Privacy Policy

Therawil GmbH
Zürcherstrasse 66, 8800 Thalwil, Switzerland
Email: info@therawil.ch
Telephone: +41 79 899 89 42

For information, correction or deletion requests, please contact info@therawil.ch. If you wish to send us health data, please use our secure HIN address therawil@hin.ch; ordinary email is not encrypted end to end.

We have not appointed a data protection adviser within the meaning of Art. 10 nFADP; we are not required to do so.

We process personal data in good faith, proportionately and only for the purpose stated at the time of collection. We do not collect more data than we need for that purpose and do not keep it longer than necessary.

The legal basis is the Swiss Federal Act on Data Protection (nFADP). Where the European General Data Protection Regulation (GDPR) applies to you, we base the processing, depending on the case, on the performance of a contract (Art. 6(1)(b) GDPR), on a legal obligation (point (c)), on your consent (point (a), and for health data additionally Art. 9(2)(a)) or on our overriding legitimate interest in the secure and functioning operation of our website (point (f)). The treatment itself is based on Art. 9(2)(h) GDPR.

a) Server log data. Each visit logs technically necessary data such as IP address, time, page requested, browser and operating system. We need it to deliver the website, detect faults and fend off attacks, and do not use it to identify you.

b) Hosting and security. The website runs on a server in Switzerland. It sits behind a security and delivery network operated by Cloudflare, Inc. (USA), which filters malicious traffic and encrypts the connection. Technically necessary cookies may be set and connection data may be processed outside Switzerland (see section 4 and section 12).

Cloudflare also uses Web Analytics to measure how quickly our pages load. No cookies are set and no profiles are created; we only see aggregated figures. The basis is our legitimate interest in a fast and reliable website.

c) Visitor statistics and ad measurement, only with your consent. With your consent we use Google Analytics 4 and Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Cookies are then set and usage data is transmitted to Google, such as pages viewed, time spent, approximate location, device and browser; data may reach the USA.

Without your consent none of this is loaded. The basis is your consent, which you can withdraw at any time with effect for the future. We use this information to understand which content is read, where the website needs improving and whether our ads in Google Search lead to someone contacting us. We do not show ads on other websites and do not use social media plugins.

What we measure. Besides page views, we measure how the website is used, for example downloads, clicks on contact options, links and the map, form submissions and newsletter sign-ups, language changes and error pages. Only the fact that an action took place is transmitted, never what you enter in a form. The one exception is search terms in the download area, which are transmitted in shortened form; please do not enter anything about yourself or your health there.

Google signals. If you are signed in to Google and have agreed to personalised advertising there, Google adds aggregated information such as age group, gender and interests to the statistics. We receive no information about individual persons. You can view and delete your data at Google under My Activity.

A cookie is a small text file that your browser stores. We only set cookies and storage entries that are necessary for operation:

Google cookies are only set with your consent and are deleted if you withdraw it. The XSRF-TOKEN cookie is set by TBooking as soon as the calendar loads; it is necessary for its secure operation and disappears when you close the browser. You can block or delete cookies in your browser at any time; the website remains usable.

The Google map is loaded only after your consent. For the calendar and the map, see section 7 and 8.

If you call, write or email us, we process your details to answer your enquiry. We keep the correspondence for as long as necessary. If the enquiry leads to treatment, it becomes part of the medical record (section 10).

Contact form. What you enter is transmitted, together with the language version and the page you sent it from. The enquiry runs without any third-party form service via our own server in Switzerland and arrives as an email in the practice mailbox.

On the server the enquiry is only processed for forwarding and is not stored permanently. If delivery fails, it remains in the error log for a limited time so that we can fix the fault. To prevent misuse, the number of submissions per IP address is limited.

Please do not send us health data by ordinary email, via WhatsApp or through this form. Use therawil@hin.ch or the telephone instead.

For the newsletter we process your first name, last name and email address, together with the language version, the place on the website where you signed up and the times of sign-up and confirmation. The same applies if you tick the newsletter box in the contact form; it is never pre-selected.

Double opt-in. After submitting, you receive an email with a confirmation link. Only when you click it are you added to the list; this way no one can sign up an address that is not theirs.

The basis is your consent. You can withdraw it at any time, via the unsubscribe link in every newsletter or at info@therawil.ch.

The data is kept on our own server in Switzerland; mailing runs through our Swiss email provider. We use no newsletter service, do not pass on your address and measure neither opens nor clicks.

Protection against misuse. On submission, Cloudflare Turnstile checks that a human is filling in the form, and the same address only receives a limited number of confirmation emails. Turnstile is only loaded when you sign up for the newsletter; Cloudflare then receives your IP address and technical details about your browser and may set technically necessary cookies. The basis is our legitimate interest in preventing misuse (see section 12).

For appointment booking we use the TBooking service (tbooking.ch), operated by Pharmed Solutions AG, Binzmühlestrasse 97, 8050 Zurich. The calendar is loaded as an embedded window from www.tbooking.ch.

