Privacy Policy · gynxtra GmbH

1 · Data Controller

Controller for data processing within the meaning of Art. 5 lit. j revDSG:

gynxtra GmbH
Höschgasse 50, 8008 Zurich
Switzerland
UID: CHE-424.531.460
Commercial register: CH-020.4.078.662-7

Medical lead and licence holder: Dr. med. Bettina von Seefried, FMH Gynaecology

Data protection enquiries: hello@gynxtra.ch

2 · What Data We Process

2.1 Identification and Contact Data

Surname, first name, date of birth, postal address, email address, phone number (required when booking, so that your physician can reach you with follow-up questions), profile picture (optional).

2.2 Health Data (sensitive personal data within the meaning of Art. 5 lit. c revDSG)

• Medical history and follow-up data (family and personal medical history, symptoms, lifestyle)
• Symptom and wellbeing tracking: self-reported ratings on a scale for sleep, mood, hormones, intimacy, body and weight
• Cycle information (cycle status, bleeding days)
• Free-text entries from check-ins (concerns, changes since the last check-in, topics for the next consultation)
• Body measurements and vital signs (weight, blood pressure, others where indicated)
• Laboratory values (hormone levels, HbA1c, lipid profile, vitamin D, other indicated markers)
• Prescribed medications, dosages, adherence, side effects and feedback on requested therapy adjustments
• Consultation records (medical notes, treatment plan, report, medical certificate)
• Off-label information sheets and signed consents

2.3 Usage and Interaction Data

• Login and session data in the Patient Cockpit
• Interaction with content (click paths, feature usage)
• Device information (browser, operating system, IP address - processed in truncated form)
• Origin of your visit: the first page of your visit (pages on individual symptoms and knowledge articles only in generalised form), campaign details from the link without the search term, the name of the website you came from, and the button that brought you to the calendar; with your consent to third parties, also the click identifier from Google or Meta if you came via an ad
• The page from which you went to the calendar, for example the page on sleep problems, a landing page or the home page. After a booking it can point to a health topic; we then treat it like health data (section 9.3)
• Status of your privacy setting (consent to third parties yes or no, version of the banner text, time)
• Times along the booking path (day and time selected, booking page opened)

2.4 Payment Data

• First and last name, billing address
• Selected appointment and the booking reference at Cal.com
• Stripe transaction IDs (card details are processed directly by Stripe and are not accessible to gynxtra)

2.5 Communication Data

• Email history
• Video call metadata (Daily.co · duration, time - no recording content without separate consent)

3 · Purposes of Data Processing

4 · Recipients and Subprocessor List

We engage the following service providers. Where they process personal data on our behalf, a Data Processing Agreement (DPA) governs the purpose, the scope and their obligation to follow our instructions. The «Location» column states where the data is held and on what basis any transfer outside Switzerland takes place.

Note on Google: For the pure measurement, Google acts as a processor. To the extent the measurement data is linked to the Google Ads account and used for advertising purposes, Google is an independent controller in that respect. This collection only takes place with your explicit consent (opt-in in the cookie banner) and contains no health data.

5 · Third-Country Transfers

Some subprocessors process data outside Switzerland / the EU. Transfers take place on the basis of the following mechanisms pursuant to Art. 16 f. revDSG:

• USA: Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF, in force since 14 September 2024) for DPF-certified recipients. For non-certified recipients, EU Standard Contractual Clauses (SCC) additionally apply, including a Transfer Impact Assessment (TIA).
• EU / EEA (Ireland, Germany, Sweden): Adequate data protection under Annex 1 DSV (ordinance to the revDSG) - no additional mechanism required.
• Additional technical and organisational measures: pseudonymisation where possible, encryption in transit (TLS 1.3) and at rest (AES-256).

