Privacy Policy and security
Privacy Policy
WELL App General Data Protection Statement
1. What is the WELL App?
11. What are your rights?
1. What is the WELL App?
Die WELL app (hereinafter the “App”) is a health platform available to respond to questions concerning health. The app was developed by WELL Gesundheit AG (see Section 3.1), a company founded as an independent joint venture by CSS, Visana, zur Rose and Allianz (Medi24 AG). With the assistance of the app, users can easily check symptoms, schedule appointments with doctors, find out about medications and make use of other features. The app connects users with physicians, pharmacists, insurance companies and other health care professionals.
2. What is this data protection statement about?
WELL Gesundheit AG, Bernstrasse 39, 8952 Schlieren (hereinafter “WELL” or “we”) processes personal information concerning you or other persons in different ways for a variety of purposes. In this statement, the term “personal information” or simply “data” refers to information that can be associated with a specific person, while “process” describes any handling of such information – for example: acquisition, storage, use, divulgation and erasure.
This Data Protection Statement applies to all persons whose data we use as the Data Controller in the context of the app – for example: if you sign up with us or use the app to communicate to us. We may also separately provide you with information concerning the processing of your data – in declarations of consent, for example. Should you have questions or need additional information concerning our data processing, please do not hesitate to contact us (Section 3). A separate Data Protection Statement accessible via the Internet at www.well.ch applies to the use of that website. For information regarding the processing of data by third parties similarly defined under data protection law as Data Controllers (see the overview in Section 3.2), please consult each third party’s own Data Protection Statement.
Our offerings via the app are designed exclusively for those persons having their residence and customary abode in Switzerland and who are covered by Swiss health insurance. This Data Protection Statement therefore conforms to the Swiss Data Protection Law (Schweizer Datenschutzgesetz – DSG).
If you provide us with information concerning other persons such as family members, we assume that you are entitled to do this and that this information is accurate. Please ensure that these individuals are informed concerning this Data Protection Statement. It is found under “Profile” and can be opened and reviewed at any time at the “Assistance and Legal Details” by clicking on “Data Protection Statement”.
Our use of masculine references in this Data Protection Statement is for ease of readability although these terms are not intended to refer to only one gender.
3. Who is responsible for processing your information?
3.1 WELL as the Data Controller
WELL is (“we” are) the “Controller” – that is, the primary competent authority under data protection law – for the processing of data under this Data Protection Statement to the extent described below and unless otherwise communicated in individual cases, including in forms or third-party contracts that arise concerning our app.
Should you have questions concerning data protection, we welcome your contact with us via the following address:
WELL Gesundheit AG
Email: info@well.ch
3.2 Third parties as Data Controllers
The app makes available certain offers and services from other parties (hereinafter “thirdparties”). These offers and services may themselves be integrated into the app, or the app may make reference to third-party offerings outside the app. The respective third parties bear their own responsibility under data protection law for offers on or external to the app. You yourself make the decision whether to divulge your data, especially your health information, to these third-party providers. We divulge your information to third parties only if we have received your express permission to do so.
Certain third-party offerings are provided on the app itself (see also Section 6 regarding these. They include the following services:
-
Symptom Checker (medical product)
-
Telemedicine appointment scheduling
-
Physician search
-
Receipt and filling of e-prescriptions
-
Uploading and storage of medical documents by authorised service providers
-
Scheduling of flu shot appointments at the chemist
-
Doctor Chat
-
Scheduling an appointment with a physician
-
Medication search
These functions can be used only if we are allowed to divulge to the third parties the information they need to provide the service and if they in turn are permitted to communicate the required information to us (for example: by displaying the Symptom Checker results on the app). If you wish to make use of these functions, you will need to agree to permit these communications. We therefore obtain your express consent to each such transfer.
WELL also provides links to other third-party offerings that cannot be accessed within WELL itself. To take advantage of these, it is necessary to access third-party websites and/or apps (see Section 7). These offerings are as follows:
-
Zur Rose Marketplace
-
Online Skin Check
-
Online trainings
-
Online psychological training
-
Online training for anxiety and panic attacks
-
Online sleep training
-
-
Blood donation
We wish to point out that each third party is solely responsible for its respective offerings and associated data processing. For more information on the protection of your data, we refer you to the respective Data Protection Statements and email contact information of the various third-party providers (see Sections 6 and 7).
