Privacy Policy · gynxtra GmbH

1 · Data Controller

Controller for data processing within the meaning of Art. 5 lit. j revDSG:

gynxtra GmbH
Höschgasse 50, 8008 Zurich
Switzerland
UID: CHE-424.531.460
Commercial register: CH-020.4.078.662-7

Medical lead and licence holder: Dr. med. Bettina von Seefried, FMH Gynaecology

Data protection enquiries: hello@gynxtra.ch

2 · What Data We Process

2.1 Identification and Contact Data

Surname, first name, date of birth, postal address, email address, phone number (required when booking, so that your physician can reach you with follow-up questions or if the video connection drops), profile picture (optional).

2.2 Health Data (sensitive personal data within the meaning of Art. 5 lit. c revDSG)

• Medical history and follow-up data (family and personal medical history, symptoms, lifestyle)
• Symptom and wellbeing tracking: self-reported ratings on a scale for sleep, mood, hormones, intimacy, body and weight
• Cycle information (cycle status, bleeding days)
• Free-text entries from check-ins (concerns, changes since the last check-in, topics for the next consultation)
• Body measurements and vital signs (weight, blood pressure, others where indicated)
• Laboratory values (hormone levels, HbA1c, lipid profile, vitamin D, other indicated markers)
• Prescribed medications, dosages, adherence, side effects and feedback on requested therapy adjustments
• Consultation records (medical notes, treatment plan, report, medical certificate)
• Off-label information sheets and signed consents

2.3 Usage and Interaction Data

• Login and session data in the Patient Cockpit
• Interaction with content (click paths, feature usage)
• Device information (browser, operating system, IP address - processed in truncated form)
• Origin of your visit: the first page of your visit (pages on individual symptoms and knowledge articles only in generalised form), campaign details from the link without the search term, the name of the website you came from, and the button that brought you to the calendar; with your consent to third parties, also the click identifier from Google or Meta if you came via an ad
• The page from which you went to the calendar, for example the page on sleep problems, a landing page or the home page. After a booking it can point to a health topic; we then treat it like health data (section 9.3)
• Status of your privacy setting (consent to third parties yes or no, version of the banner text, time)
• Times along the booking path (day and time selected, booking page opened)

2.4 Payment Data

• First and last name, billing address
• Selected appointment and the booking reference at Cal.com
• Amount, time of payment and any refunds
• For a booking via our booking form: the booking number and which version of our terms and conditions and of this privacy policy applied when you clicked «Continue to payment», with the time
• Stripe transaction IDs (card details are processed directly by Stripe and are not accessible to gynxtra)

2.5 Communication Data

• Email history
• Video call metadata (duration, time)
• Recording and transcript of the video consultation, only with your consent

With your consent, the physician records the video consultation and has it transcribed automatically, so that she can focus fully on you during the conversation. The transcript and her notes are used to draft your medical report, which the physician reviews and edits. For this we use the medical transcription services Corti and Isaac (section 4). The physician asks you at the start of the conversation whether you agree and notes your answer. If you say no, the consultation takes place without recording, with the same services. You can withdraw your consent at any time, including during the conversation; the physician then stops the recording. We delete the recording and the transcript no later than five days after the conversation. The final report and the physician's notes become part of your patient record (terms and conditions, clause 4.5).

3 · Purposes of Data Processing

4 · Recipients and Subprocessor List

We engage the following service providers. Where they process personal data on our behalf, a Data Processing Agreement (DPA) governs the purpose, the scope and their obligation to follow our instructions. The «Location» column states where the data is held and on what basis any transfer outside Switzerland takes place.

Note on Google: For the pure measurement, Google acts as a processor. To the extent the measurement data is linked to the Google Ads account and used for advertising purposes, Google is an independent controller in that respect. This collection only takes place with your explicit consent (opt-in in the cookie banner) and contains no health data.

How booking the medical consultation works

You book on our booking page via our own booking form with first name, last name, email address and phone number. While we are introducing it, and whenever it is not available, the page shows Cal.com's booking form instead. The last paragraph applies to that route.

When you submit our form, your details, the selected time and the random identifier of your visit (section 9.3) go to our server in Frankfurt. It checks with Cal.com whether the time is still available and stores your details as an open booking. Cal.com learns nothing about you at this point. You then pay with Stripe, on a Stripe page or in Stripe's payment field on our booking page.