6 · Retention Periods

• Patient record (health data): at least 10 years after the last treatment (cantonal health law, HMG)
• Contract data / accounting: 10 years (OR Art. 958f)
• Measurement of the booking path (session line, origin, page before the calendar, times): 12 months, then only monthly totals without any link to individual people
• Marketing and analytics data: up to 24 months
• Non-medical communication (support): 24 months
• After expiry, data is deleted or anonymised

7 · Your Rights

As a data subject, you have the following rights under revDSG (and, where applicable, GDPR):

• Access to the data processed about you (Art. 25 revDSG)
• Rectification of inaccurate data
• Erasure of your data (unless a statutory retention obligation applies)
• Restriction of processing
• Data portability in a machine-readable format
• Withdrawal of consents granted (effective for the future)
• Objection to processing based on a legitimate interest, in particular to the usage statistics (see section 9)
• Complaint to the FDPIC (Federal Data Protection and Information Commissioner), Feldeggweg 1, 3003 Bern

Please direct enquiries to hello@gynxtra.ch. We process enquiries within 30 days.

8 · Data Security

We implement appropriate technical and organisational measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256 in Supabase Storage)
• Row-level security at database level
• Audit logs for sensitive actions (prescription issuance, plan changes, off-label consents)
• Role-based access control (Patient, Coach, Doctor, Admin)
• Regular security reviews
• Obligation on all staff and processors to observe medical professional secrecy or confidentiality

9 · Cookies and Tracking

9.1 What your browser stores

On gynxtra.ch we use technically necessary cookies (session, authentication, storage of your privacy choice). They are required to operate the website and cannot be switched off. For the booking, your browser keeps in this tab's storage (sessionStorage) the selected time, the random identifier of your visit, the origin of your visit and the page from which you went to the calendar, plus markers without content, for example whether you reached the calendar via a button on our site. That way nothing is lost if you go back. Everything disappears when you close the tab.

9.2 Usage statistics with PostHog

We collect pseudonymised usage statistics with PostHog (EU Cloud, servers located in the EU) in order to understand which pages are viewed and where visitors drop off. For this purpose PostHog stores a randomly generated identifier in your tab's storage. It applies only to this visit and is discarded afterwards. The data is not combined into a profile over time. The legal basis is our legitimate interest in a functioning and comprehensible website (Art. 31(1) FADP). We inform you about the processing on your device in accordance with Art. 45c TCA.

We record which pages are viewed, including pages on individual treatment topics, which campaign details the link you came through contained, how long a page was open, how far it was scrolled and where on it people click (as a pseudonymous heatmap). Addresses, titles and referrers of pages on individual symptoms are generalised. On the way to a booking, PostHog records the steps: click on "Book an appointment" with the position of the button, calendar viewed and browsed, notes expanded, day and time selected (only the hour and how many days ahead), booking page opened, form shown, started and submitted (without its contents), payment step opened or left, time changed, booking completed and access to the patient area ready. These steps include the page from which you went to the calendar, for example the page on sleep problems, one of our landing pages or the home page. This shows us which topics bring women to us.

PostHog receives no identifier that would allow a session to be linked to your booking or your name, and no form contents. In the medical history questionnaire, the cockpit and the status pages, no statistics at all are collected. We do not use session replay. Statistical data is deleted after a maximum of 24 months.

9.3 Measuring the booking path on our server

We want to know which pages and sources lead to bookings. For this purpose our own server in Frankfurt stores the following against a random identifier of your visit as soon as you continue from the calendar with a selected time:

• the origin of your visit (section 2.3), without the search term; the click identifier from Google or Meta only with your consent to third parties
• the page from which you went to the calendar, for example the page on sleep problems, a landing page or the home page
• the status of your privacy setting with the text version and time
• when you selected a day and a time and when you opened the booking page

Until then, your browser keeps the origin in this tab's storage. If you book, we link the identifier to your booking. To do so, it is passed to Cal.com as a property of the booking. From then on, this information is attributed to you. If you came from the page on a particular symptom, it shows which topic brought you to us. We therefore treat this information like health data. We use it only to evaluate which pages and sources lead to bookings, not for your treatment, and we do not pass it on to Google, Meta or any other third party. The legal basis is our legitimate interest in a booking process that is clear and works (Art. 31(1) FADP). After 12 months we keep only totals without any link to you (section 6).

