keeping the medical record and billing we use the practice software eErgo. It is operated by Pharmed Solutions AG, Binzmühlestrasse 97, 8050 Zurich - the same provider as for the booking calendar. It is a web-based application; according to the provider, the data is hosted exclusively in Switzerland with a supplier certified to ISO 27001. Pharmed Solutions AG processes this data solely on our behalf and on our instructions and is contractually bound to confidentiality and to appropriate security measures.

Appointment reminders. On request we remind you of your appointment by SMS. Your name and the appointment are transferred to an SMS service provider in the process. No health data is included.

Electronic dispatch of invoices to the payers also takes place via eErgo, through an intermediary in Switzerland.

Recipients. Within this framework we pass data on to:

• your referring doctor as well as specialists providing concurrent or follow-up treatment, in so far as this is necessary for the treatment and you agree to it;
• your health insurer or its medical adviser service, in so far as this is necessary for cost coverage and billing;
• accident, disability or military insurance, where it is the payer;
• the provider of our practice software as well as the body through which electronic invoicing to insurers is handled.

Reports are sent to doctors in encrypted form via the health network HIN (Health Info Net AG, Switzerland).

Retention. We keep the medical record in accordance with cantonal health law for at least ten years after the last treatment. It is then destroyed in a data-protection-compliant manner.

For all systems we use suppliers that host in Switzerland. The only exception is the upstream security and delivery network of the website and the map that you load yourself with a click.

On request we are happy to name the specific suppliers behind these categories.

We contractually oblige our processors to process personal data only as we ourselves would be permitted to, and to take appropriate security measures.

Our systems are operated in Switzerland. In three cases data may nevertheless reach other countries:

• via the upstream security and delivery network of the website, whose provider is based in the USA and operates a worldwide network;
• via the map on the contact page, which you load yourself with a click (Google, Ireland and USA);
• via visitor statistics, provided you have consented to them (Google, Ireland and USA).

In all three cases this concerns connection and usage data of this website, not treatment data. For transfers to countries without recognised adequate data protection we rely on the European Commission’s standard contractual clauses in the version recognised by the FDPIC and on supplementary safeguards. Despite these measures it cannot be ruled out that authorities in the recipient country access data.

Health data from treatment is not transferred abroad. The practice software, the online booking calendar, SMS dispatch, electronic invoicing and the secure sending of reports via HIN are all operated in Switzerland without exception; the details are in section 11.

We take appropriate technical and organisational measures: encrypted transmission (TLS/HTTPS with HSTS), access for authorised persons only, encrypted sending of health data via HIN, secure storage of treatment documentation and regular updating of the software used. Nobody can guarantee absolute security when transmitting over the internet; please therefore do not send us sensitive information by ordinary email.

Within the framework of the applicable law you have the right:

• to request information as to whether and which personal data we process about you (Art. 25 nFADP);
• to have incorrect data corrected;
• to request erasure or restriction of processing, in so far as no statutory retention obligation stands in the way;
• to object to processing;
• to withdraw consent given at any time with effect for the future;
• to request certain data in a common electronic format or have it transferred to another body (Art. 28 nFADP).

Please contact info@therawil.ch for this. To protect your data we must be able to establish your identity beyond doubt; we may therefore ask you for suitable proof. Information is provided free of charge as a matter of principle.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. If the GDPR applies to you, you may in addition approach a supervisory authority in your country of residence.

We do not take decisions that produce legal effects concerning you or significantly affect you and that are based solely on automated processing. We do not carry out profiling.

We may adapt this privacy policy at any time, for example if our services or the legal situation change. The version published on this website at any given time is authoritative.

Version of 1 September 2026