Our Commitment

for the protection of your data

This document aims to clarify our commitment and responsibility in the area of data protection.

Values and Ethics

At agenda.ch, respecting our values is one of our reasons for being and we are proud of it. Our values also include integrity and honesty.

Data Ownership and Processing Responsibility

The data on agenda.ch as well as the final responsibility for processing belongs to our clients who use our software.

Agenda.ch will therefore never use this data for its own account.

Booking an appointment on agenda.ch does not require a patient to open an account.

Regarding data, each client account's data is separated from other client accounts. No data is shared between two client accounts.

Agenda.ch's Responsibility

Agenda.ch's responsibility is to provide the best possible service to its clients.

We are fully aware that our clients sometimes process sensitive and confidential information on our platform. We therefore understand the purpose of data protection laws, as their main objective is to prevent harm and damage to individuals through improper data processing or negligence.

We take medical confidentiality very seriously as it aims to protect the medical and private data of patients (results, medical records, diagnoses, imaging data, documents, etc., data on the private sphere, etc.)

Physical Location of Data

All data on agenda.ch is hosted on servers in Switzerland in robust and secure data centers.

Traceability

All actions on the data, the name of the action and the name of the user are logged.

Team

Agenda.ch employees have been hired based on criteria of their competence, integrity, sense of responsibility and rigor. They share our values and are employed in Geneva. We do not use "outsourcing" employees external to Switzerland.

All our employees are contractually required to maintain professional confidentiality, which means they cannot disclose any information to third parties, whether regarding agenda.ch's clients or client account data.

Agenda.ch's offices are not shared with other companies.

At the request of our clients, our employees can access their account to assist them in using the platform. All actions by agenda.ch employees are also logged.

Data Processing at Client Request

Agenda.ch only processes personal data within the agreed framework and according to the client's instructions. The only situation that could require agenda.ch to process information or data would be one arising in a strictly legal context (this has never happened in 12 years of existence). If applicable, agenda.ch will inform the client, to the extent permitted, of the corresponding legal requirements before the start of processing.

If the client explicitly requests it, agenda.ch can delete specific data from an account or merge data from two accounts.

Specific Technical Measures

To ensure confidentiality:

1. Authorized employees only have access to the personal data they need to perform their tasks. Access is made using an individual password. Each employee access is logged.
2. Only employees and authorized persons have access to agenda.ch's premises. No employee has physical access to the servers which are hosted in a Swiss data center.
3. Unauthorized persons cannot use automated data processing systems through data transmission facilities.

To ensure availability and integrity:

1. Encrypted backups are performed every hour on external secure servers.
2. Unauthorized persons cannot read, copy, modify, move, delete or destroy backups (data media control).
3. The availability of personal data and access to it can be quickly restored in the event of a physical or technical incident.
4. We ensure that all functions of the automated data processing system are available (availability), that malfunctions are reported (reliability) and that stored personal data is not, a priori, damaged by system malfunctions (data integrity);
5. As far as possible, we ensure that operating systems and application software are always maintained at the most recent security level and that known critical gaps are addressed (system security).

To ensure traceability:

1. Each action is logged: personal data entered or modified in the automated data processing system, the time of these actions and their author (input control).
2. We can trace personal data and thus find out to whom it is communicated using data transmission facilities (communication control);
3. We can quickly detect data security breaches (detection) and therefore be reactive in taking measures to reduce or eliminate the consequences (elimination).

We are committed to doing our utmost to respect the confidentiality of our clients' data.

Done in Geneva, on October 18, 2023,