If you object to audience measurement ("Necessary only" or in the settings), we store neither the origin, nor the page you came from, nor a click identifier, and your browser deletes the origin already recorded. So that a booking can be attributed to the calendar it came through, our server still creates a line with a random identifier when you continue, and records when you selected a day and a time and when you opened the booking page. If you book, this line is also linked to your booking.

9.4 Your choice in the consent banner

You may object at any time. On your first visit we show a short notice naming the purpose, the transfer to third parties and your right to withdraw, with the buttons "Necessary only" and "Agree". The names of the recipients and the country are given in the settings and in this section. Via "Settings" you reach the same choice with three separate categories: Necessary (no choice), Audience measurement (on by default, can be switched off at any time) and Third parties (off by default, only with your explicit consent). Audience measurement covers the usage statistics (9.2) and the measurement of the booking path (9.3). The two categories are stored separately and can be changed separately. After that the setting remains available via the "Cookie settings" link shown on every page. An objection takes effect immediately. What it stops and what it does not is set out in 9.3. Withdrawing consent is as easy as giving it: the same dialog, the same switch. Your choice is stored locally in your browser and therefore applies per browser and device. If you clear your browser storage, you will need to make it again.

We count how often people consent and how often they decline. When you make a choice in the banner, whichever button you use, our own server records one line: which of the three answers it was, which version of the text you were shown, whether the choice came from the settings view, and the date without a time. Nothing else is in that line: no IP address, no identifier, no session, no cookie value, and not which page you were on. As with every request to our website, our server does see your IP address. It does not retain it anywhere for this count. There is therefore nothing in that line that could connect it to you.

We need the number for two reasons. If you decline, no statistics run, and without the count we would not know how large that share is. It also shows us whether the banner is clear enough. We count every decision, including a refusal. Otherwise we would know nothing about precisely the refusals. The count has no effect on what you are shown. We keep it indefinitely, because it contains nothing about individual people.

Two pages deliberately show no consent element: the calendar page and the booking page. Neither the first-visit notice nor the «Cookie settings» link appears there. The reason is usability: on a mobile phone the element covered the available times and the booking form, that is, the very thing these pages are for. What runs in the background is unaffected: audience measurement runs as it does everywhere unless you have objected, and Google and Meta receive nothing without your consent.

You can still object and withdraw, right there. At the bottom of both pages you will find a link to this privacy policy and a button that opens the same settings with all three categories. That button works even if you have never made a choice before. A change made there takes effect immediately and applies to the whole website, not just that one page. Once you leave these pages, the consent element is back on the next page.

Manage privacy settings

9.5 Advertising performance measurement with Google and Meta (only with your consent)

Only if you explicitly consent in the consent banner (category Third parties) do we measure the performance of our advertising with Google (Google Ads, Google Analytics 4) and with the Meta pixel. These pseudonymous events are transmitted:

• To Google: your click on "Book an appointment" with the position of the button on the page (for example at the top or at the end), as an event in Google Analytics and as a conversion in Google Ads. Google Analytics also records usage values of its own accord, such as time on page, and receives the address, title and referrer of the page only as a neutral value. Google Ads records the page visit with its address and, with the click, also its title.
• To Meta: that you opened the calendar and that you selected a time, each once per visit, under neutral names and without parameters, that is without the time and without the page you came from.

Google only loads on the home page, on our landing pages for ads and on general pages such as pricing and frequently asked questions. On a landing page, Google thereby also learns the topic of the ad you came through, for example weight or hormones. Google does not load on pages on individual symptoms, life stages, treatments, programmes and diagnostics or on knowledge articles, so that our website does not report to Google which topic you are reading about. When you click on from these pages, they also pass on only gynxtra.ch as the referrer. Google does not load on the calendar page either. We report no page views to Meta. Neither Google nor Meta loads on the booking page or the confirmation page, not even with your consent. Never sent to Google or Meta, therefore: these pages on symptoms, treatments and knowledge, your name, your email address, your phone number, the selected time and whether you paid. Nor does our website report to Meta from which page you went to the calendar. If you come via one of our ads, Google or Meta know which ad you clicked and which page it leads to. If the ad names a topic, such as hot flushes, they thereby also know this topic. Meta can thereby link the reports from the calendar with the ad you came through.