4. What data do we process?
In connection with your use of the app and depending on the purpose, we process different sorts of data from a variety of sources. In principle, we receive your data directly from you – for example, when you sign up for the app or access features made available via the app.
Should you make use of third-party offerings on the app and give your consent, we also obtain data concerning you from these third-party providers (see Section 6).
We primarily (but not exclusively) process data in the following categories:
4.1 Master data
We define master data as the information we need to carry out our business relationship or for marketing or promotional purposes and that directly refer to you personally and to your individual characteristics.
For example, we process the following master data and any other master data you provide to us:
-
Name
-
Surname
-
Address
-
Date of birth
-
Sex
-
Health insurance
-
Insurance policy number
-
Email
-
Landline/mobile number
-
Height (optional)
-
Weight (optional)
-
Prior illnesses (optional)
-
Medications (optional)
-
Allergies (optional)
For you to be able to make use of the third-party features and offerings made available to you via the app and, for example, to have the Symptom Checker results displayed on the app, we also need information from these third parties providing the offerings you are using. This includes health data. You are therefore required to grant your consent prior to using these third-party offerings (see Section 3.2). You can find in Section 6 a detailed overview of the data we divulge with your consent to third-party providers and which information we may possibly retain.
Certain features of the app depend on our ability to identify you. In this identification process, we collect an encrypted image of your identity document, your photograph and a brief video you record for us. The process analyses all data from your ID document (for example: the issuing authority, date of issuance and expiry, document number and type, etc.), including particularly sensitive personal information (biometric data) extracted from your photo (see Section 5.2).
4.2 Signup data
You may use the app as a guest or registered user. Should you choose to register, you will be required to provide the information that is minimally required and may also elect to add other information (master data).
If you register with us, we proceed to process the following personal information at that time in addition to the master data (Section 4.1):
-
User ID created by WELL upon your registration
-
Password
You bear sole responsibility for entering the data accurately, keeping your information up to date and ensuring the confidentiality of your password.
For guest access, you are required to complete a guest profile by entering the following information into the app:
-
name of your health insurance provider
-
at your option, you may also include additional data such as date of birth, weight, height, sex, etc.
WELL then creates a guest ID for you
4.3 Usage data
Usage data includes information we receive based on your use of the app – for example, if you enter information into the app functions regarding your health (health data), schedule a flu shot or communicate with service providers via the app.
4.4 Communication data
The term ‘communication data’ relates to our communication with you occurring, for example, when you contact us via the web form or email, by phone, post or in other ways. In this process, we collect data derived from the information you exchange with us, including your contact information and ancillary data such as the time, nature and location of the communication.
To the extent necessary (when you request information, for example), we also collect data for the purpose of identifying you, such as a copy of an ID document.
4.5 Insurance data
Since some of the offers on the app (Symptom Checker, telemedicine appointment scheduling, filling of prescriptions and Doctor Chat) are not available to all users but are limited solely to those having a certain level of coverage, we also process insurance data when you use these functions. Examples of such data include general information on your basic insurance, policy number and basic insurance model.
4.6 Technical data
Technical data are generated each time you use our website. These most commonly include the following:
-
Terminal IP address and device ID
-
Information regarding your device, your terminal’s operating system or language settings
-
Information regarding your Internet provider
-
Information regarding the installation of the app
-
Accessed content such as protocols in which the use of our system is recorded
-
Date and time of the access of the website as well as your approximate location
We can also assign an individual ID to you or to your terminal (by means of a cookie, for example; see Section 9). This ID is stored for a certain amount of time, frequently only for the duration of your access. The technical data themselves do not lead to identification of your identity. In the signup process and when utilising the user account, however, you can be associated with other data categories and personally identified in this way.
When you use the app by means of a Wi-Fi connection, we process additional data such as the date, time and duration of the connection, the location of the Wi-Fi network and the volume of data.
4.7 Data on habits and preferences
Depending upon the relationship between us, we seek to learn more about you so that we may become better able to orient our products and services to you. For this purpose, we gather and use data describing your habits and preferences by assessing your use of the app. We are able to combine this information with other data (for example, with anonymous statistical information from official sources). This allows us, for example, to determine the statistical likelihood that you may have an affinity towards certain products and services, that you have specific needs, or that you behave in certain ways.