From us, Stripe receives your email address for the payment and the receipt, the amount, the description "Medical consultation", our booking number, the language of the page and the selected time, on the Stripe page in the return address, with the payment field in the address of our booking page. With the payment field, Stripe also receives the version number of our terms and conditions. Stripe does not receive your name, your phone number or the identifier of your visit from us. Stripe does, however, learn that you are paying us for a medical consultation. That, too, says something about your health. Anything else Stripe needs for the payment you enter directly with Stripe, or your wallet transmits it with Apple Pay and Google Pay. Depending on the payment method, besides your card details this may include your country, postcode or name. We never see your card details. Stripe also processes payment data under its own responsibility for fraud prevention and its legal obligations.

With the payment field, your browser loads a Stripe program (Stripe.js), only after you click «Continue to payment» and only on the booking page. Before that, we remove everything from the address except the time and a fixed page marker, and from the tab's storage the origin of your visit, the page from which you went to the calendar and any click identifier from an ad. Stripe sees only gynxtra.ch as the origin. For fraud detection, Stripe.js records your IP address and technical details about your device, browser and interaction with the page, and sets cookies (9.1). To detect automated access, Stripe also integrates the hCaptcha service. It is operated on Stripe's behalf by Intuition Machines, Inc. in the USA. hCaptcha likewise receives your IP address and technical details about your device and browser, directly from your browser. Stripe is independently responsible for this processing as part of its fraud prevention. Intuition Machines is certified under the Swiss-U.S. Data Privacy Framework (section 5). You enter your payment details in Stripe's fields. If you then leave the booking page, the next page reloads fully so that Stripe.js does not keep running there.

If you choose Klarna with Stripe, Stripe forwards you to Klarna. Klarna then receives our name, the amount and, with our booking form, the name of the service, and therefore knows that you are paying us for a medical service. You enter your other details directly with Klarna. Klarna shows the purchase in your Klarna account and processes the information under its own responsibility, for example for a credit check; Klarna's privacy notice applies to this. This also applies to the payment step in Cal.com's form. If you do not want this, pay by card, Apple Pay or Google Pay. If you pay with Apple Pay or Google Pay, Apple's or Google's privacy terms also apply.

After your payment, our server creates the appointment with Cal.com. For this, Cal.com receives your name, your email address, language and time zone as well as our booking number, and sends the confirmation, the calendar invitation and the video link. Your phone number and the identifier of your visit do not go to Cal.com. If you do not yet have an account in the patient area, we then set it up with the name, email address and phone number from the form. If the time has been taken in the meantime, our server books a replacement appointment for you with Cal.com using the same details, the next available appointment after the selected time (section 6.6 of our terms and conditions). We send you an email straight away, also store the originally selected time with the booking, and our team receives a notification by email. If there is no replacement appointment or the appointment cannot be created for another reason, we refund the full amount via Stripe and send you an email.

You can reschedule or cancel via the links in Cal.com's emails. Cal.com notifies us of every rescheduling and cancellation. In clear cases our server issues the refund automatically via Stripe, for example if you cancel at least 24 hours before the appointment (section 6.5 of our terms and conditions), if you cancel a replacement appointment (section 6.6) or if we cancel the appointment. Our team looks at all other cases. Only our team can decline a refund, never the server on its own. If something goes wrong with a booking, for example with the payment or with creating the appointment, our team receives a notification by email.

For every booking via our form, we store which version of our terms and conditions and of this privacy policy applied when you clicked «Continue to payment». This lets us show on which terms you booked. The details from the form are never sent to Google Ads, Google Analytics, Meta or PostHog.

If you book via Cal.com's booking form, you enter your name, email address and phone number directly with Cal.com, and you pay in Cal.com's payment step with Stripe. The identifier of your visit then goes to Cal.com as a property of the booking (section 9.3). Rescheduling and cancellation are handled via Cal.com here as well.

5 · Third-Country Transfers

Some subprocessors process data outside Switzerland / the EU. Transfers take place on the basis of the following mechanisms pursuant to Art. 16 f. revDSG:

• USA: Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF, in force since 14 September 2024) for DPF-certified recipients. For non-certified recipients, EU Standard Contractual Clauses (SCC) additionally apply, including a Transfer Impact Assessment (TIA).
• EU / EEA (Ireland, Germany, Sweden): Adequate data protection under Annex 1 DSV (ordinance to the revDSG) - no additional mechanism required.
• Additional technical and organisational measures: pseudonymisation where possible, encryption in transit (TLS 1.3) and at rest (AES-256).

