1. General
The protection of your personal data is important to us. This privacy policy explains which personal data we collect when you use this website and in the course of our dermatological and aesthetic services, how we process it, and what rights you have as a data subject.
This privacy policy is designed to meet the requirements of the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable in individual cases, the EU General Data Protection Regulation (GDPR). Swiss data protection law is primarily authoritative, as our practice is based in Switzerland. Whether and to what extent the GDPR also applies depends on the individual case.
We offer our services primarily within Switzerland and to people resident in Switzerland.
2. Controller
Depending on the area of service, the following are responsible for data processing in connection with this website and the services provided:
Dermatologie Aslanel (Firat Aslanel)
Dufourstrasse 47, 8008 Zurich
Cutivion AG
Dufourstrasse 47, 8008 Zurich
Contact for data protection matters for both: Firat Aslanel, aslanel@hin.ch, +41 77 804 25 31
3. Special categories of personal data (health data)
In the course of consultations, examinations and treatments, we process sensitive personal data within the meaning of Art. 5 lit. c FADP, in particular information about your health, diagnoses, treatment histories and, where applicable, before-and-after photographs. This data is additionally subject to medical professional secrecy (Art. 321 Swiss Criminal Code) and the provisions of cantonal health legislation. We process this data exclusively for the purposes of medical advice, diagnosis, treatment and documentation, and to comply with statutory retention obligations. It is only passed on to third parties with your express consent, for billing with your health insurer, or where we are legally obliged to do so.
4. Hosting
This website is hosted by:
Infomaniak Network SA
Rue Eugène-Marziano 25
1227 Les Acacias, Geneva
Switzerland
The data is stored and processed on servers in Switzerland. A data processing agreement with Infomaniak ensures that your personal data is processed only on our instructions and in compliance with Swiss data protection law.
5. Server log files
When you visit our website, the hosting provider automatically records technical data transmitted by your browser, in particular IP address, browser type and version, operating system, referrer URL, and the date and time of access. This data is used to provide the website without technical errors and to keep it secure, and is not combined with other data sources.
6. Contact form and CV request
If you contact us via a contact form or request the CV via the form, we process the data you provide (e.g. name, email address) solely to handle your enquiry or to send you the requested document. If you have agreed to receive occasional news about treatments and the practice, we also use your email address for this purpose until you unsubscribe.
We use the Mailchimp service for processing and sending. The provider is The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. Your email address and, where applicable, your name are stored and processed on Mailchimp’s servers. Mailchimp may also use this data for its own purposes, e.g. to optimise the service technically. According to Mailchimp, the data is not combined with other data. Data transfer to the USA is based on the standard contractual clauses of the European Commission; further information can be found in Mailchimp’s privacy policy at https://mailchimp.com/legal/privacy/. You can object to the use of your data by Mailchimp at any time by unsubscribing via the link in every email or by contacting us directly.
7. Online appointment booking
For online appointment booking we use the Arzt-Direkt platform. If you book an appointment through it, the data you enter (e.g. name, contact details, preferred appointment) is transmitted to and processed by the operator of this platform:
zollsoft GmbH
Ernst-Haeckel-Platz 5/6
07745 Jena
Germany
Email: arzt-direkt@zollsoft.org
Phone (enquiries): +49 3641 / 269 4162
Phone (technical support for medical practices): +49 3641 / 268 4151
Fax: +49 3641 / 268 7183
As zollsoft GmbH is based in Germany and therefore in the EU, this data transfer is considered under Swiss data protection law to be a transfer to a country with an adequate level of data protection.
8. Cookies and analytics tools
Our website uses technically necessary cookies that are required for the operation and security of the website. We do not currently use any additional cookies or third-party tracking tools (e.g. Google Analytics, Meta Pixel). Should we use such tools in future, we will inform you in advance via a cookie banner and obtain your consent where required by law; this privacy policy will then be updated accordingly.
To evaluate the use of our website statistically, we use the open-source software Umami. It sets no cookies and does not store IP addresses. It records the pages viewed, the referring source, device type, browser, operating system and approximate location (country or region). The evaluation is not intended to identify individual visitors. We also record interactions such as clicks on appointment booking, phone or links, as well as scroll depth, and we record sessions under a pseudonym (mouse movements, clicks and scrolling) to produce session replays and heatmaps. Forms and anything typed into them are not recorded; recordings are deleted after 30 days. Umami runs on a server of DigitalOcean LLC in Frankfurt (Germany), operated by our web service provider.
On the contact page we embed a map from Google Maps (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). It only loads when you scroll to it; your IP address and browser data are then transmitted to Google. More information: policies.google.com/privacy.
We protect the CV request form from automated requests (spam) with Google reCAPTCHA v3 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). reCAPTCHA only loads once you start filling in the form; your IP address and information about your browser and usage are then transmitted to Google, including to the USA. The legal basis is our legitimate interest in protecting the website from abuse. More information: policies.google.com/privacy.
9. Social media
On this website we link to our profiles on Instagram and LinkedIn. These are simple links; no data is transmitted to these networks when you visit our website itself. Only when you actively click on such a link and visit the respective platform do its own privacy policies apply.
10. Data security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse, in particular access restrictions, encryption of data transmission (SSL/TLS) and compliance with medical confidentiality by us and our practice team.
11. Retention period
We keep website-related data (e.g. contact enquiries) for as long as necessary to handle your request. We keep patient records and medical documents in accordance with professional regulations (FMH Code of Professional Conduct) and cantonal health law; considerably longer statutory retention periods generally apply to these. Once the respective period has expired, the data is deleted or anonymised, unless a further statutory retention obligation applies.
12. Rights of the data subject
Within the scope of applicable data protection law, you have the right to:
- information about the data processed about you
- correction of inaccurate data
- deletion or restriction of processing, unless a statutory retention obligation prevents this
- object to processing where it is based on a legitimate interest
- receive your data in a common format (data portability), where technically possible
To exercise these rights, you can contact us at any time using the contact details given in section 2. Exercising them generally requires that you identify yourself clearly. You also have the right to lodge a complaint with the competent supervisory authority; in Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).
13. Data processing abroad
This website is hosted in Switzerland; as a rule, your data is not transferred abroad. The services described in section 8 are an exception. If we use services from providers based abroad in future (e.g. for appointment booking or sending newsletters), we will inform you of this at the appropriate place in this privacy policy and, where required by law, ensure an adequate level of protection.
14. Changes to this privacy policy
We may amend this privacy policy at any time. The current version published on this website applies.
15. Contact
If you have any questions about data protection, please contact:
Firat Aslanel
Dufourstrasse 47, 8008 Zurich
aslanel@hin.ch
+41 77 804 25 31