5. How is information processed during signup and login?
5.1 Authentication data
5.1.1 Data processing by WELL as the Data Controller
Users wishing to register with WELL are required to provide identification. For this purpose, you are asked to provide a username (email address) and password as well as your mobile number. We subsequently send you a verification email to confirm your email address and ring your mobile number to provide a code for you to use in identifying yourself for the app.
For this two-step identification process, WELL uses an identification platform maintained by the Auth0 company, located at 10800 NE 8th Street, Ste. 600, Bellevue, WA, 98004, United States. The data collected in this process are stored exclusively in the EU. WELL erases the data once the authentication process has been concluded.
5.1.2 Data processing by Auth0 as the Data Controller
Auth0 can process data generated through use of the Auth0 platform (user login information as well as usage data such as protocol data and performance results). As a Controller, Auth0 determines the nature, extent and purpose of its processing of usage data. Auth0’s own Data Protection Statementapplies wherever personal data are involved. Auth0 is not permitted to make subsequent use of the usage data for direct marketing purposes, nor to sell this information.
5.2 Data to identify users
5.2.1 Data processing by WELL as the Data Controller
For certain functions internal to WELL, we require additional information from you beyond this authentication. For this further identification process (hereinafter the “KYC process”), we ask for an encrypted image of your identity document, a photo of you and a short video to be recorded by you.
The first step in the process is to analyse all data from your identification document (you can review details regarding these data and additional information in Section 3.1). In a second step, biometric data from your photographic image and sensitive personal information are processed. The data derived from your photo and video are compared using special technology. This allows us to identify you unequivocally. Lastly, the authenticity of the photo in your ID document is scrutinised.
In its KYC process, WELL has engaged a provider of digital identification software and services, the PXL Vision AG company, located at Mühlebachstrasse 164, 8008 Zurich. PXL Vision AG servers are exclusively located in Switzerland.
5.2.2 Data processing by PXL Vision AG as the Data Controller
PXL Vision AG uses the data gathered by WELL to improve its detection processes. PXL Vision AG is a Controller for the processing of these data.
Before we divulge highly sensitive personal data to PXL Vision AG, we obtain your express consent for such sharing. PXL Vision AG uses these data exclusively in the improvement process described. You may obtain additional information regarding data processing by PXL Vision AG by consulting the Data Protection Statement of PXL Vision AG.
6. How are offer data processed on the app?
The third-party features on the app assist you when you have questions regarding your health. Some of these functions are available only to users having a certain level of health insurance coverage. More information on eligibility requirements can be found in the respective Conditions of Use of each third-party provider.
In addition, certain personal identification information must be conveyed to the service provider (for example: the physician) for inclusion in his system. This is required, for example, when scheduling a telemedicine call-back appointment. You are thus asked to provide consent when using the relevant services on the app.
6.1 Symptom Checker
Symptom Checker is a systematic interview to ascertain health status and make a recommendation for next steps. At the end of the interview, you automatically receive a summary. Moreover, possible illnesses are identified (differential diagnosis).
After reviewing the results of the interview, should you wish to know whether you qualify to choose between seeing your general practitioner or making use of telemedicine (perform a “triage”), we would need to review your insurance information (see Section 4.5) and possibly learn the name of your general practitioner. You can send us this information via SASIS AG, a santésuisse Group company. For this, SASIS AG needs your master data or alternatively your insurance card number.
Third-party provider:
in4medicine AG
email: info@in4medicine.ch
Data divulged:
-
Master data (for example: date of birth, sex)
-
Usage data (for example: response to questions and followups concerning symptoms and health condition)
-
Signup data (guest ID, user ID)
-
Symptom Checker ID
-
Symptom Checker results
Symptom Checker user instructions
6.2 Scheduling a telemedicine appointment
WELL can facilitate your appointment via the scheduling system provided by medi24 AG (“medi24”). Appointment scheduling can be optionally based on a triage decision reached through Symptom Checker. This service is available only to customers of CSS or Visana and to those whose insurance covers medi24 telemedicine services.
In the process of scheduling a telemedicine appointment, your personal data are sent in advance to the service provider to enable the provider to contact you.
Third-party provider:
Medi24 AG
email: info@medi24.ch
Data divulged:
-
Master data (for example: landline/mobile phone)
-
Signup data (user ID, guest ID)
-
Insurance data (for example: insurance policy information)
-
Usage data (for example: Symptom Checker results (optional), additional documents/photos (optional), comments (optional) and appointment availability (date, time slot)
-
Appointment confirmation
medi24 Data Protection Statement
6.3 Physician search
You can use the app to search for an appropriate physician.
