Privacy policy

Privacy Policy
Dr Verena Immer –
Männedorf Medical Centre Date: 2026 | Legal basis: revDSG (Switzerland) and GDPR (EU) where applicable

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website or contact our practice. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to this privacy policy.

Applicable law

This website is operated by a doctor based in Switzerland. The applicable data protection law is the Swiss Federal Act on Data Protection (FADP) in its revised version (revFADP, SR 235.1) and the associated Data Protection Ordinance (DPO). Where personal data of individuals residing in the European Union is processed, the EU General Data Protection Regulation (GDPR, (EU) 2016/679) must also be observed.

Data collection on this website

Who is responsible for data processing on this website? Data processing on this website is carried out by the data controller. Their contact details can be found in the section ‘Details of the data controller’ in this privacy policy.

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us (e.g. via a contact form). Other data is collected automatically by our IT systems when you visit the website. This consists primarily of technical data (e.g. internet browser, operating system or time of page view).

What do we use your data for?

Some of the data is collected to ensure the website functions correctly. Other data may be used for statistical analysis of user behaviour.

What rights do you have regarding your data?

Under the revDSG, you have the right at any time to access your personal data stored by us (Art. 25 revDSG). You may also request the rectification of inaccurate data (Art. 32 revDSG) and – provided the conditions are met – the erasure of your data. Furthermore, you have the right to object (Art. 30 revDSG) and the right to data portability (Art. 28 revDSG). Where the GDPR applies, you are also entitled to the rights set out in Articles 15–22 of the GDPR. To exercise your rights, please contact: info@individualmedizin-immer.ch

2. Hosting

External hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host’s servers. This may include, amongst other things, IP addresses, contact enquiries, meta and communication data, as well as other data generated via a website.

The use of the host is in the interest of ensuring the secure, fast and efficient provision of our online services by a professional provider. The legal basis is the overriding legitimate interest of the controller (Art. 31(1) revDSG; Art. 6(1)(f) GDPR where applicable).

The hosting provider is located in Germany (EU). The transfer of personal data to the EU is permitted in accordance with Art. 16(1) revDSG in conjunction with the FDPIC’s list of countries with adequate data protection.

We use the following hosting provider:

Alfahosting Ankerstrasse 3b, 06108 Halle (Saale), Germany Tel. +49 (345) 279 58 0 | info@alfahosting.de

Data Processing Agreement

We have concluded a data processing agreement with the aforementioned provider. This ensures that the hosting provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the applicable data protection regulations.

3. General information and mandatory notices

Data protection

The operator of this website takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the revDSG and this privacy policy.

We would like to point out that data transmission over the internet may be subject to security vulnerabilities. It is not possible to provide complete protection of data against access by third parties.

Details of the data controller

The data controller for data processing on this website is:

Dr Verena Immer
staff doctor
Männedorf Medical Centre
Schwerzistrasse 30,
8708 Männedorf

Telephone: +41 44 921 78 00
Email: info@individualmedizin-immer.ch

Sensitive personal data (health data)

As a medical practice, we process health data and other sensitive personal data within the meaning of Art. 5(c) revDSG. The processing of this data takes place exclusively:

  • within the context of the treatment relationship and on the basis of your express consent (Art. 6(6)(a) revDSG);
  • insofar as the processing is necessary to fulfil legal obligations (e.g. reporting obligations, Health Insurance Act KVG);
  • insofar as the processing is necessary to safeguard the vital interests of the data subject.
  • The data is subject to medical confidentiality (Art. 321 StGB) and the Health Act of the Canton of Zurich (GesG, LS 810.1).

Retention period

Unless a more specific retention period is stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies.

For treatment data (medical history, patient records), the statutory retention periods apply: at least 10 years after the end of treatment; for patients under the age of 18, until they reach the age of 28 (Art. 46 KVG; § 46 GesG ZH). Once these periods have expired, the data will be securely destroyed.

Legal basis for data processing

We process personal data on the following legal bases:

  • Consent of the data subject (Art. 6(6)(a) revDSG; Art. 6(1)(a) GDPR)
  • Performance of a contract or pre-contractual measures (Art. 31(2)(a) revDSG; Art. 6(1)(b) GDPR)
  • Fulfilment of a legal obligation (Art. 31(2)(c) revDSG; Art. 6(1)(c) GDPR)
  • Overriding legitimate interests of the controller or third parties (Art. 31(1) revDSG; Art. 6(1)(f) GDPR)
  • Transfer of personal data abroad

We transfer personal data to the following countries:

  • Germany (hosting provider Alfahosting: EU Member State with an adequate level of data protection according to the FDPIC list. The transfer is permitted under Art. 16(1) revDSG.
  • Estonia (Veronalabs, WP Statistics): EU Member State, adequate level of data protection.
  • USA (Google Ireland Limited for Google Maps, YouTube, Google Ads): The USA does not offer a level of data protection comparable to that of Switzerland or the EU. The transfer is based on appropriate safeguards (standard contractual clauses in accordance with Art. 16(2)(d) revDSG; Art. 46(2)(c) GDPR). Please refer to the privacy policies of the respective providers for details.

