Legal

Privacy policy

Last updated: 6 October 2026

Draft: values in [Placeholder: …] are still missing, and this text has not had a legal review yet.

1. Who is responsible

Data protection contact: [Placeholder: name or role of the data protection contact, and address]
Representative in the EU (GDPR Art. 27): [Placeholder: EU representative, if required]

This policy follows the Swiss Federal Act on Data Protection (nDSG) and, where it applies to visitors in the EU or EEA, the EU General Data Protection Regulation (GDPR).

2. In short

• No analytics, no advertising trackers, no cookies.
• If you send a booking request, we store what you enter in that form.
• If you use the free assessment, your answers are sent to Rhythm-Connect to calculate the result. This website does not store them.
• Payments, once the shop opens, are handled by Stripe. Your card details never reach this website.

3. Hosting and server logs

This website runs on Cloudflare Workers (Cloudflare, Inc., USA). Its content database (Cloudflare D1) is placed in Cloudflare's Western Europe region. To deliver pages and protect the site against attacks, Cloudflare processes your IP address and technical request data (time, address requested, browser). Request logs are kept for [Placeholder: log retention period].

Transfer to the USA: [Placeholder: legal basis for the transfer to Cloudflare, e.g. data privacy framework certification or standard contractual clauses, to be confirmed]

Purpose and basis: running a secure website (legitimate interest; GDPR Art. 6(1)(f)).

4. Fonts

The font used for headings and text (Ballinger) is licensed through Adobe Fonts and loaded from Adobe's servers (use.typekit.net, Adobe Inc., USA). When a page loads, your browser sends your IP address and browser data to Adobe. The fallback font (Plus Jakarta Sans) is served from this website; no request goes to Google. Adobe's handling: [Placeholder: Adobe Fonts data processing terms and transfer basis]

5. Booking and interest requests

The form on the "Book & start" page (also reached through "Notify me") collects your name, your email address, what you are interested in (a consultation, a program, a kit or a Digital Clinic) and anything else you type into it. A request about a health topic can reveal health information; please only enter what is needed.

The request is stored in this website's database (Cloudflare D1, see section 3). The practice team reads it through Rhythm-Connect with an authenticated connection. It is not public.

Purpose: answering your request and letting you know when a service opens. Basis: your request and consent (GDPR Art. 6(1)(a) and (b), Art. 9(2)(a) for health information). Retention: [Placeholder: retention period for booking and interest requests]

6. The free assessment

When you click "Show my result", this website's server forwards the following to Rhythm-Connect, our patient platform, to calculate your result:

• the concern you chose,
• your four answers (palpitations, symptoms when upright, fainting, link to an infection), each as a number on a scale,
• if you entered them, your pulse lying down and standing.

No name, no email address and no other contact details are sent. Because the request passes through this website's server, Rhythm-Connect sees the request coming from this website. This website does not store your answers or the result.

Where Rhythm-Connect runs: [Placeholder: hosting provider and location of Rhythm-Connect]
Whether and how long Rhythm-Connect keeps the answers: [Placeholder: Rhythm-Connect retention for anonymous assessment requests]

To prevent abuse, this website counts submissions per IP address. The IP address and the time of the submission are kept for one minute and removed with the next submission after that. The same applies to the booking form and the checkout.

Purpose and basis: giving you the orientation you asked for (your request; GDPR Art. 6(1)(b), Art. 9(2)(a)).

The result is an automated orientation based on fixed rules. It is not a medical assessment and not a diagnosis. A physician sees it only if you bring it to a consultation or save it in your Rhythm-Connect account.

7. Logging in to Rhythm-Connect

"Log in" and the links to programs take you to the Rhythm-Connect app on its own address. From there, its own privacy policy applies: [Placeholder: link to the Rhythm-Connect privacy policy]

8. Payments (Stripe)

The shop is not open yet. Once it is, payments are processed by Stripe ([Placeholder: contracting Stripe entity and address]). Stripe collects your card or TWINT details, billing address and, for kits, a shipping address in Switzerland. We receive the order and a payment confirmation, not your card details. Retention of order data: [Placeholder: retention period for order data, e.g. under accounting law]

9. Email

If you write to us by email, we use your message and address to answer you. Email is usually not encrypted end to end; please do not send detailed health information by email. Email provider: [Placeholder: email provider and location]

10. Your rights

Under the nDSG and, where it applies, the GDPR, you can:

• ask what personal data we hold about you (right of access),
• have incorrect data corrected,
• have your data deleted, unless we must keep it by law,
• object to processing or restrict it,
• receive data you gave us in a common machine-readable format,
• withdraw consent at any time, without affecting what happened before.

Write to info@rhythmologicum.ch. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your local data protection authority.

11. Changes

We update this policy when the website changes. The date at the top shows the current version.