6 · Retention Periods

• Patient record (health data): at least 10 years after the last treatment (cantonal health law, HMG)
• Contract data / accounting: 10 years (OR Art. 958f)
• Booking via our booking form without payment: If you do not pay for a booking or cancel the payment, we delete the details from your booking form after 30 days. Stripe keeps the uncompleted payment session with your email address under its own rules.
• Booking via our booking form with payment: 12 months after the appointment, we replace your name, email address and phone number in the booking with a placeholder. Identifiers, amount, status of the booking, the versions of the terms and conditions and of the privacy policy and the times, for a replacement appointment also the originally selected time, remain as contract data (second line). If a patient record has been created for you, the first line applies to your name and contact details there.
• Our log of notifications from Cal.com (bookings, reschedulings and cancellations, including via Cal.com's form): 90 days, then only identifiers, appointment type, times and our processing notes, without name, contact details or answers from the form
• Measurement of the booking path (session line, origin, page before the calendar, times): 12 months, then only monthly totals without any link to individual people
• Recording and transcript of the video consultation (only with your consent): no later than 5 days after the conversation; the report and the physician's notes belong to the patient record (first line)
• Marketing and analytics data: up to 24 months
• Non-medical communication (support): 24 months
• After expiry, data is deleted or anonymised

7 · Your Rights

As a data subject, you have the following rights under revDSG (and, where applicable, GDPR):

• Access to the data processed about you (Art. 25 revDSG)
• Rectification of inaccurate data
• Erasure of your data (unless a statutory retention obligation applies)
• Restriction of processing
• Data portability in a machine-readable format
• Withdrawal of consents granted (effective for the future)
• Objection to processing based on a legitimate interest, in particular to the usage statistics (see section 9)
• Complaint to the FDPIC (Federal Data Protection and Information Commissioner), Feldeggweg 1, 3003 Bern

Please direct enquiries to hello@gynxtra.ch. We process enquiries within 30 days.

8 · Data Security

We implement appropriate technical and organisational measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256 in Supabase Storage)
• Row-level security at database level
• Audit logs for sensitive actions (prescription issuance, plan changes, off-label consents)
• Role-based access control (Patient, Coach, Doctor, Admin)
• Regular security reviews
• Obligation on all staff and processors to observe medical professional secrecy or confidentiality

9 · Cookies and Tracking

9.1 What your browser stores

On gynxtra.ch we use technically necessary cookies (session, authentication, storage of your privacy choice). They are required to operate the website and cannot be switched off. For the booking, your browser keeps in this tab's storage (sessionStorage) the selected time, the random identifier of your visit, the origin of your visit and the page from which you went to the calendar, plus markers without content, for example whether you reached the calendar via a button on our site. If you book via our booking form, the details from the form are added, so that they are still there if you cancel the payment, until the confirmation page deletes them. The confirmation page keeps the identifier of your booking, so that it still knows which booking to show after a reload. That way nothing is lost if you go back. Everything in the tab's storage disappears when you close the tab.

On some of our German-language landing pages for ads, the button first leads to four short questions (pre-check) before you see the calendar. Your browser keeps your answers only in this tab's storage (sessionStorage), as identifiers of the answers you selected. That way they are kept if you go back, and they appear at the top of the calendar under „Deine Antworten“ (your answers). They are not transmitted to us, to PostHog, Google or Meta, they are not evaluated and they are not linked to your booking. Your physician does not receive them; she works with your medical history, which you complete after booking. The questions are not a screening: everyone then reaches the same calendar. The answers disappear when you close the tab.

When you submit our booking form, our server also sets a technically necessary cookie. It contains only the booking number, the time and a signature, so that only your browser can query the status of your booking, and it expires after two hours.

Once the payment field has loaded, Stripe sets two of its own cookies on gynxtra.ch for fraud detection, __stripe_mid (one year) and __stripe_sid (30 minutes). Within the payment field, Stripe and the hCaptcha service integrated by Stripe (Intuition Machines, Inc., USA, section 4) set further cookies on their own domains to detect fraud and automated access, Stripe on m.stripe.com for up to 400 days, hCaptcha on hcaptcha.com for up to 30 days. Stripe is independently responsible for these cookies. You can block them in your browser, but the payment may then fail.

