Privacy Policy · gynxtra GmbH

1 · Data Controller

Controller for data processing within the meaning of Art. 5 lit. j revDSG:

gynxtra GmbH
Höschgasse 50, 8008 Zurich
Switzerland
UID: CH-020.4.078.662-7

Medical lead and licence holder: Dr. med. Bettina von Seefried, FMH Gynaecology

Data protection enquiries: hello@gynxtra.ch

2 · What Data We Process

2.1 Identification and Contact Data

Surname, first name, date of birth, postal address, email address, phone number (optional, only with WhatsApp opt-in), profile picture (optional).

2.2 Health Data (sensitive personal data within the meaning of Art. 5 lit. c revDSG)

• Medical history (family and personal medical history, symptoms, lifestyle)
• Symptom and wellbeing tracking (sleep, energy, mood, hot flushes, libido)
• Body measurements and vital signs (weight, blood pressure, others where indicated)
• Laboratory values (hormone levels, HbA1c, lipid profile, vitamin D, other indicated markers)
• Prescribed medications, dosages, adherence, side effects
• Consultation records (medical notes, treatment plan, report, medical certificate)
• Off-label information sheets and signed consents

2.3 Usage and Interaction Data

• Login and session data in the Patient Cockpit
• Interaction with content (click paths, feature usage)
• Device information (browser, operating system, IP address - processed in truncated form)

2.4 Payment Data

• First and last name, billing address
• Stripe transaction IDs (card details are processed directly by Stripe and are not accessible to gynxtra)

2.5 Communication Data

• Email and WhatsApp history (where opt-in granted)
• Video call metadata (Daily.co · duration, time - no recording content without separate consent)

3 · Purposes of Data Processing

4 · Recipients and Subprocessor List

We engage the following service providers. A Data Processing Agreement (DPA) is in place with each of them:

Note on Google: For the pure measurement, Google acts as a processor. To the extent the measurement data is linked to the Google Ads account and used for advertising purposes, Google is an independent controller in that respect. This collection only takes place with your explicit consent (opt-in in the cookie banner) and contains no health data.

5 · Third-Country Transfers

Some subprocessors process data outside Switzerland / the EU. Transfers take place on the basis of the following mechanisms pursuant to Art. 16 f. revDSG:

• USA: Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF, in force since 14 September 2024) for DPF-certified recipients. For non-certified recipients, EU Standard Contractual Clauses (SCC) additionally apply, including a Transfer Impact Assessment (TIA).
• EU / EEA (Ireland, Germany, Sweden): Adequate data protection under Annex 1 DSV (ordinance to the revDSG) - no additional mechanism required.
• Singapore (respond.io): No adequacy decision - transfer based on EU Standard Contractual Clauses (SCC) as well as the patient's explicit consent in the WhatsApp opt-in.
• Additional technical and organisational measures: pseudonymisation where possible, encryption in transit (TLS 1.3) and at rest (AES-256).

6 · Retention Periods

• Patient record (health data): at least 10 years after the last treatment (cantonal health law, HMG)
• Contract data / accounting: 10 years (OR Art. 958f)
• Marketing and analytics data: up to 24 months
• Non-medical communication (support): 24 months
• After expiry, data is deleted or anonymised

7 · Your Rights

As a data subject, you have the following rights under revDSG (and, where applicable, GDPR):

• Access to the data processed about you (Art. 25 revDSG)
• Rectification of inaccurate data
• Erasure of your data (unless a statutory retention obligation applies)
• Restriction of processing
• Data portability in a machine-readable format
• Withdrawal of consents granted (effective for the future)
• Objection to processing based on a legitimate interest, in particular to the usage statistics (see section 9)
• Complaint to the FDPIC (Federal Data Protection and Information Commissioner), Feldeggweg 1, 3003 Bern

Please direct enquiries to hello@gynxtra.ch. We process enquiries within 30 days.

8 · Data Security

We implement appropriate technical and organisational measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256 in Supabase Storage)
• Row-level security at database level
• Audit logs for sensitive actions (prescription issuance, plan changes, off-label consents)
• Role-based access control (Patient, Coach, Doctor, Admin)
• Regular security reviews
• Obligation on all staff and processors to observe medical professional secrecy or confidentiality

9 · Cookies and Tracking

On gynxtra.ch we use technically necessary cookies (session, authentication, storage of your privacy choice). They are required to operate the website and cannot be switched off.

In addition we collect pseudonymised usage statistics with PostHog (EU Cloud, servers located in the EU) in order to understand which pages are viewed and where visitors drop off. A randomly generated identifier is stored in your browser's local storage for this purpose. The legal basis is our legitimate interest in a functioning and comprehensible website (Art. 31(1) FADP). We inform you about the processing on your device in accordance with Art. 45c TCA.

You may object at any time. On your first visit we display a notice with a "Decline statistics" button. After that the setting remains available via the "Cookie settings" link shown on every page. An objection takes effect immediately and no further usage statistics are collected.

Manage statistics settings

These usage statistics contain no information about you as a person, no questionnaire answers and no findings. We record which pages are viewed, including pages on individual treatment topics. This data is not combined into a profile over time: the identifier applies only to the current browser session and is discarded afterwards. No statistics at all are collected in the patient area (questionnaire, cockpit, status pages). We do not use session replay.

Statistical data is deleted after a maximum of 24 months. Your objection is stored locally in your browser and therefore applies per browser and device. If you clear your browser storage, you will need to object again.

Advertising performance measurement with Google (only with your consent). If you explicitly consent in the cookie banner, we measure the performance of our advertising with Google Analytics 4 / Google Ads. Only two anonymous events are transmitted (start of the Fit-Check, booked first consultation), no page views, no answers, no symptom or topic pages and no information about you as a person. The transfer goes to Google in the USA (Swiss-U.S. DPF). Unlike PostHog, Google can link these signals to your Google account for advertising. Nothing is transmitted to Google without your consent; you can withdraw it at any time via "Cookie settings".

10 · Automated Decisions

Treatment decisions are taken exclusively by qualified physicians. We do not use any fully automated decisions producing legal effect within the meaning of Art. 21 revDSG.

The upstream Fit-Check (eligibility triage) is based on a rule-based algorithm that checks whether the patient meets the prerequisites for an assessment (age, residence, exclusion criteria). In case of a negative outcome, the patient has the right to request a review by a physician (Art. 21 Abs. 2 revDSG). Requests to hello@gynxtra.ch.

AI-supported features (e.g. report preparation, symptom classification) serve solely as a tool; the final medical assessment is performed manually.

11 · Advertising and Marketing

• Patient Cockpit-related communication (appointment reminders, refills, adherence) is part of the contract and is not subject to marketing consent.
• Newsletters and product-related marketing only take place after a separate opt-in.
• Every marketing email contains a one-click unsubscribe link.

12 · Amendments to this Privacy Policy

We may amend this policy, in particular in response to legal or technical changes. Material changes are announced in the cockpit and take effect 30 days after announcement.

The current version is always available at: gynxtra.ch/en/legal/datenschutz

13 · Contact

Data protection enquiries:
gynxtra GmbH · Data Protection
Höschgasse 50, 8008 Zurich, Switzerland
hello@gynxtra.ch

Swiss supervisory authority:
Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch