Privacy Policy

1. Controller

Aida Medical SA, Campus Biotech Innovation Park, Avenue de Sécheron 15, 1202 Geneva, Switzerland (UID CHE-458.981.803), is the controller for the processing described in this policy.

For any question or request about your data: legal@aida.med, or by post at the address above.

2. Scope

This policy covers the personal data we process as controller: when you visit the aida.swiss website, write to us, request a demonstration or a trial, apply for a job, or when you are our customer, prospect or supplier.

Patient data processed in Aida MD, Aida Dental and Aida Desk is processed on behalf of the practices and clinics that use this software, which remain the controllers. We act there as a processor, under the data processing agreement concluded with each customer. Section 10 describes this processing.

It applies to persons located in Switzerland, in the European Union and elsewhere. The rights of persons located in the European Union derive from the GDPR; those of persons in Switzerland, from the FADP.

3. Data we process

We collect only the data necessary for the purpose pursued. Depending on your relationship with us, this is the following data.

• Contact form and demonstration requests: first name and surname, professional e-mail address, telephone number, practice or organisation, role, the product you are interested in, your message, as well as the site language, the originating page and the source of your visit.
• Support requests sent from the Aida software: name, e-mail address, product concerned, description of the problem and, if you attach them, screenshots.
• Job applications: name, contact details, CV, cover letter and the information you choose to send us.
• Contractual relationship: identity of contact persons, contact details, role, billing and payment data, history of correspondence and support.
• Correspondence by e-mail, telephone or video call: the content of our exchanges and their metadata (date, participants).
• Browsing the website: IP address, device and browser type, pages viewed, duration of visit, referring website, interaction events (playing a video, submitting a form), collected by our technical logs and by the audience measurement described in Section 9.

We collect no health data about you through the website. If you mention sensitive information in a free-text message, we handle it with the required confidentiality and solely to respond to your request.

4. Purposes and legal bases

We process your data for the following purposes. The legal basis stated is that of the GDPR where it applies; under Swiss law, this processing rests on the principle of proportionality and, where relevant, on our overriding interest or on your consent.

• Responding to your requests, arranging a demonstration, a trial period or an installation: pre-contractual measures and performance of the contract (Art. 6(1)(b) GDPR).
• Managing the customer relationship, billing, support and account security: performance of the contract and legal obligations (Art. 6(1)(b) and (c) GDPR).
• Informing you about our products when you are a customer or have contacted us: legitimate interest in developing our business (Art. 6(1)(f) GDPR), with a right to object at any time.
• Processing your job application: pre-contractual measures (Art. 6(1)(b) GDPR) and, for retention beyond the recruitment process, your consent (Art. 6(1)(a) GDPR).
• Operating the website, securing it and measuring its audience: legitimate interest (Art. 6(1)(f) GDPR); consent is required for non-essential cookies where the applicable law so requires.
• Complying with our legal obligations, in particular accounting and tax obligations, and asserting our rights: legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).

We make no decision producing legal effects concerning you based solely on automated processing, and we do not build profiles for advertising purposes.

5. Recipients and processors

Your data is accessible to those employees of Aida Medical SA who need it for their role and who are bound by confidentiality. We do not sell your data and disclose it to third parties only in the following cases.

Service providers that process data on our behalf, bound by contract and by confidentiality and security obligations:

Authorities and third parties: we disclose data where the law requires us to, to respond to a request from a competent authority, or to establish, exercise or defend our legal rights.

Restructuring: in the event of a merger, acquisition or transfer of business, your data may be passed to the acquirer, which remains bound by this policy.

6. Transfers abroad

We host our customers' data in Switzerland. Some of the website's service providers nevertheless process data in the European Union, which offers a level of protection recognised as adequate by the Federal Council and the European Commission.

Where a provider is established in the United States or may transfer data there (Cloudflare, Google), the transfer relies on its certification under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework and, failing that, on the European Commission's standard contractual clauses recognised by the Federal Data Protection and Information Commissioner, supplemented by technical measures such as encryption.

You may obtain a copy of the applicable safeguards by writing to info@aida.med.

7. Retention periods

We keep your data for as long as necessary for the purpose for which it was collected, and then for as long as the law requires. As a guide:

• Contact and demonstration requests that do not lead to a contract: 24 months after our last exchange.
• Customer relationship data: for the duration of the contract, then 10 years for accounting and contractual records (Art. 958f of the Swiss Code of Obligations).
• Support tickets: for the duration of the customer relationship, then 12 months.
• Job applications: 6 months after the end of the recruitment process, unless you agree to a longer retention with a view to another position.
• Website technical logs: 30 days at most, except for a security incident under investigation.
• Audience measurement: 14 months (Google Analytics 4 retention setting).

At the end of these periods, the data is deleted or anonymised.

8. Security

We protect your data with technical and organisational measures proportionate to the risk: encryption in transit (TLS 1.3) and at rest (AES-256), keys managed on FIPS 140-2 Level 3 certified hardware security modules (HSM), strong authentication (MFA) on every account, roles and least privilege, access logging, encrypted backups, annual penetration tests by an independent third party, and regular training of the team. The Aida software is hosted in Switzerland by Infomaniak SA, in ISO 27001-certified data centres.