After a booking, your browser also stores a short check value with a time in local storage (localStorage) on the confirmation page, with either booking form, provided you have not objected to audience measurement. It is calculated from the identifier of your booking and does not contain it. This way our usage statistics (9.2) count the completion of a booking only once, even if you open the page several times or in several tabs. The check value remains after you close the tab. The confirmation page removes entries older than seven days the next time it shows a booking. You can remove it completely by clearing your browser storage.

9.2 Usage statistics with PostHog

We collect pseudonymised usage statistics with PostHog (EU Cloud, servers located in the EU) in order to understand which pages are viewed and where visitors drop off. For this purpose PostHog stores a randomly generated identifier in your tab's storage. It applies only to this visit and is discarded afterwards. The data is not combined into a profile over time. The legal basis is our legitimate interest in a functioning and comprehensible website (Art. 31(1) FADP). We inform you about the processing on your device in accordance with Art. 45c TCA.

We record which pages are viewed, including pages on individual treatment topics, which campaign details the link you came through contained, how long a page was open, how far it was scrolled and where on it people click (as a pseudonymous heatmap). We also record which sections of a page became visible on the screen and how many seconds after loading, and which controls are clicked, such as a button, a link, a price card, an expandable question or a menu item. For this we use only fixed labels from our code for the type of page, the section and the element, no text from the page and no input. None of these labels names an individual symptom. Addresses, titles and referrers of pages on individual symptoms are generalised. On the way to a booking, PostHog records the steps: click on "Book an appointment" or "Passt gynxtra zu mir?" with the position of the button, calendar viewed and browsed, notes expanded, day and time selected (only the hour and how many days ahead), booking page opened, form shown, started and submitted (without its contents), with our booking form also an error on submitting (only the type of error), payment step opened or left, time changed, payment received, booking completed and access to the patient area ready. These steps include the page from which you went to the calendar, for example the page on sleep problems, one of our landing pages or the home page. This shows us which topics bring women to us.

PostHog receives no identifier that would allow a session to be linked to your booking or your name, and no form contents. In the pre-check (9.1), the medical history questionnaire, the cockpit and the status pages, no statistics at all are collected, including no heatmap and no click measurement. If the calendar shows you your answers from the pre-check, PostHog records none of them. We do not use session replay. Statistical data is deleted after a maximum of 24 months.

9.3 Measuring the booking path on our server

We want to know which pages and sources lead to bookings. For this purpose our own server in Frankfurt stores the following against a random identifier of your visit as soon as you continue from the calendar with a selected time:

• the origin of your visit (section 2.3), without the search term; the click identifier from Google or Meta only with your consent to third parties
• the page from which you went to the calendar, for example the page on sleep problems, a landing page or the home page
• the status of your privacy setting with the text version and time
• when you selected a day and a time and when you opened the booking page

Until then, your browser keeps the origin in this tab's storage. If you book, we link the identifier to your booking. With our booking form, it goes to our server together with your details, not to Cal.com. If you book via Cal.com's form, it is passed to Cal.com as a property of the booking. From then on, this information is attributed to you. If you came from the page on a particular symptom, it shows which topic brought you to us. We therefore treat this information like health data. We use it only to evaluate which pages and sources lead to bookings, not for your treatment, and we do not pass it on to Google, Meta or any other third party. The legal basis is our legitimate interest in a booking process that is clear and works (Art. 31(1) FADP). After 12 months we keep only totals without any link to you (section 6).

If you object to audience measurement ("Necessary only" or in the settings), we store neither the origin, nor the page you came from, nor a click identifier, and your browser deletes the origin already recorded. So that a booking can be attributed to the calendar it came through, our server still creates a line with a random identifier when you continue, and records when you selected a day and a time and when you opened the booking page. If you book, this line is also linked to your booking.