Please note that in countries without an adequate level of data protection – particularly in the USA – public authorities may, under certain circumstances, access your personal data without there being any effective legal protection. We have no influence over these processing activities.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw any consent you have already given at any time with effect for the future. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected.

Right to object (Art. 30 revDSG; Art. 21 GDPR)

You have the right to object to the processing of your personal data where the processing is based on overriding legitimate interests (Art. 30 revDSG). Where the GDPR applies, Art. 21 GDPR applies in addition. Following a substantiated objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the revDSG, you have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or to bring an action before the competent court (Art. 49 revDSG):

Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1, 3003 Bern www.edoeb.admin.ch

Where the GDPR applies, EU citizens may also lodge a complaint with the competent data protection supervisory authority in their Member State.

Right to data access and data portability

You have the right to request that personal data which you have provided to us and which we process automatically be provided to you in a commonly used electronic format (Art. 28 revDSG). Where technically feasible, you may request that we transfer this data directly to another data controller.

SSL or TLS encryption

For security reasons, this site uses SSL or TLS encryption for the transmission of confidential content. You can recognise an encrypted connection by the ‘https://’ in your browser’s address bar and the padlock symbol.

Access, rectification and erasure

You have the right at any time to obtain, free of charge, information about your stored personal data, its origin, the recipients and the purpose of the data processing (Art. 25 revDSG). You may also request the rectification of inaccurate data (Art. 32 revDSG) and, subject to the legal requirements, its erasure. Please contact us at any time in this regard.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data, in particular if:

  • you contest the accuracy of the data (for the duration of the verification);
  • the processing is unlawful and you request restriction instead of erasure;
  • we no longer require the data, but you need it to assert legal claims;
  • you have lodged an objection and it has not yet been determined whether our interests prevail.

If processing has been restricted, this data – apart from its storage – may only be processed with your consent or for the purpose of asserting, exercising or defending legal claims or for the protection of important public interests.

Objection to promotional emails

We hereby object to the use of contact details published in accordance with the legal notice requirement for the purpose of sending unsolicited advertising. We expressly reserve the right to take legal action in the event of unauthorised sending of promotional information, such as via spam emails.

4. Data collection on this website

Cookies

Our website uses cookies. Cookies are small text files that are stored on your device and do not cause any harm. Session cookies are automatically deleted after your visit; persistent cookies remain on your device until you delete them or your browser removes them automatically.

Necessary cookies are stored on the basis of the controller’s legitimate interest (Art. 31(1) revDSG), as they are required for the technically fault-free operation of the website.

Non-essential cookies (analytics, advertising) are only set with your explicit consent (Art. 6(6)(a) revDSG; Art. 6(1)(a) GDPR where applicable). You may withdraw your consent at any time with future effect.

You can configure your browser to be notified when cookies are set, to allow cookies only on a case-by-case basis or to reject them generally, and to enable the automatic deletion of cookies when you close your browser. If you disable cookies, the functionality of this website may be restricted.

Consent Management (Borlabs Cookie)

Our website uses the consent technology provided by Borlabs Cookie (Borlabs – Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg, Germany) to obtain your consent to the storage of certain cookies and to document this in accordance with data protection regulations. When you visit our website, a Borlabs cookie is stored which records the consents you have given or withdrawn. This data is not passed on to the provider and remains with us until you request its deletion. Legal basis: Fulfilment of a legal obligation (Art. 31(2)(c) revDSG; Art. 6(1)(c) GDPR).

Server log files

The website provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:

Browser type and browser version

  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of the server request
  • IP address

This data is not merged with other data sources. Legal basis: Legitimate interests of the controller (Art. 31(1) revDSG; Art. 6(1)(f) GDPR).

Enquiries by email or telephone

If you contact us by email or telephone, your enquiry, including any personal data contained therein, will be stored for the purpose of processing your request. We will not disclose this data without your consent. Legal basis: Fulfilment of the data processing contract (Art. 31(2)(a) revDSG; Art. 6(1)(b) GDPR) or legitimate interests (Art. 31(1) revDSG; Art. 6(1)(f) GDPR).

The data you provide will remain with us until you request its deletion, withdraw your consent or the purpose for data storage no longer applies. Statutory retention periods – in particular the 10-year retention obligation for treatment data – remain unaffected.

5. Analytics tools and advertising

WP Statistics

This website uses the WP Statistics analysis tool for the statistical evaluation of visitor traffic. The provider is Veronalabs, Tatari 64, 10134 Tallinn, Estonia (https://veronalabs.com). WP Statistics collects, among other things, anonymised log files (IP address, referrer, browser used, user origin) as well as the actions of website visitors. The data collected is stored exclusively on our own server and is not passed on to third parties.

