Privacy

General

Based on Article 13 of the Swiss Federal Constitution and the revised Federal Act on Data Protection (revFADP, in force since 1 September 2023), every person has the right to protection of their privacy and protection against misuse of their personal data. Resident AG complies with these provisions. Personal data is treated strictly confidentially and is neither sold to third parties nor passed on without authorization.

Controller

Resident AG
Bahnhofplatz 5b, 8400 Winterthur, Switzerland
info@resi-dent.ch

Contact Point for Data Protection Matters

For data protection matters, please contact Dr. Markus Franke, Resident AG, info@resi-dent.ch.

Processing When Visiting the Website

When you access our website, your browser transmits technically necessary data to the server, including your IP address, the date and time of access, the page requested and information about your browser and operating system. These server log data are processed solely to operate the website securely and reliably (legitimate interest) and are not combined with other data sources. No analysis relating to your person takes place.

Hosting

Our website is hosted by a specialised hosting provider based in the USA. As a processor acting on our behalf, it processes the technically necessary connection data, in particular the server logs. This may involve disclosure of data to the USA. Such disclosure is based on appropriate safeguards, in particular the standard contractual clauses.

Cookies and Measurement

When you visit our website we use cookies and comparable techniques and measure how the website is used. Measurement starts when the page is opened. You may object to it at any time, see the following section.

• Necessary (always active): technically required, e.g. to store your cookie choice and for online appointment booking.
• Audience measurement: Google Analytics and PostHog.
• Measuring the success of our advertising: Meta pixel, Microsoft Advertising and Google advertising features.
• Google Maps: loaded once you activate a map with the «Load map» button.

Measurement is based on our overriding interest in evaluating and improving our web offering and in measuring the success of our advertising (Art. 31(1) revFADP). The services used store pseudonymous identifiers in cookies and in your browser storage; details follow in the sections below. The Meta pixel sets a cookie («_fbp») and stores technical information about the origin of your visit in your browser's local storage.

Objecting to Measurement

The objection applies jointly to PostHog, Google Analytics, the Meta pixel and Microsoft Advertising. From the objection onwards we transmit no further data to these services, and the analytics identifiers set by PostHog are removed from your browser storage. Data already transmitted is not covered by this.

We store your objection in a technically necessary first-party cookie («resident_consent») on this device. It remains in effect as long as that cookie exists, for at most 400 days. If you clear your browser cookies or use a different browser or device, please set the objection again there. In Safari the browser shortens the lifetime of such cookies to seven days.

Statistics: PostHog

We use PostHog (PostHog Inc., USA) in its EU cloud region in Frankfurt to analyze how our website is used. We record page views and selected clicks on appointment, phone, email and map links. We process the page visited, the language, the practice location and link placement where applicable, and technical browser and device information. To attribute traffic sources, we collect the referring domain and selected campaign identifiers. Pseudonymous identifiers are stored in cookies lasting up to 90 days and in your browser's session storage to associate related visits.

We additionally record the course of your visit. Recorded are the page content displayed, mouse movement, clicks, scrolling, window size and page changes. From this recording your visit can be replayed afterwards like a video. Entries in input fields are masked before transmission. The ZaWin booking window and embedded maps are not recorded but shown as placeholders. Keyboard input, clipboard content, file names and the content of network requests are not recorded either. The recordings are pseudonymous, are not linked to patient data and are deleted after 30 days.

Your IP address is technically transmitted when connecting to the service; geographic enrichment is disabled. We do not send patient data to PostHog. A click on «Book appointment» is measured as a click and does not confirm a completed booking in the external booking system.

Data is stored in the selected EU region. In providing the service, PostHog and its subprocessors may also process data in the USA or other countries. Information about these providers and safeguards for international transfers is available in the data processing agreement and the list of subprocessors.

You may object to this measurement at any time, see the section «Objecting to Measurement». For more information, see PostHog's privacy policy.