9.4 Your choice in the consent banner

You may object at any time. On your first visit we show a short notice naming the purpose, the transfer to third parties and your right to withdraw, with the buttons "Necessary only" and "Agree". On the landing pages of our Google ads, this notice appears only one minute after the page has loaded; before that, you can make your choice via the "Cookie settings" link in the footer. The names of the recipients and the country are given in the settings and in this section. Via "Settings" you reach the same choice with three separate categories: Necessary (no choice), Audience measurement (on by default, can be switched off at any time) and Third parties (off by default, only with your explicit consent). Audience measurement covers the usage statistics (9.2) and the measurement of the booking path (9.3). The two categories are stored separately and can be changed separately. After that the setting remains available via the "Cookie settings" link shown on the pages of our website, except the pre-check, the calendar and the booking pages (see below). An objection takes effect immediately. What it stops and what it does not is set out in 9.3. Withdrawing consent is as easy as giving it: the same dialog, the same switch. Your choice is stored locally in your browser and therefore applies per browser and device. If you clear your browser storage, you will need to make it again.

We count how often people consent and how often they decline. When you make a choice in the banner, whichever button you use, our own server records one line: which of the three answers it was, which version of the text you were shown, whether the choice came from the settings view, and the date without a time. Nothing else is in that line: no IP address, no identifier, no session, no cookie value, and not which page you were on. As with every request to our website, our server does see your IP address. It does not retain it anywhere for this count. There is therefore nothing in that line that could connect it to you.

We need the number for two reasons. If you decline, no statistics run, and without the count we would not know how large that share is. It also shows us whether the banner is clear enough. We count every decision, including a refusal. Otherwise we would know nothing about precisely the refusals. The count has no effect on what you are shown. We keep it indefinitely, because it contains nothing about individual people.

Two pages deliberately show no consent element: the calendar page and the booking page. Neither the first-visit notice nor the «Cookie settings» link appears there, and there is no button for the settings. A link to this privacy policy appears there only below the payment area, next to «Secure payment via Stripe». The reason is usability: on a mobile phone the element covered the available times and the booking form, that is, the very thing these pages are for. What runs in the background is unaffected: audience measurement runs as it does everywhere unless you have objected, and Google and Meta receive nothing without your consent.

You can object and withdraw via any other page. On all other pages of our website you reach the settings with all three categories, on your first visit via the consent banner, after that via the «Cookie settings» link. The «Manage privacy settings» button directly below this section opens them as well. A change takes effect immediately and applies to the whole website, including the calendar and booking pages. After booking, the consent element is back on the confirmation page. You can also object or withdraw by email to hello@gynxtra.ch.

The pre-check (9.1) shows no consent element either, and no «Cookie settings» link. Neither our statistics nor Google or Meta load there, not even with your consent, so there is nothing there for you to object to. The choice you made before continues to apply; you can change it on any page that shows the link.

Manage privacy settings

9.5 Advertising performance measurement with Google and Meta (only with your consent)

Only if you explicitly consent in the consent banner (category Third parties) do we measure the performance of our advertising with Google (Google Ads, Google Analytics 4) and with the Meta pixel. These pseudonymous events are transmitted:

• To Google: your click on "Book an appointment" or "Passt gynxtra zu mir?" with the position of the button on the page (for example at the top or at the end), as an event in Google Analytics and as a conversion in Google Ads. Google Analytics also records usage values of its own accord, such as time on page, and receives the address, title and referrer of the page only as a neutral value. Google Ads records the page visit with its address and, with the click, also its title.
• To Meta: that you opened the calendar and that you selected a time, each once per visit, under neutral names and without parameters, that is without the time and without the page you came from.

Google only loads on the home page, on our landing pages for ads and on general pages such as pricing and frequently asked questions. On a landing page, Google thereby also learns the topic of the ad you came through, for example weight or hormones. Google does not load on pages on individual symptoms, life stages, treatments, programmes and diagnostics or on knowledge articles, so that our website does not report to Google which topic you are reading about. Like all pages of our website, they pass on only gynxtra.ch as the referrer when you click on. Google does not load on the pre-check or the calendar page either. We report no page views to Meta, and Meta does not load on the pre-check either. Neither Google nor Meta loads on the booking page or the confirmation page, not even with your consent. Never sent to Google or Meta, therefore: these pages on symptoms, treatments and knowledge, your answers from the pre-check, your name, your email address, your phone number, the selected time and whether you paid. Nor does our website report to Meta from which page you went to the calendar. If you come via one of our ads, Google or Meta know which ad you clicked and which page it leads to. If the ad names a topic, such as hot flushes, they thereby also know this topic. Meta can thereby link the reports from the calendar with the ad you came through.