Legal basis: Legitimate interests (Art. 31(1) revDSG; Art. 6(1)(f) GDPR). The IP address is anonymised prior to storage, so that direct association with the data subject is no longer possible.

Google Ads

The website operator uses Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Ads enables advertisements to be displayed in the Google search engine or on third-party websites. Personal data may be transferred to the USA in this context; the transfer is based on the EU Standard Contractual Clauses (Art. 16(2)(d) revDSG; Art. 46(2)(c) GDPR). Legal basis for use: Legitimate interests (Art. 31(1) revDSG; Art. 6(1)(f) GDPR). Details: https://policies.google.com/privacy/frameworks

6. Plugins and Tools

YouTube (enhanced privacy mode)

This website embeds videos from YouTube. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube in enhanced privacy mode. According to YouTube, this ensures that YouTube does not store any information about visitors to this website before they watch the video.

As soon as you start a YouTube video, a connection is established with YouTube’s servers. If you are logged into your YouTube account, you can prevent YouTube from associating your browsing behaviour with your personal profile by logging out of your account. Personal data may be transferred to the USA in the process; the transfer is based on standard contractual clauses (Art. 16(2)(d) revDSG; Art. 46(2)(c) GDPR). Legal basis: Legitimate interests (Art. 31(1) revDSG; Art. 6(1)(f) GDPR). Further information: https://policies.google.com/privacy?hl=de

Google Maps

This site uses the Google Maps mapping service (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). In order to use the functions of Google Maps, it is necessary to store your IP address. This is usually transferred to a Google server in the USA; the transfer is carried out on the basis of standard contractual clauses (Art. 16(2)(d) revDSG; Art. 46(2)(c) GDPR). Legal basis: Legitimate interests (Art. 31(1) revDSG; Art. 6(1)(f) GDPR). Details: https://privacy.google.com/businesses/gdprcontrollerterms/

Google Web Fonts (local hosting)

This site uses Google Web Fonts, which are installed locally, to ensure consistent font display. No connection is established with Google’s servers.

Font Awesome (local hosting)

This site uses Font Awesome, which is installed locally, to ensure consistent font display. No connection is established with the servers of Fonticons, Inc.

7. Our social media presence

Data processing by social networks

We maintain publicly accessible profiles on social networks. Social networks can comprehensively analyse user behaviour when you visit their websites or websites with integrated social media content. Visiting our social media pages triggers numerous data processing operations relevant to data protection.

If you are logged into your social media account and visit our page, the platform operator may associate this visit with your account. Your personal data may also be collected even if you are not logged in. We are jointly responsible with the respective platform operator for the data processing operations triggered by this visit. You may exercise your rights (right of access, rectification, erasure, restriction, data portability, objection and complaint) both against us and against the platform operator.

Please note that, despite our joint responsibility, we do not have full control over the data processing operations of the social media platforms.

Legal basis: Legitimate interests (Art. 31(1) revDSG; Art. 6(1)(f) GDPR). The analysis processes initiated by the social networks may be based on different legal grounds, which must be specified by the respective operators.

Facebook

We have a profile on Facebook. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Meta, the data collected is also transferred to the USA and other third countries. For details, please refer to Facebook’s privacy policy: https://www.facebook.com/about/privacy/

Instagram

We have a profile on Instagram. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. For details, please refer to Instagram’s privacy policy: https://help.instagram.com/519522125107875

8. Your rights – summary

As a data subject, you have the following rights under the revDSG:

  • Right of access (Art. 25 revDSG): You may request information about your personal data stored by us at any time and free of charge.
  • Right to rectification (Art. 32 revDSG): You may request the rectification of inaccurate data.
  • Right to erasure (Art. 32 revDSG): Under certain conditions, you may request the erasure of your data.
  • Right to restriction of processing: Under certain conditions, you may request the restriction of processing.
  • Right to data portability (Art. 28 revDSG): You may request your data in a commonly used electronic format.
  • Right to object (Art. 30 revDSG): You may object to data processing based on legitimate interests.
  • Right to lodge a complaint: You may lodge a complaint with the FDPIC (www.edoeb.admin.ch) or with the competent court (Art. 49 revDSG).

To assert your rights, please contact: info@individualmedizin-immer.ch

9. Changes to this privacy policy

To ensure that this privacy policy complies with legal requirements, we reserve the right to make changes at any time. This also applies if our services or the legal framework change. The current version is always available on this website. In the event of significant changes, we will inform you in an appropriate manner.

Date: 2026 Legal basis: Federal Act on Data Protection (revDSG, SR 235.1) and the GDPR (EU) 2016/679 where applicable.