Statistics: Google Analytics

We use Google Analytics 4 (Google Ireland Ltd., Ireland, and Google LLC, USA) to analyze the use of our website. Google Analytics 4 does not store your IP address; it is used solely for approximate geographic attribution and is then discarded. This may involve disclosure of data to the USA (Swiss-U.S. Data Privacy Framework, standard contractual clauses). The basis is our overriding interest. You may object to this measurement at any time, see the section «Objecting to Measurement».

Marketing: Meta Pixel, Microsoft Advertising and Google Advertising Features

To measure the success of our advertising campaigns we use the following services:

• Meta Pixel (Meta Platforms Ireland Ltd., Ireland, and Meta Platforms Inc., USA): measures the success of our advertising on Facebook and Instagram and enables more relevant ads. The pixel sets a cookie («_fbp») and stores technical information about the origin of your visit in your browser's local storage.
• Microsoft Advertising (Microsoft Ireland Operations Ltd., Ireland, and Microsoft Corporation, USA): measures, via the Bing UET tag, which ads in the Microsoft advertising network (Bing) lead to appointment bookings or calls.
• Google advertising features (Google Ireland Ltd., Ireland, and Google LLC, USA): using the same Google tag we use for statistics, Google may build advertising audiences (Google Signals). Your IP address is transmitted in truncated form.

These tools are configured and evaluated within our own accounts. A marketing agency based in Switzerland that we have engaged has access to these accounts for that purpose and processes the data held there solely on our behalf and on our instructions.

This may involve disclosure of data to the USA (Swiss-U.S. Data Privacy Framework, standard contractual clauses). The basis is our overriding interest. You may object to this measurement at any time, see the section «Objecting to Measurement». The privacy policies of Google, Meta and Microsoft apply in addition.

Google Maps

To display our locations we embed maps from Google Maps (Google Ireland Ltd., Ireland, or Google LLC, USA). The maps are loaded only once you activate an individual map with the «Load map» button. Only then is a connection to Google established, your IP address transmitted and cookies may be set by Google. The Google privacy policy applies in addition.

Google Reviews

Where we display Google reviews of our practices on this website, these are retrieved when the website is built (at build time) and stored as static content. As a result, no connection to Google takes place when you visit the website and no cookies are set.

Online Booking via ZaWin

For online appointment booking we use ZaWin, practice management software provided by Martin Engineering AG, Gewerbestrasse 1, 8606 Nänikon, Switzerland (UID CHE-108.014.012). The booking window is embedded on our booking pages. Any information you enter there is transmitted directly to Martin Engineering AG and processed on our behalf. The ZaWin privacy policy applies in addition.

Patient Survey

After a visit to one of our practices, you can take part in a short survey on this website. Participation is voluntary. We do not ask for your name or contact details.

We process your answers (how likely you are to recommend us, the topics you select, whether you were offered a drink and whether it was your first visit) as well as the practice location and the way you opened the survey (text message, QR code or tablet in the practice). The purpose is to improve the quality of our care and service. No measurement takes place on the survey pages.

The survey page and the transmission of your answers are handled by the service provider described in the «Hosting» section. Resident AG evaluates the answers in its internal reporting application. They are stored with Supabase in Zurich, Switzerland, as monthly counts without IP addresses. For your rights, the «Your Rights» section applies; please send requests to info@resi-dent.ch.

Contacting Us

If you contact us by email or telephone, we process the information you provide solely to handle your request. Emails to us are processed on our behalf by our email provider on servers in the USA. We do not use a contact form with its own data submission on this website. The section on ZaWin above applies to online appointment booking.

Social Media Profiles

We operate profiles on Facebook and Instagram (Meta Platforms Ireland Ltd., Ireland, and Meta Platforms Inc., USA). Our footer links to these profiles; a connection to Meta is established only when you follow one of these links or visit a profile. If you visit or interact with our profiles, Meta processes your data under its own responsibility and in accordance with its privacy policy; we have no influence over this processing. For the analysis of anonymous statistics about our pages, we and Meta may be joint controllers. The Meta privacy policy applies in addition.