Third-party provider:
Zur Rose Suisse AG
email: team@zurrose.ch
Data divulged:
-
Usage data (search criteria you enter such as physician name/office address, specialisation, city/postal code, location information)
-
None
Zur Rose Data Protection Statement
6.4 Filling e-prescriptions
This feature allows e-prescriptions to be received, checked and processed. The e-prescription is displayed on the app and can be filled online to be collected at the local chemist or shipped to your home.
Third-party provider:
Zur Rose Suisse AG
email: team@zurrose.ch
Data divulged:
-
Master data (for example: first name, surname, date of birth, landline/mobile phone, email, shipping address (only for shipment of medications), known information such as previous illnesses, allergies, possible pregnancy, weight, etc.)
-
Signup data (guest ID, user ID)
-
Usage data (for example: complete prescription information, chemist name, additional information on health (only for shipment of medications), possible pregnancy
-
Insurance data (for example: insurance policy information)
-
If you collect the medication directly at your local chemist, no information is stored by WELL, although the following data are retrieved from the program interface (API): e-prescription, medication/dosage, physician, prescription ID, recipient name and date of birth, status (filled/unfilled)
-
If the medication is shipped to you, the following specific master and usage data are retrieved from API: e-prescription, medication/dosage, physician, prescription ID, recipient name and date of birth, status. Additionally, the following usage data are stored by WELL: height, weight, previous illnesses, medications, allergies, etc.
Zur Rose Data Protection Statement
6.5 Third-party provider uploads and storing of medical documents
At your direction, a service provider such as a physician can upload medical documents (for example: treatment plans or test results) onto the WELL application to be saved to your file so that you will have direct online access to your medical documents. You also have the option to transfer documents to your provider. When documents are sent to the provider or by the provider to the user, only the documents themselves and your signup data (user ID) are shared.
Third-party provider:
Zur Rose Suisse AG
email: team@zurrose.ch
Data divulged:
-
Master data (for example: first name, surname, date of birth, sex)
-
Signup data (user ID)
-
User ID
-
ID of the sending individual or institutional provider (for example: physician ID)
-
Usage data (for example: documents such as treatment plans, medication list, lab results, etc. sent by a provider to your document file)
Zur Rose Data Protection Statement
6.6 Scheduling an appointment for an influenza shot at the chemist
You can use the app to schedule an appointment to receive an influenza shot either at a Galenica Group chemist (Amavita or Sun Store) or at Coop Vitality. Appointment scheduling is a service of GaleniCare AG, which manages the webshop on behalf of these chemists, and can also be accomplished via the OneDoc appointment scheduling tool provided to all registered users by OneDoc SA.
Third-party provider:
OneDoc SA
OneDoc SA Data Protection Statement
Third-party providers:
-
GaleniCare AGUntermattweg 8 3027 Bern email: info@galenica.com
-
Webshop operators on behalf of Amavita, Sun Store and Coop Vitality chemists
-
Amavita Apotheken
-
Galenicare Management AG
-
Untermattweg 8
-
3027 Bern
-
email:info@amavita.ch
Amavita Data Protection Statement
Third-party provider:
-
Sun Store Apotheken
-
Galenicare Management AG
-
Untermattweg 8
-
3027 Bern
-
email:info@sunstore.ch
Sun Store Data Protection Statement
Third-party provider:
Coop Vitality Data Protection Statement
Data divulged:
-
Master data (for example: first name, surname, date of birth, sex, telephone number,email)
-
Signup data (User ID)
-
User data (for example: purpose of the appointment, availability (date, time slot)
-
Information regarding the scheduled appointment (chemist name and address, appointment confirmation)
6.7 DoctorChat
DoctorChat is a service of Medi24 AG (“medi24”). This medi24 feature is provided by the Abi Global Health Limited company, Dublin, Ireland (“ABI”).
DoctorChat can be used via Messenger to receive a doctor’s response to questions you pose. DoctorChat refers your question directly to an appropriate specialist in Switzerland.
If you are a Visana insurance policyholder, you are required to provide the information from your insurance card so that it can be determined whether this service is covered by your insurance plan.