If you come via an ad, the address contains a click identifier from Google or Meta. With your consent, your browser keeps it in this tab's storage, Google and Meta store it, where they load, in their own cookies on our domain, and our server stores it with the measurement described in 9.3 in order to attribute bookings to a campaign. Our server does not pass it on to Google or Meta. Pseudonymous means: Google and Meta can link the events via their cookies to your account with them and connect them with advertising. They are independent controllers for this. Meta receives the events under neutral names, without reference to the medical consultation. The transfer goes to Google and Meta in the USA (Swiss-U.S. DPF). Nothing is transmitted without your consent. You can withdraw it at any time via "Cookie settings". The withdrawal switches both services off immediately and deletes the Google Analytics and Meta cookies. A cookie in which Google Ads has stored a click identifier remains in the browser until it expires, but is no longer transmitted without your consent. We no longer store click identifiers after that.

9.6 Count from the former pre-check

In the former pre-check, when the outcome was that we did not yet have a suitable programme, we counted the reason (age group, none of the listed symptoms, or both), only as a total per week and reason, without a time, without an identifier and without any link to your session. The pre-check no longer exists; you book directly in the calendar. We keep the existing weekly totals indefinitely, because they contain nothing about individual people.

10 · Automated Decisions

Treatment decisions are taken exclusively by qualified physicians. We do not use any fully automated decisions producing legal effect within the meaning of Art. 21 revDSG.

There is no screening and no questionnaire before booking. You can book directly in the calendar. Whether treatment is appropriate is assessed by your physician on the basis of the medical history and in the consultation. The former pre-check, which showed an outcome based on age group and symptoms, no longer exists. If you received the outcome there that we did not yet have a suitable programme for you, you can still ask for a physician to review it (Art. 21 Abs. 2 revDSG). Requests to hello@gynxtra.ch.

AI-supported features (e.g. report preparation, symptom classification) serve solely as a tool; the final medical assessment is performed manually.

11 · Advertising and Marketing

• Patient Cockpit-related communication (appointment reminders, refills, adherence) is part of the contract and is not subject to marketing consent.
• Newsletters and product-related marketing only take place after a separate opt-in.
• Every marketing email contains a one-click unsubscribe link.
• Notice about a suitable programme: anyone who found no suitable programme in the former pre-check could leave us their email address so that we get in touch as soon as there is one. Booking via the calendar no longer asks for it. For this we store only the address, the day of the entry, the language and the text version, without any link to answers or the visit, and we delete each address no later than 12 months after the entry. You can unsubscribe at any time via the link in the message or by email to hello@gynxtra.ch.

12 · Amendments to this Privacy Policy

We may amend this policy, in particular in response to legal or technical changes. Material changes are announced in the cockpit and take effect 30 days after announcement.