If you come via an ad, the address contains a click identifier from Google or Meta. With your consent, your browser keeps it in this tab's storage, Google and Meta store it, where they load, in their own cookies on our domain, and our server stores it with the measurement described in 9.3 in order to attribute bookings to a campaign. Our server does not pass it on to Google or Meta. Pseudonymous means: Google and Meta can link the events via their cookies to your account with them and connect them with advertising. They are independent controllers for this. Meta receives the events under neutral names, without reference to the medical consultation. The transfer goes to Google and Meta in the USA (Swiss-U.S. DPF). Nothing is transmitted without your consent. You can withdraw it at any time via "Cookie settings". The withdrawal switches both services off immediately and deletes the Google Analytics and Meta cookies. A cookie in which Google Ads has stored a click identifier remains in the browser until it expires, but is no longer transmitted without your consent. We no longer store click identifiers after that.

9.6 Count from the former pre-check

In the former pre-check (until 1 October 2026), when the outcome was that we did not yet have a suitable programme, we counted the reason (age group, none of the listed symptoms, or both), only as a total per week and reason, without a time, without an identifier and without any link to your session. That pre-check with an outcome no longer exists. Today's pre-check (9.1) shows no outcome and counts nothing. We keep the existing weekly totals indefinitely, because they contain nothing about individual people.

10 · Automated Decisions

Treatment decisions are taken exclusively by qualified physicians. We do not use any fully automated decisions producing legal effect within the meaning of Art. 21 revDSG.

Refunds after a cancellation are an exception: in clear cases they are issued automatically (section 4), only ever in your favour. If you disagree with a refund decision, a member of our team will review it at your request.

The replacement appointment is also automatic: if your time has already been taken after payment, our server books the next available appointment for you without human involvement (section 4, section 6.6 of our terms and conditions). You can reschedule or cancel it; if you cancel, you get the full amount back. If you reply to our email, a member of our team takes care of your request and refunds the full amount if you wish.

There is no screening before booking. On some of our landing pages for ads, you answer four short questions before the calendar (pre-check, 9.1). They are not evaluated and not transmitted, there is no outcome, and everyone then reaches the same calendar. Otherwise you book directly in the calendar. Whether treatment is appropriate is assessed by your physician on the basis of the medical history and in the consultation. The former pre-check, which until 1 October 2026 showed an outcome based on age group and symptoms, no longer exists. If you received the outcome there that we did not yet have a suitable programme for you, you can still ask for a physician to review it (Art. 21 Abs. 2 revDSG). Requests to hello@gynxtra.ch.

AI-supported features (e.g. report preparation, symptom classification) serve solely as a tool; the final medical assessment is performed manually.

11 · Advertising and Marketing

• Patient Cockpit-related communication (appointment reminders, refills, adherence) is part of the contract and is not subject to marketing consent.
• Newsletters and product-related marketing only take place after a separate opt-in.
• Every marketing email contains a one-click unsubscribe link.
• Notice about a suitable programme: anyone who found no suitable programme in the former pre-check could leave us their email address so that we get in touch as soon as there is one. Booking via the calendar no longer asks for it. For this we store only the address, the day of the entry, the language and the text version, without any link to answers or the visit, and we delete each address no later than 12 months after the entry. You can unsubscribe at any time via the link in the message or by email to hello@gynxtra.ch.

12 · Amendments to this Privacy Policy

We may amend this policy, in particular in response to legal or technical changes. Material changes are announced in the cockpit and take effect 30 days after announcement.

A new booking is governed by the version published when you book. Corrections and changes in your favour apply from their publication.

Change log

• v1.25 · 21 October 2026: Sections 2.5 and 6: We delete the recording and the transcript of the video consultation with all services no later than five days after the conversation.
• v1.24 · 20 October 2026: Sections 2.5, 4 and 6: With your consent, the physician records the video consultation and has it transcribed with Corti or Isaac as a draft for your report. The physician asks you at the start of the conversation; you can decline or withdraw later. We delete the recording and the transcript from our system after five days at the latest.
• v1.23 · 15 October 2026: Sections 9.1, 9.2, 9.4, 9.5, 9.6 and 10: On some of our landing pages for ads there are again four short questions before the calendar (pre-check). Your answers stay in your tab's storage and appear at the top of the calendar. They are not sent to us, to PostHog, Google or Meta, they are not evaluated and they do not reach your physician. Neither statistics nor Google or Meta load on the pre-check, and no consent element appears there. What is otherwise measured is unchanged.
• v1.22 · 15 October 2026: Section 9.4: On the landing pages of our Google ads, the notice on your first visit appears only one minute after the page has loaded. Before that, you can make your choice via the «Cookie settings» link in the footer. What is measured is unchanged.
• v1.21 · 11 October 2026: Sections 4 and 9.1: The hCaptcha service, which Stripe integrates in the payment field to detect automated access, is operated on Stripe's behalf by Intuition Machines, Inc. in the USA. Stripe is independently responsible for it. The transfer to the USA is based on the Swiss-U.S. Data Privacy Framework. What is processed is unchanged.
• v1.20 · 10 October 2026: Sections 2.4 and 4: With the payment field, Stripe.js already loads after you click «Continue to payment», before our payment button. At this click we also record which version of the terms and conditions and of the privacy policy applied. With the payment field, Stripe also receives the version number of our terms and conditions. Depending on the payment method, Stripe receives further details directly from you or from your wallet, such as your country, postcode or name. To detect automated access, Stripe integrates the hCaptcha service. Section 9.1: Within the payment field, Stripe and hCaptcha set further cookies on their own domains. Section 9.4: The link to this policy appears below the payment area, next to «Secure payment via Stripe».
• v1.19 · 10 October 2026: Section 4: Payment is made with Stripe, on a Stripe page or in Stripe's payment field on our booking page. With the payment field, Stripe.js loads only after you click the payment button, and Stripe sets two cookies for fraud detection (9.1). All pages pass on only gynxtra.ch as the referrer when you click on (9.5), and a link to this policy appears next to the payment field (9.4). If the selected time has already been taken after payment, we automatically book a replacement appointment for you instead of refunding straight away (sections 4 and 10, section 6.6 of our terms and conditions). Section 6: For a replacement appointment, the originally selected time is also kept with the booking.
• v1.18 · 8 October 2026: Section 9.2: The usage statistics now also record which sections of a page became visible and which controls are clicked, using only fixed labels from our code, without text or input.
• v1.17 · 8 October 2026: Section 9.4: The calendar and booking pages no longer show a link to this privacy policy or a button for the settings. You can object and withdraw via the other pages, the button in this section or by email. What is measured is unchanged.
• v1.16 · 7 October 2026: Section 4: if you choose Klarna when paying, Klarna learns that you are paying us for a medical service and processes the information under its own responsibility, including for a credit check. Klarna is now in the list of service providers. We also note that Apple's or Google's privacy terms apply if you pay with Apple Pay or Google Pay.
• v1.15 · 7 October 2026: We are introducing our own booking form for the medical consultation; payment there is made on Stripe's payment page. Until it applies to everyone, and as a fallback, Cal.com's booking form remains. Section 4 now describes how the booking works, what Cal.com and Stripe receive and when we refund automatically. Section 2.1: the phone number is also used to reach you if the video connection drops. Section 2.4: amount, time, refunds and the version of the terms and conditions and of the privacy policy when you clicked the payment button. Section 3: booking via our form, refunds via Stripe. Section 6: retention periods for bookings via our form and for our log of notifications from Cal.com. Section 9: what your browser stores during booking, the cookie for the status of the booking and the check value on the confirmation page, with either booking form and only if you have not objected to audience measurement (9.1), errors on submitting and "payment received" in the usage statistics (9.2), and that the identifier of your visit does not go to Cal.com with our form (9.3). Section 10: refunds after a cancellation are issued automatically in clear cases, only ever in your favour. Section 12: a new booking is governed by the version published when you book.
• v1.14 · 5 October 2026: Section 9.5 now states more precisely what our website reports to Google and Meta, and newly what Google and Meta learn from an ad you come through. WhatsApp communication, respond.io and Meta's WhatsApp Business API removed, we no longer use WhatsApp.