In the event of a security breach likely to result in a high risk to your rights, we will inform you and notify the competent authority within the statutory time limits.

9. Cookies and audience measurement

The website uses a session cookie necessary for the language choice, Google Analytics 4 to measure its audience in aggregate, and Google Maps on the Contact page only. The cookies set, their duration and how to refuse them are described in our Cookie Policy.

From the European Economic Area and the United Kingdom, audience measurement and the map only load with your consent, given in the cookie banner and revocable at any time.

10. Patient data in the Aida software

When a practice or clinic uses Aida MD, Aida Dental or Aida Desk, it remains the controller of its patients' data. Aida Medical SA acts as processor within the meaning of Art. 9 FADP, on the customer's documented instructions and under a data processing agreement concluded with each customer, which prevails over the General Terms for any data protection matter. That agreement and its annexes (description of the processing, technical and organisational measures, list of sub-processors) are provided with the offer and can be downloaded from the Trust Centre.

What we process on the customer's behalf: the written transcript of the consultation, draft notes, suggested diagnoses and tariff positions, the documents produced, the agenda and contact data needed by Aida Desk, the identification data of authorised users, and technical logs. These are sensitive data within the meaning of Art. 5(c) FADP.

What we do not do: we keep no audio recording, as the consultation is transcribed live and no audio file is kept once the note has been produced; we send no clinical data to third-party AI providers (OpenAI, Google, Anthropic or others), as our models run on our own infrastructure in Switzerland; we do not exploit customer data commercially and train no model on data that could identify a patient, a user or a practice.

Place of processing: all processing (hosting, processing by our AI systems, backups, logs and support) takes place exclusively in Switzerland, in the ISO 27001-certified data centres of Infomaniak SA. Administrative access is nominative, logged and limited to Swiss territory. No data is disclosed abroad without the customer's prior written consent and compliance with Art. 16 et seq. FADP.

Confidentiality: Aida staff who access these data act as auxiliaries of the healthcare professional. They are bound by professional secrecy (Art. 321 of the Swiss Criminal Code) and the duty of discretion (Art. 62 FADP), sign confidentiality undertakings and are trained in data protection.

Sub-processors: Infomaniak SA (Geneva) provides hosting and compute infrastructure. Any addition or replacement is notified to the customer in writing at least thirty days in advance; the customer may object on legitimate grounds and, failing a reasonable solution, terminate the services concerned without penalty. Messages that Aida Desk exchanges by SMS or WhatsApp pass through the operators of those services, like any messaging.

Security breaches: any data security breach is notified to the customer without undue delay, and at the latest within 24 hours of its discovery, with the information needed to notify the FDPIC and, where applicable, to inform patients (Art. 24 FADP).

Retention, return and deletion: notes and structured data are kept for as long as the customer keeps them in the services; access logs for twelve months; encrypted backups for thirty days. The customer can export its data at any time in open formats. At the end of the contract, all data is returned within thirty days, then every copy is deleted, backups being overwritten at the latest ninety days after the return, with a written certificate of deletion.

Audit: once per calendar year, or after a significant breach, the customer may have compliance with the data processing agreement verified, itself or through a qualified third party, and obtain the compliance documentation (record of processing activities, security measures, hosting provider's certificates, penetration test summaries).

Patients' rights: a patient who wishes to exercise their rights of access, rectification or erasure contacts their practice or clinic, the sole controller. Any request that reaches us directly is forwarded to it without delay, and we assist our customers in answering within the statutory time limits.

11. Your rights

You have the following rights, within the limits laid down by the FADP and, where applicable, by the GDPR:

• Access: obtain confirmation that we process your data and receive a copy of it, with the information provided for by law.
• Rectification: have inaccurate data corrected or incomplete data completed.
• Erasure: obtain the deletion of your data when it is no longer necessary or when you withdraw your consent, subject to our legal retention obligations.
• Restriction: request that processing be frozen while a dispute is being examined.
• Portability: receive the data you have provided to us in a common, machine-readable format, or have it transmitted to another controller.
• Objection: object at any time to processing based on our legitimate interest, including any direct marketing.
• Withdrawal of consent: withdraw consent you have given at any time, without affecting the lawfulness of prior processing.

To exercise these rights, write to info@aida.med or to our postal address. We may ask you to prove your identity. We respond within 30 days, a period that may be extended where the request is complex; we will inform you if so.

Exercising these rights is free of charge, except for manifestly unfounded or excessive requests.

12. Complaints

If you believe that the processing of your data breaches the law, you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Berne, www.edoeb.admin.ch.

Persons located in the European Union may also contact the data protection authority of their country of residence.

13. Minors

The website and our services are intended for healthcare professionals and organisations. We do not knowingly collect data from persons under 16 through the website. If you believe that a minor has sent us data, write to us and we will delete it.

14. Changes

We may adapt this policy as our services or the law evolve. The version in force is the one published on this page, with its update date. In the event of a significant change, we inform our customers by e-mail.

15. Contact

Aida Medical SA, Campus Biotech Innovation Park, Avenue de Sécheron 15, 1202 Geneva, Switzerland. Data protection: legal@aida.med. General enquiries: info@aida.med, +41 22 519 72 17.