Change log

• v1.14 · 5 October 2026: Section 9.5 now states more precisely what our website reports to Google and Meta, and newly what Google and Meta learn from an ad you come through. WhatsApp communication, respond.io and Meta's WhatsApp Business API removed, we no longer use WhatsApp.
• v1.13 · 2 October 2026: New booking of the medical consultation: the "Book an appointment" button leads directly to our calendar; details and payment are handled via Cal.com and Stripe as before. The pre-check no longer exists (sections 9 and 10). Section 9 has been restructured and now describes: the measurement of the booking path on our server with the origin and the page from which you went to the calendar, which is linked to you after a booking (9.3); which events Google and Meta receive, new for Meta "calendar opened" and "time selected", what Google Ads records, that Google does not load on the calendar page and on the pages on symptoms, life stages, treatments, programmes, diagnostics and knowledge, and that neither Google nor Meta loads on the booking and confirmation pages (9.5). Section 2.1: the phone number is required when booking. Section 4: mailboxes with Google Workspace, Hostpoint now DNS only, Stripe also in the USA. Section 6: retention period for the measurement of the booking path. Section 11: list for a notice about a suitable programme. Section 1: UID correctly labelled.
• v1.12 · 25 September 2026: Section 9 now describes that, when the pre-check outcome is that we do not yet have a suitable programme, we count the reason (age group, none of the listed symptoms, or both), only as a total per week and reason, without a time, without an identifier and without any link to the session. Section 10 now states what the pre-check is based on: age group and symptoms. This replaces the earlier wording "age, residence, exclusion criteria".
• v1.11 · 24 September 2026: The notice on your first visit now names the purpose (cookies for marketing purposes) and that data is passed to third parties in doing so. Names of the recipients and the country are given in the settings and in section 9. The description in section 9 has been adjusted accordingly.
• v1.10 · 24 September 2026: Section 9 now describes that we anonymously count the choices made in the consent banner: which of the three answers, which version of the text, whether it came from the settings view, and the date without a time. No IP address, no identifier, no session, no cookie value and no page path. The reason is that no statistics run without consent and the share of refusals was previously unknown.
• v1.9 · 22 September 2026: The list of service providers in section 4 has been aligned with the actual situation: the website and both cockpits have been hosted by Vercel since 25 August 2026. The website's server functions have run in the Frankfurt region since 22 September 2026, previously in the United States. The previous hosting provider no longer applies, Lovable is now listed as a development environment, and the voluntary feedback form (Google Forms) is now listed. Section 9 now distinguishes clearly between the pre-check, where the start, completion and outcome are measured, and the medical history questionnaire, the cockpit and the status pages, where nothing is measured. It also newly describes that no consent element appears on the pre-check and the booking page, and how withdrawal works there.
• v1.8 · 22 September 2026: The questionnaire before booking is now called the pre-check (previously Fit Check). Content and processing are unchanged.
• v1.7 · 21 September 2026: Usage statistics now also record how long a page was open, how far it was scrolled and where people click. Addresses and titles of symptom pages are generalised in all fields. The events sent to Google and Meta are now described as pseudonymous rather than anonymous; Meta receives them under neutral names.
• v1.6 · 20 September 2026: The first-visit notice is nowtwo-stage: first a short version naming the purpose, the recipients (Google, Meta), the third country (USA) and the right to withdraw, with the buttons "Necessary only" and "Agree", and below them "Settings" for the full choice. Categories, legal bases, defaults and withdrawal remain unchanged. Reason: on small screens the full dialog covered the content behind it.
• v1.5 · 17 September 2026: Consent is now managed inthree separate categories (Necessary · Audience measurement · Third parties) with separate storage. Previously audience measurement (legitimate interest) and third parties (consent) shared a single choice, mixing two different legal bases. Third parties are now explicitly off by default. Consent is recorded with a timestamp and the version of the notice text. Existing objections to audience measurement remain in force; a previously bundled consent to third parties is not carried over, so the notice appears once more.
• v1.4 · 16 September 2026: Section 2.2 aligned with the wellbeing categories actually collected (sleep, mood, hormones, intimacy, body, weight) and clarified that these are self-reported ratings on a scale. Cycle information and free-text entries from check-ins added. Change log now also in the English version.
• v1.3 · 28 August 2026: Added for measuring the performance of Google Ads campaigns: minimal, consent-based Google tracking (Google Analytics 4), two anonymous events (fit check started, initial consultation booked), no health data, transfer to the USA (Swiss-U.S. DPF), only after opt-in in the cookie banner. Google added to the subprocessor list (section 4), the purposes table (section 3) and cookies (section 9).
• v1.2 · 17 August 2026: Usage statistics (PostHog) are now operated on the basis of legitimate interest with a right to object at any time, instead of on consent. Clarification "pseudonymised" instead of "anonymised", retention period and transfer mechanism added, no session replay.
• v1.1 · 22 June 2026: Subprocessor list and data subject rights added.
• v1.0 · 3 June 2026: First version.

The current version is always available at: gynxtra.ch/en/legal/datenschutz

13 · Contact

Data protection enquiries:
gynxtra GmbH · Data Protection
Höschgasse 50, 8008 Zurich, Switzerland
hello@gynxtra.ch

Swiss supervisory authority:
Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch