Privacy Policy
This policy describes how Vitalink HealthData processes personal data in the context of its website and API services. It is intended for visitors, prospects, and clients. The site operator is Vitalink HealthData AG, Seefeldstrasse 45, 8008 Zürich.
It is written for technical managers, clinical management, and legal departments. Each chapter indicates what is processed, why, for how long, and on what legal basis. Encryption and access control measures are detailed on the Security and encryption page.
Scope
This policy covers the Vitalink HealthData showcase website and API services. It applies to data collected via contact forms and data processed as part of integrations. It does not cover processing performed by our clients in their own systems.
- Your interactions with us via the site are subject to this policy.
- Patient data integrated into an electronic health record is the responsibility of the hospital client, who acts as the data controller.
- Vitalink then acts as a data processor, based on documented instructions from the institution.
Collected data
We collect data that you provide via our forms, as well as technical navigation data necessary for the operation and security of the site. Actual health data must not be transmitted via the site's forms.
If you need to send us a test dataset, do not do so via the form: ask us first for a test environment and an appropriate exchange procedure.
Legal basis and compliance
Processing is carried out within the framework of the Swiss Federal Act on Data Protection (FADP) and, where applicable, the European General Data Protection Regulation (GDPR). We apply principles of minimization, purpose limitation, and proportionality: each category of data corresponds to an identified need, and nothing is kept without an operational or legal reason.
When the GDPR applies to a client established in the European Union, the same technical guarantees are provided. The corresponding measures are described in detail on the Security and encryption page.
Compliance with the FADP and GDPR relates to the processing that Vitalink HealthData performs on its own behalf: site, prospecting, support, security. It does not replace the obligations of the hospital institution that integrates patient data into its electronic health record.
No certification is claimed here beyond what is described on this page and in the contractual documents provided to clients.
Purposes of processing
Contact data is used to respond to your request, prepare a quote, or organize a technical demo. Technical data is used for the operation and security of the site. We do not process this data for purposes unrelated to these objectives.
Data retention
Contact data is kept for the time necessary to process your request and follow up on the commercial relationship. Technical logs are kept for a duration defined for security and auditing purposes. Beyond that, the data is deleted or anonymized.
Your contact details remain saved for the duration of the commercial relationship, including after a negative response, in order to keep a history of exchanges. You can request deletion at any time.
Access logs are kept for security, abuse detection, and auditing. They are subsequently deleted or aggregated in anonymous form for service availability monitoring.
Data recipients
Data may be processed by our technical service providers as part of the operation of the site and services. They act on our instructions and in accordance with contractual confidentiality and security commitments. We do not sell your data.
- Vitalink teams Named access limited to role: support, engineering, administration. Each access is logged.
- Hosting providers Server operation and backups, based on documented instructions, without proprietary use of the data.
- Authorities Communication only in the event of a legal obligation or formal request from a competent authority.
Security
We implement technical and organizational measures to protect data: encryption in transit and at rest, named access control, logging of sensitive operations, and separation of test and production environments. However, no measure can be considered an absolute guarantee: security remains a continuous effort, reviewed as threats evolve.
To exercise your rights or ask a question about this policy, write to us. We respond during business hours.
- [email protected]
- Phone
- +41 21 581 78 71
- Address
- Vitalink HealthData AG, Seefeldstrasse 45, 8008 Zürich, Schweiz
- Hours
- Monday – Friday: 09:00 – 18:00 (CET)
Data subject rights
You have the right to access, rectify, and delete data concerning you. You may also object to certain processing and request the limitation of its use. To exercise these rights, contact us via the contact details provided above, specifying the request and the context in which your data was transmitted.
How do I request access to my data?
Write to the contact address indicating your name, the organization concerned, and the channel used to reach us. We verify your identity before transmitting anything, then we respond with the retrieved data or, if we no longer hold any, with a clear explanation.
Can I request the deletion of my contact details?
Yes. We delete contact details linked to a commercial request upon simple request. Some technical traces may remain for the duration of the retention period provided for security, then they are deleted or anonymized.
Does my health data pass through this site?
No. The site is used for commercial and technical exchanges. Blood glucose measurements and smartwatch data circulate in the integration flows defined contractually with the institution, not via the site's forms.
Who should I address a complaint to?
Send your request to us first: most situations are resolved directly. If the response does not satisfy you, you can refer the matter to the competent supervisory authority in your country of residence or work.
Changes
This policy may be updated to reflect legal or technical developments. The version in force is the one published on this site, dated at the top of the page. We invite you to consult it regularly, especially before signing an integration contract or transmitting information about your project.
If a change alters how your contact data is used, we will clearly indicate it in the published version rather than letting it go unnoticed in the text.
Related documents and contact
This policy is accompanied by other documents that describe the same commitments from a different angle: details of protection mechanisms, site usage rules, and tracker processing. A question about a specific case remains the fastest way.