Processing in the Practice

As part of dental treatment, we collect health, identification and billing data. This processing serves the performance of the treatment contract and is justified by an overriding interest pursuant to Art. 31 para. 2 lit. a revFADP. Health data constitutes sensitive personal data within the meaning of Art. 5 lit. c revFADP and is protected accordingly. We retain medical records for at least ten years after the last treatment, based on the cantonal health acts and the general statutory retention obligation.

Data is passed on to third parties only:

• to insurers, with your consent, for billing purposes;
• to co-treating specialists, with your consent;
• to authorities, where a statutory duty to disclose exists.

To support the diagnosis, we analyse X-ray images with AI software from Nostic Solutions AG, Kantonsstrasse 150, 8807 Freienbach, Switzerland (UID CHE-425.076.702). For this purpose the images are transmitted to Nostic Solutions AG and processed on our behalf in Switzerland and in the EU. We analyse 3D X-ray images (CBCT) with AI software from DGNCT LLC (Diagnocat), 333 Southeast 2nd Avenue, 20th Floor #563, Miami, FL 33131, USA. For this purpose the images are transmitted to DGNCT LLC and stored and processed on our behalf in data centres in the EU. The diagnosis is always made by the treating dentist.

Retention and Deletion

We retain personal data only for as long as necessary for the respective purpose or as required by law:

• Server log data: only for the period required to operate the website securely.
• Objection to measurement: up to 400 days, as long as you do not clear this browser's cookies.
• Session recordings: 30 days, after which they are deleted.
• Statistics and marketing data: in line with the retention periods of the respective providers (Google, PostHog, Meta, Microsoft).
• Medical records: at least ten years after the last treatment (see the «Processing in the Practice» section).

Once the respective period has expired, the data is deleted or anonymized, unless a statutory retention obligation applies.

Data Security

We take appropriate technical and organizational measures to protect your data against unauthorized access, loss or misuse. The website is transmitted exclusively in encrypted form via TLS/HTTPS. In addition, we use security measures such as HTTP Strict Transport Security (HSTS), a Content Security Policy and a restrictive Permissions Policy, and we limit access to personal data to authorized persons. However, absolute security of data transmission over the internet cannot be guaranteed.

No Automated Decision-Making

We do not use automated individual decision-making within the meaning of Article 21 revFADP, and we do not carry out profiling that produces legal effects concerning you or similarly significantly affects you.

Minors

We do not knowingly collect data from minors via this website without the consent of their parents or legal guardians. As part of the dental treatment of minors, we process the necessary data through their legal representatives.

Disclosure Abroad

As described above, data may be disclosed to service providers in the USA (our hosting provider, our email provider, Google, PostHog, Meta, Microsoft and DGNCT LLC). In these cases we ensure an adequate level of protection, in particular through the standard contractual clauses and, where the respective provider is certified, through the Swiss-U.S. Data Privacy Framework. The X-ray images for the AI-assisted analysis (section «Processing in the Practice») are stored and processed in Switzerland and in the EU.

Your Rights

Within the scope of the applicable data protection law, you are entitled at any time to:

• information about the data processed about you;
• correction of incorrect data;
• deletion of your data, unless a statutory retention obligation applies;
• release or transfer of your data in a common format;
• withdrawal of consent given, with effect for the future;
• objection to the processing of your data for analytics and advertising purposes;
• report the matter to the Federal Data Protection and Information Commissioner (FDPIC), who may open an investigation on that basis (Art. 49 revFADP).

Notice for Persons in the EU

If you visit our website from the European Union or reside there, the EU General Data Protection Regulation (GDPR) may additionally apply. The legal bases for processing are then, in particular, performance of a contract (Art. 6(1)(b) GDPR), your consent within the treatment relationship (Art. 6(1)(a) GDPR) and our legitimate interest in the secure operation of the website and in measuring its use (Art. 6(1)(f) GDPR). In this case you additionally have the right to lodge a complaint with the competent data protection authority of your country of residence.

Contact for Privacy Inquiries

info@resi-dent.ch