Third-party provider:
-
Master data (for example: age, sex)
-
Signup data (user ID)
-
Usage data
-
Insurance data (such as policy number) if you are insured through Visana
-
Technical data (for example: language preference, IP address)
-
None
medi24 DoctorChat Data Protection Statement
Third-party provider:
-
Abi Global Health Limited
Dublin
Ireland (hereinafter ABI)
-
Master data (for example: age, sex)
-
Insurance data (such as insurer name, insurance card information)
-
Usage data (for example: data you communicate to ABI, especially health information and possibly data on sexual orientation and sex life)
-
Technical data (for example: language preference, IP address)
-
None
6.8 Scheduling an appointment with a doctor
6.8.1 Booking a doctor’s appointment with Medicosearch
MedicoSearch provides a medical scheduling platform to connect users with service providers. Registered users can directly schedule a physician’s appointment via MedicoSearch.
Third-party provider:
MedicoSearch AG
email: datenschutz@medicosearch.ch
Data divulged:
-
Master data (first name, surname, date of birth, sex, landline/mobile phone, email, address)
-
Usage data (for example: doctor’s name)
-
Signup data (for example: guest ID, user ID)
-
Usage data (for example: name and address of the doctor with whom the appointment is scheduled, selected treatment, appointment status, appointment confirmation)
MedicoSearch Data Protection Statement
6.8.2 Booking a doctor’s appointment with Arzthaus.ch
Arzthaus.ch offers a booking platform in the medical sector and connects users with LERBs of Arzthaus.ch AG. Registered users can thereby make a doctor’s appointment directly.
Third party provider:
Arzthaus.ch AG
Handelsregister: CHE-214.545.301
Data divulged:
-
Master data (first name, surname, date of birth, telephone/mobile, e-mail)
-
Usage data (e.g. name of doctor, chosen treatment, reason for booking, information whether already a patient at Arzthaus.ch, chosen booking date)
-
Usage data (e.g. name and address of the doctor where the booking was made, booking status, confirmation of booking date).
6.9 Medication search
This function provides you with lists of prescription and non-prescription medications. Each medication offers information on its applicability and composition. The packaging leaflet can be digitally accessed.
Third-party provider:
HCI Solutions AG
email: marketing@hcisolutions.ch
Data divulged:
-
None
-
None
HCI Solutions AG Data Protection Statement
7. How are offer data processed outside the app?
As already stated, the app makes reference to certain services outside the app. WELL and the relevant third party do not share data with each other.
7.1 Zur Rose Marketplace
This service can be used to order specific products through ZRMB Marketplace AG.
Third-party provider:
ZRMB Marketplace AG
email: team@zurrose.ch
Data divulged:
-
None
-
None
ZRMB Marketplace AG Data Protection Statement
7.2 Online Skin Check
OnlineDoctor AG manages the Internet mediation platform onlinedoctor.ch. Private individuals residing in Switzerland can use this platform to arrange for a dermatologist’s assessment of skin changes. Data collected in this context are anonymously processed as part of the operation of OnlineDoctor and to document symptoms.
Third-party provider:
OnlineDoctor AG
email: support@onlinedoctor.ch
Data divulged:
-
None
-
None
Online Doctor Data Protection Statement
7.3 Online trainings outside the app
The app mediates third-party online trainings.
a. Psychological online training for depression (third-party offering)
The “deprexis®” program provides support for the treatment of despondency or depression.
Psychological online training (third-party offering):
Deprexis
email: info@deprexis.com
Data divulged:
-
None
-
None
Deprexis Data Protection Statement
b. Psychological online training for feelings of anxiety (third-party offering)
The “velibra®” program by GAIA SA mediates exercises and techniques for dealing with anxieties (generalised anxieties or social phobias) and panic attacks.
Online training for feelings of anxiety (third-party offering):
Velibra
email: info@velibra.de
Data divulged:
-
None
-
None
Velibra Data Protection Statement
c. Online sleep training (third-party offering)
“somnio” online sleep training is a digital application to treat problems related to sleeping and falling asleep (insomnia).
Online sleep training (third-party offering):
mementor GmbH
email: info@mementor.de
Data divulged:
-
None
-
None
mementor Data Protection Statement
d. Online training for pain (third-party offering)
The AI-powered and CE-I-certified medicalmotion app provides you with therapist-accredited exercise recommendations that are fully customised to your needs. To use this service, users must complete a questionnaire to enable the app to convey appropriate exercises to the user.
Online training for pain (third-party offering):
medicalmotion GmbH
email: contact@medicalmotion.de
Data divulged:
-
None
-
None
medicalmotion Data Protection Statement
7.4 Blood donation
If you are a first-time donor, you can use this feature to learn about the process and requirements for donating blood and arrange a suitable appointment.
Third-party provider:
Blutspende SRK Schweiz
email: info@blutspende.ch
Data divulged:
-
Location or postal code
-
None
Blutspende SRK Schweiz Data Protection Statement
8. How are data processed in other ways?
8.1 Other purposes
We process the data identified in Section 4 not only when you make use of the third-party-provided features on and outside the app but also for other purposes associated with the use of the app, especially those listed below:
-
To comply with official laws, directives and recommendations as well as internal rules (“compliance”). For these purposes, we particularly use your master data.
-
We process technical data to enable our app can be used, to ensure system security and stability and to optimise our app. Such data include analyses, tests, error checks and backup copies,.
-
We also process your data to improve our functions and the app’s offerings. For example: we analyse which functions will be used by which groups and in what ways they will be used. For these purposes, we primarily use master, technical and behavioural/preferential data.
-
We process your data in the course of our communication with you – for example, to respond to requests and assertions of your rights or to contact you in the event any questions arise. For these purposes, we especially use communication data as well as master data where necessary in addition to signup data resulting from your use of technical functions and your response to offers. Phone communications between us can be recorded; we will inform you at the beginning of the conversation if this is occurring. Should you prefer that we not record such discussions, you are entitled at any time to interrupt the call and contact us in some other fashion. We retain these data to document our internal communication with you and for training, quality assurance and followup enquiries.
-
We also process data to conduct market research, achieve marketing objectives and support customers. For example, we can provide you with information, advertising and product offers from WELL and third-party providers. Like most companies, we engage in further tailoring of marketing messages and other communications to enable us to provide you with information and offers that are relevant to you. For these purposes, we make particular use of master and behavioural/preferential data.
-
We can also process your data for other purposes. These include processing your data for risk management, in the context of prudent business practice including company organisation and development, in the course of our internal operations and administration, to be used in education and training, to exercise our rights and defend against claims and to preserve other legitimate interests.
Should we request your consent to further data processing, we will always inform you specifically on each such occasion regarding the purposes of that processing. You can revoke your consent at any time by sending us a written communication (our contact information is found in Section 3.1). In particular, you can contest our processing for marketing purposes and even limit your objection to specific communication channels (for example, email advertising) or specific promotions (see Section 11).
8.2 Additional notifications
Consistent with the purposes we have identified, we also send your personal data to other third parties, especially recipients in the following categories:
-
Authorities: We can share your personal data with official agencies, courts and other domestic and international authorities when we are obligated or entitled by law to do so or when it appears necessary that we share such information to protect our interests. Such circumstances can also apply to health data. These authorities process the data they receive from us under their own responsibility.
Examples of applicable scenarios include criminal investigations, police actions (for example: protective arrangements, combatting violence, etc.), extrajudicial requirements and examinations, court proceedings, reporting obligations and pre-trial or out-of-court proceedings as well as our legal duty to provide information and cooperation. Data can also be divulged if we wish to obtain information from public institutions – for example: to justify an interest in information or when required to identify someone about whom we need information (for example: from a register).
-
Payment providers: If you select direct payment in the WELL app, we communicate the personal information required for invoicing (especially your master data) along with the email address (to send confirmation of your payment) and the means of payment you have chosen as well as the amount in Swiss francs to an external payment provider where you can transact your payment via a platform. WELL receives a transaction ID to use in allocating the payment to your order. The provider through which we process payments is Payrexx, a service of PAYREXX AG (Burgstrasse 18, 3600 Thun, Switzerland, email: info@payrexx.com). You can obtain further information here.
-
Other persons: This refers to other cases where third parties are engaged pursuant to the purposes identified in this Data Protection Statement. Examples of other recipients include delivery addressees that do not match those you provided to us. In the course of our corporate development, we may sell, acquire or partner with businesses or business units, assets or companies, and such actions could result in data being divulged to persons involved in these transactions. Recipients in all these categories may in turn engage the services of third parties, and this may result in your data becoming accessible as well to them. We can restrict the processing to specific third parties (for example: IT providers) but not others (for example: authorities, banks, etc.).
Please note that when data are sent via networks, multiple Internet providers participate in the transfer. The possibility cannot be excluded that third parties may access information being transmitted in this fashion and make unauthorised use of it. For this reason, sensitive data such as passwords should never be sent via email. In this connection, you should observe a duty of care stemming from applicable general terms and conditions as well as additional terms contained in the product and service conditions of other third-party providers. Even when a transmission is encrypted, the names of the sender and recipient remain identifiable. Third parties may therefore be able to draw conclusions concerning business relationships. When the app is used or installed, third parties (for example: Apple or Google) may make suppositions concerning the existence of a customer relationship with WELL and certain contents.
9. Online tracking and similar technologies
In operating our app, we use third-party services to be able to measure and improve the user-friendliness of the app and our online promotional campaigns. In this light, we can integrate third-party components into our app and website that can in turn deposit cookies. Third-party providers may also be based outside Switzerland and the EU/EEC, especially in the United States, to the extent that your personal information is protected to a reasonable degree. Laws in such countries (for example: in the United States) do not always protect data in a manner equivalent to that assured under Swiss law. For this reason, we draw up contractual provisions to bring the weaker legal protection up to Swiss levels, provided that individual data protection measures have not been legally established for other reasons. These conditions particularly include the standard contractual clauses issued or recognised by the European Commission and the Swiss Federal Data Protection and Information Commissioner (FDPIC). Data are stored by service providers collaborating with WELL almost exclusively on servers in Switzerland and in EEC member states. Your data processed by WELL in the context of your use of the app are also exclusively stored on the Google Cloud platform maintained by Google Cloud EMEA Limited on servers in Switzerland. The Google Cloud platform employs a particularly high level of security in protecting your most sensitive personal information. You can access further information here regarding the security of your data on the Google Cloud platform.
In situations where we track you or employ similar technologies, our core aim is to be able to distinguish your access (via your own system) from access by other users, thus enabling us to ensure the website’s functionality and perform statistical analyses. In doing this, we have no interest in revealing your identity even though we possess the ability to do this, since we or third parties engaged by us can identify you in combination with your signup data. Even without signup data, however, the techniques we employ are designed to recognise you as an individual each time you access a page – for example, when our server (or the third-party server) assigns you a unique recognition number (known as a “cookie”). Cookies are tiny files stored by your browser onto your device to log your access of the app or web pages and record your preferences when you navigate through various pages or save configurations when you access our website. We use other tools besides cookies that have the capacity to distinguish your access from that of any other users. We use such techniques on our app and permit certain third parties to use them as well.
You can program your browser to block or outwit certain cookies or to erase existing cookies. You can also enhance your browser with software to block tracking by specific third parties. You can learn more about this feature on your browser’s help page (usually under the term “data protection”) or on the websites of any third parties whose tools are used by WELL.
We currently feature offers by various service providers and contracted advertising partners. Described below are the most noteworthy offers and service providers we use. Other providers generally process personal and other data in a similar fashion:
-
Mixpanel, a product analysis service. The service is provided by Mixpanel Inc., a company located at One Front Street, 28th Floor, San Francisco, CA 94195 in the United States. Mixpanel stores and process information on user behaviour on our app. In so doing, it uses performance cookies that make it possible to analyse your use of our app. The data are stored on a server in the Netherlands (EU). To ensure reasonable data protection, Mixpanel does not store the IP address but instead uses IPs solely to map data when logging site characteristics. In addition, we include the standard contractual clauses approved by the EU. We use Mixpanel for marketing and optimisation, especially to analyse the use of our app and to be able to improve individual functions and offerings as well as the ongoing user experience. Through statistical assessment of user behaviour, we can improve our offerings and design them to be more interesting to users like you. You can find additional information regarding data protection at Mixpanel by clicking here.
-
Google Forms, a service within the G-Suite program package of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, U.S.) and Google Ireland Ltd. (Google Building Gordon House, Barrow St, Dublin 4, Ireland). You can learn more about Google data protection policies here. In addition, we use the Formfacade add-on for Google Forms. WELL uses Google Forms to collect user feedback. Additional information on data protection by Formfacade can be found here.
-
Airship is a customer engagement platform. The service is offered by the Airship Group, Inc., 1225 West Burnside Street, Suite 401, Portland OR, 97209, United States. Airship records data resulting from use of the app. Such use includes actions related to app use (for example: opening the app) as well as interactions (views, clicks) involving news supplied by Airship via push notifications, emails and in-app messages. The data collected in this way ensure that the user’s experience is improved through increasingly relevant communication. Consent for push notifications and email messages is obtained during the user signup process. Exceptionally, no consent is obtained for push messages sent to Android users. Notification preferences can be modified by the user at any time through adjustment of the settings. Collected data are stored on European servers. You can find additional information here regarding Airship data protection.
-
Freshdesk, a help desk and ticketing software package for efficient customer service design. The company providing this service is Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, United States. The software enables us to store, track and respond to user requests and to manage these in a variety of ways. The data are stored on servers in Germany. Further information regarding data protection policies at Freshworks can be obtained here.
10. What else should you know?
10.1 What happens in profiling?
“Profiling” refers to the automatic processing of personal data to analyse individual aspects or forecast outcomes – for example, analysis of personal interests, preferences, affinities and habits or the prediction of likely behaviour. When profiling is used, preferential data in particular can be collected.
For the purposes already described in this Data Protection Statement, we can automatically process and evaluate data. This practice also includes “profiling”, the automatic processing of data for the purposes of analysis and forecasting and to evaluate preferential data. The most significant examples are profiling for customer care and for marketing purposes.
10.2 For how long do we process your personal information?
We store and process your personal data for the duration required to accomplish the purpose of the processing, for as long as we have a justified interest in the storage (for example, to assert legal claims, for archiving purposes or to ensure IT security) and until retention of the data is no longer legally mandated. Once legal or contractual obligations have expired and the storage or processing period has ended, we destroy or anonymise your data in the course of our normal operations.
10.3 How do we protect your data?
We engage in reasonable security measures to ensure the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or illegal processing and to counteract the risk of loss, unintentional modification, involuntary disclosure or unauthorised access. Despite these actions, security risks cannot generally be eliminated, and residual risks are unavoidable.
Security measures of a technical or organisational nature can also include other steps such as data encryption and pseudonymisation, log maintenance, restricted access, creation of backup copies, directives to our employees, confidentiality agreements and monitoring.We use our own encryption mechanisms to protect your data during transmission via our app. We can only secure areas under our control, however. We also require our processors to take reasonable steps to safeguard data.
11. What are your rights?
To facilitate your review of the processing of your personal data, you have the following rights related to our data processing:
-
Information: You have the right to demand information regarding our processing of your personal data and a copy of the personal data.
-
Rectification: You can demand that we correct or supplement inaccurate or incomplete data – for example, when these data are incorrect.
-
Erasure: You have the right to demand the erasure or anonymisation of your data.
-
Objection and revocation: You can object to our processing for specific purposes (for example, processing intended for marketing). You have the right to revoke your consent with future effect if processing is based on consent. Please note that we are entitled to continue to process your personal data to the extent allowed under the law even after you have revoked your consent.
-
Portability: You have the right to receive the personal data you have made available to us in a structured, commonly used and machine-readable format or to have these data transmitted to a third party, provided that the data processing in question is based on your permission or is required for the fulfilment of a contract.
Please bear in mind that these rights are subject to legal requirements and restrictions and may not therefore be fully applicable to you in every case. In particular, we may be required to continue to process and store your personal data to fulfil the terms of a conteact with you, to safeguard interests that may be worthy of protection such as the assertion or exercise of our claims or defence against the claims of others, or to comply with legal obligations. To the extent legally permissible, therefore, especially in order to protect the rights and freedoms of other affected persons and to safeguard interests worthy of protection, we are entitled to refuse a request by an affected party either fully or in part (for example, by blacking out certain contents affecting third parties or containing our own business secrets).
If you wish to assert your rights vis-à-vis WELL, please send us a written communication. Our contact information is found in Section 3. We are generally required to check your identity (through provision of a copy of an identity document, for example). We need to identify you to exclude the possibility of abuse (for example, by means of a copy of an identity document to the extent that this is not possible in some other way).
You are entitled to these rights with respect to third-party providers that collaborate independently with us – please contact these providers directly whenever you exercise your rights in connection with their processing of your data. You can find information regarding these third-party providers in Sections 6 and 7.
You may also elect to lodge a complaint with a supervisory authority if you have misgivings as to whether the processing of your personal data is legally justified. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
Data Protection Statement version: 05 September 2022