The calendar loads as soon as you open the booking page. TBooking then receives your IP address and technical details about your browser and sets a session cookie that protects your booking against forged requests. What you enter in the calendar is stored by TBooking and made available to us, solely to arrange, confirm and remind you of your appointment. According to the provider, the data is hosted in Switzerland.

We do not ask for consent for this: you request the calendar yourself by opening the page, and the cookie is necessary for its operation (Art. 45c lit. b of the Swiss Telecommunications Act). If you do not want this, block cookies in your browser or arrange your appointment by telephone or email. Pharmed Solutions AG processes the data as our processor.

The TBooking privacy policy additionally applies.

On the contact page we offer a Google Maps map (Google Ireland Limited). It is loaded only after your consent, either in the notice shown on your first visit or by clicking on the map area. Google then receives your IP address, may set cookies and may link the request to a signed-in Google account; data may reach the USA.

The basis is your consent. You can withdraw it at any time using the switches in section 3c, also reachable via “Consent” at the foot of every page. Information from Google: policies.google.com/privacy

You can download the documents in the download area without registering. The download appears in the server log data under section 3 and, if you have consented, in the visitor statistics.

Once you are in treatment with us, we process the data required for careful therapy: personal particulars, contact details, insurance and billing data, medical prescription, findings, therapy goals, progress documentation, reports and correspondence. This constitutes sensitive personal data (Art. 5(c) nFADP).

Registration at reception. At your first treatment you enter your details and signature on a device belonging to the practice. They are transmitted in encrypted form to our own server in Switzerland, kept there temporarily and become part of your medical record as a signed document in our storage in Switzerland. We transfer your personal details into the practice software.

Purpose and basis. The processing serves assessment, treatment, documentation and billing. It is based on the treatment contract with you as well as on legal obligations, in particular the duty to keep a medical record under the Health Act of the Canton of Zurich.

Professional secrecy. We are bound by professional secrecy under Art. 321 of the Swiss Criminal Code. Disclosure to third parties takes place only if you release us from it, if there is a legal duty or authorisation, or if the competent authority releases us from it.

Practice software. For scheduling, medical records and billing we use eErgo from Pharmed Solutions AG, Zurich, which also operates the appointment calendar. According to the provider, the data is hosted in Switzerland. Pharmed processes it solely on our behalf. Electronic billing to payers also runs through eErgo and a clearing office in Switzerland.

Appointment reminders. On request we remind you of your appointment by SMS. Your name and the appointment are transferred to an SMS service provider in the process. No health data is included.

Recipients. Within this framework we pass data on to:

• your referring doctor as well as specialists providing concurrent or follow-up treatment, in so far as this is necessary for the treatment and you agree to it;
• your health insurer or its medical adviser service, in so far as this is necessary for cost coverage and billing;
• accident, disability or military insurance, where it is the payer;
• the provider of our practice software as well as the body through which electronic invoicing to insurers is handled.

Reports are sent to doctors in encrypted form via the health network HIN (Health Info Net AG, Switzerland).

Retention. We keep the medical record for as long as cantonal health law requires and then destroy it in compliance with data protection.

We use processors who handle data on our behalf. Treatment data stays in Switzerland; section 12 explains when website data may go abroad.

On request we are happy to name the specific suppliers behind these categories.

We contractually oblige our processors to process personal data only as we ourselves would be permitted to, and to take appropriate security measures.

We operate our own systems in Switzerland. For the website, data may go abroad in three cases:

• through the upstream security and delivery network of Cloudflare, Inc. (USA), including Web Analytics and Turnstile;
• through the map, if you have consented to it (Google, Ireland and USA);
• through visitor statistics and ad measurement, if you have consented to them (Google, Ireland and USA).

For recipients certified under the Swiss-U.S. Data Privacy Framework, the USA is considered to provide adequate data protection. Where this does not apply, we rely on the standard contractual clauses recognised by the FDPIC. Access to data by authorities in the recipient country cannot be entirely ruled out.

We do not transfer health data from treatment abroad. According to the provider, the practice software and the online calendar are operated in Switzerland; reports are sent securely via HIN.

We take appropriate technical and organisational measures, such as encrypted transmission, access only for authorised persons and sending health data via HIN. No one can guarantee complete security when transmitting over the internet.

Within the framework of the applicable law you have the right:

• to request information as to whether and which personal data we process about you (Art. 25 nFADP);
• to have incorrect data corrected;
• to request erasure or restriction of processing, in so far as no statutory retention obligation stands in the way;
• to object to processing;
• to withdraw consent given at any time with effect for the future;
• to request certain data in a common electronic format or have it transferred to another body (Art. 28 nFADP).

Please contact info@therawil.ch for this. To protect your data we must be able to establish your identity beyond doubt; we may therefore ask you for suitable proof. Information is provided free of charge as a matter of principle.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. If the GDPR applies to you, you may in addition approach a supervisory authority in your country of residence.

We do not take decisions that produce legal effects concerning you or significantly affect you and that are based solely on automated processing. We do not carry out profiling.

We update this statement when our services or the legal situation change. The version published on this website applies.

Version of 30 September 2026