Privacy Policy
Last updated: 06th of November 2026
1. Who we are and what this policy covers
ctcHealth SARL, Route de Chêne 5, 1207 Genève, Switzerland (“ctcHealth”, “we”, “us”) is responsible for the processing of personal data described in this policy. You can reach us at contact@ctchealth.ch or +41 76 317 12 23. We have not appointed a data protection officer; privacy requests go to the same address.
This policy explains how we handle personal data when you visit www.ctchealth.ch (the “Website”), contact us or use the chat assistant on the Website. It applies under the Swiss Federal Act on Data Protection (FADP) and, where applicable to our processing activities, the EU General Data Protection Regulation (GDPR).
It does not cover our software products. Use of PLATO and our other platforms is governed by separate privacy notices provided with those products, for example, the PLATO Privacy Policy. It also does not cover third-party websites we link to, such as LinkedIn.
2. What data we collect
We collect only what you give us and what your browser sends when you visit. We do not buy contact lists or obtain data about you from data brokers.
Source
Data
When
AI chat assistant
Your messages and the assistant’s replies, technical session data
When you use the chat
Email or phone contact
Your contact details and what you tell us
When you contact us directly
Your device (automatic)
IP address, browser and device type, operating system, pages viewed, referring page, date and time of visit
Every visit
Website analytics (automatic)
Pages viewed, referring page, approximate location, browser and device type, collected without cookies
Every visit
Please do not send health information. Our website is for business enquiries. Do not include health data about yourself or anyone else in emails or the chat assistant. If we receive unsolicited health data, we delete it unless it is required or permitted by applicable law.
3. Why we use your data and on what legal basis
We use personal data only for the purposes below. Swiss law does not require a legal basis for each purpose; we state the GDPR basis for visitors in the EU and EEA.
Purpose
Data used
GDPR legal basis
Answer your enquiry, arrange a demo, prepare an offer
Email and phone data
Steps before a contract (Art. 6(1)(b)) or our legitimate interest in responding to business enquiries (Art. 6(1)(f))
Run the chat assistant and answer your questions
Chat messages, session data
Legitimate interest in answering visitor questions (Art. 6(1)(f))
Follow up with business contacts about our services
Name, email, company, position
Legitimate interest in B2B communication (Art. 6(1)(f)); consent where the law requires it (Art. 6(1)(a))
Deliver the Website and keep it secure
Device data
Legitimate interest in a working, secure website (Art. 6(1)(f))
Measure how the Website is used, in aggregate
Device data (cookieless analytics)
Legitimate interest in understanding and improving the Website (Art. 6(1)(f))
Meet legal obligations and defend legal claims
Any of the above, as needed
Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f))
You can object to processing based on legitimate interest and withdraw consent at any time (section 9). Withdrawal does not affect processing that happened before it.
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell it. The chat assistant gives automated answers but makes no decisions about you.
4. Cookies and similar technologies
Our Website does not use cookies. We do not use advertising, retargeting or cross-site tracking technologies.
Website analytics. We use the built-in analytics of our website provider Framer to count visits and see which pages are used, in aggregate. It works without cookies and without storing information on your device.
Technical storage. Your browser may keep a small technical cache so pages load faster. It contains no personal data and is not used to track you.
Fonts. Our Website loads fonts from Google Fonts (Google Ireland Ltd. / Google LLC), which receives your IP address when the font files are fetched. See Google’s privacy policy.
If we add cookies that require your consent, we will update this policy and ask for your consent first.
5. Who we share data with
We share personal data only with service providers who process it on our behalf under a written contract, and only as far as they need it. They may not use it for their own purposes, and providers of AI services may not use it to train their models.
Recipient
Role
Location
Framer B.V. (Netherlands) and its hosting provider Amazon Web Services
Website hosting and cookieless website analytics
EU, USA
Google Ireland Ltd. / Google LLC
Delivery of website fonts
EU, USA
ctcHealth AI agent
AI chat assistant
EU
Microsoft (Microsoft 365)
Email and handling of enquiries
EU, USA
Professional advisers (lawyers, auditors)
Advice and audits, under confidentiality
Switzerland
Framer’s terms are in its data processing addendum and privacy statement.
We may also disclose data to authorities or courts where the law requires it, or to protect our rights in a dispute. If ctcHealth is merged with or sold to another company, data may pass to the buyer, who must keep to this policy.
6. International transfers
Your data is processed mainly in Switzerland, and through our providers in the EU and the USA. Switzerland recognises the EU and EEA as providing adequate data protection.
For transfers to the USA, we rely on the Swiss-US and EU-US Data Privacy Frameworks where the recipient is certified (for example Google LLC and Microsoft). Where a recipient is not certified, or if a framework ceases to apply, we use the European Commission’s Standard Contractual Clauses, as recognised by the Swiss FDPIC. You can request a copy of the safeguards we use at contact@ctchealth.ch.
7. How long we keep data
We keep data only as long as we need it for the purpose it was collected for, then delete or anonymise it.
Data
Retention
Enquiries and business contact data
24 months after our last contact with you, unless a contract follows
Data related to a contract
10 years after the contract ends, as required by Swiss accounting law (Art. 958f CO)
Chat assistant conversations
14 days, then deleted automatically
Device data and analytics
Up to 14 months
We keep data longer only where the law requires it or to establish or defend legal claims. Deleted data may remain in backups for a short period until they are overwritten.
8. Security
We protect personal data with technical and organisational measures appropriate to the risk. These include TLS encryption of all traffic to the Website, access limited to staff who need the data, multi-factor authentication on our accounts and contracts requiring our providers to apply equivalent measures. No system is fully secure. In the event of a personal data breach, we will notify the relevant supervisory authorities and affected individuals where required by applicable data protection laws.
9. Your rights
Subject to the conditions and exceptions in applicable law, you have the right to:
Access the personal data we hold about you and receive information about how we process it.
Correct inaccurate or incomplete data.
Delete your data, or have us stop processing it.
Object to processing based on our legitimate interests, and to any direct marketing at any time.
Restrict processing while a correction or objection is being checked (GDPR).
Receive your data in a common electronic format, or have it sent to another organisation (data portability).
Withdraw consent at any time, with effect for the future.
To use these rights, email contact@ctchealth.ch or write to the address in section 1. We may ask you to prove your identity. We respond within the time limits required by applicable law—generally 30 days under Swiss law or one month under the GDPR. Where a legally permitted extension is necessary, we will inform you within the applicable initial response period and explain the reasons. Requests are generally handled free of charge.
You can also complain to a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. In the EU, you can complain to the data protection authority in the country where you live or work. We would appreciate the chance to address your concern first.
10. Children, changes and contact
Children. The Website is intended for business professionals aged 18 or over and is not directed at children. If you believe a child has provided personal data through the Website, please contact us so we can review the matter and delete the data where appropriate.
Changes. We may update this policy when our Website, services or the law change. The “Last updated” date at the top shows the current version. We will announce significant changes on the Website before they take effect.
Contact. ctcHealth SARL, Route de Chêne 5, 1207 Genève, Switzerland · contact@ctchealth.ch · +41 76 317 12 23