• v1.13 · 2 October 2026: New booking of the medical consultation: the "Book an appointment" button leads directly to our calendar; details and payment are handled via Cal.com and Stripe as before. The pre-check no longer exists (sections 9 and 10). Section 9 has been restructured and now describes: the measurement of the booking path on our server with the origin and the page from which you went to the calendar, which is linked to you after a booking (9.3); which events Google and Meta receive, new for Meta "calendar opened" and "time selected", what Google Ads records, that Google does not load on the calendar page and on the pages on symptoms, life stages, treatments, programmes, diagnostics and knowledge, and that neither Google nor Meta loads on the booking and confirmation pages (9.5). Section 2.1: the phone number is required when booking. Section 4: mailboxes with Google Workspace, Hostpoint now DNS only, Stripe also in the USA. Section 6: retention period for the measurement of the booking path. Section 11: list for a notice about a suitable programme. Section 1: UID correctly labelled.
• v1.12 · 25 September 2026: Section 9 now describes that, when the pre-check outcome is that we do not yet have a suitable programme, we count the reason (age group, none of the listed symptoms, or both), only as a total per week and reason, without a time, without an identifier and without any link to the session. Section 10 now states what the pre-check is based on: age group and symptoms. This replaces the earlier wording "age, residence, exclusion criteria".
• v1.11 · 24 September 2026: The notice on your first visit now names the purpose (cookies for marketing purposes) and that data is passed to third parties in doing so. Names of the recipients and the country are given in the settings and in section 9. The description in section 9 has been adjusted accordingly.
• v1.10 · 24 September 2026: Section 9 now describes that we anonymously count the choices made in the consent banner: which of the three answers, which version of the text, whether it came from the settings view, and the date without a time. No IP address, no identifier, no session, no cookie value and no page path. The reason is that no statistics run without consent and the share of refusals was previously unknown.
• v1.9 · 22 September 2026: The list of service providers in section 4 has been aligned with the actual situation: the website and both cockpits have been hosted by Vercel since 25 August 2026. The website's server functions have run in the Frankfurt region since 22 September 2026, previously in the United States. The previous hosting provider no longer applies, Lovable is now listed as a development environment, and the voluntary feedback form (Google Forms) is now listed. Section 9 now distinguishes clearly between the pre-check, where the start, completion and outcome are measured, and the medical history questionnaire, the cockpit and the status pages, where nothing is measured. It also newly describes that no consent element appears on the pre-check and the booking page, and how withdrawal works there.
• v1.8 · 22 September 2026: The questionnaire before booking is now called the pre-check (previously Fit Check). Content and processing are unchanged.
• v1.7 · 21 September 2026: Usage statistics now also record how long a page was open, how far it was scrolled and where people click. Addresses and titles of symptom pages are generalised in all fields. The events sent to Google and Meta are now described as pseudonymous rather than anonymous; Meta receives them under neutral names.
• v1.6 · 20 September 2026: The first-visit notice is nowtwo-stage: first a short version naming the purpose, the recipients (Google, Meta), the third country (USA) and the right to withdraw, with the buttons "Necessary only" and "Agree", and below them "Settings" for the full choice. Categories, legal bases, defaults and withdrawal remain unchanged. Reason: on small screens the full dialog covered the content behind it.
• v1.5 · 17 September 2026: Consent is now managed inthree separate categories (Necessary · Audience measurement · Third parties) with separate storage. Previously audience measurement (legitimate interest) and third parties (consent) shared a single choice, mixing two different legal bases. Third parties are now explicitly off by default. Consent is recorded with a timestamp and the version of the notice text. Existing objections to audience measurement remain in force; a previously bundled consent to third parties is not carried over, so the notice appears once more.
• v1.4 · 16 September 2026: Section 2.2 aligned with the wellbeing categories actually collected (sleep, mood, hormones, intimacy, body, weight) and clarified that these are self-reported ratings on a scale. Cycle information and free-text entries from check-ins added. Change log now also in the English version.
• v1.3 · 28 August 2026: Added for measuring the performance of Google Ads campaigns: minimal, consent-based Google tracking (Google Analytics 4), two anonymous events (fit check started, initial consultation booked), no health data, transfer to the USA (Swiss-U.S. DPF), only after opt-in in the cookie banner. Google added to the subprocessor list (section 4), the purposes table (section 3) and cookies (section 9).
• v1.2 · 17 August 2026: Usage statistics (PostHog) are now operated on the basis of legitimate interest with a right to object at any time, instead of on consent. Clarification "pseudonymised" instead of "anonymised", retention period and transfer mechanism added, no session replay.
• v1.1 · 22 June 2026: Subprocessor list and data subject rights added.
• v1.0 · 3 June 2026: First version.

The current version is always available at: gynxtra.ch/en/legal/datenschutz

13 · Contact

Data protection enquiries:
gynxtra GmbH · Data Protection
Höschgasse 50, 8008 Zurich, Switzerland
hello@gynxtra.ch

Swiss supervisory authority:
Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch