Privacy Notice

Contents

1. What is this Privacy Notice about?
2. Who is the controller for data processing?
3. How do we process personal data in connection with your dental care?
4. How do we process data in connection with advertising?
5. How do we disclose personal data?
6. How do we work together in the group?
7. Can we disclose data abroad?
8. How do we use artificial intelligence?
9. How do we process data in relation to our website?
10. How do we process data via social media?
11. Are there other processing purposes?
12. How do we protect your data?
13. How long do we process personal data?
14. Additional information where the GDPR applies
15. What are your rights?

1. What is this Privacy Notice about?

This Privacy Notice explains how the companies of Groupe Clinique d’Hygiène Dentaire listed in Section 2 below (“CHD Group”) process personal data in connection with dental hygiene, preventive dental care and other dental treatments. It also covers the use of our website, appointment booking, enquiries, and other interactions with us. The company responsible for a particular processing activity is identified in Section 2. If you have any questions, please contact us using the details provided there.

2. Who is the controller for data processing?

The controller is the company responsible for deciding why and how your personal data is processed. For personal data processed in connection with your dental care, the controller is typically the company which provides services to you, and which is identified on contracts and invoices:

• CHD Clinique d’Hygiène Dentaire Sàrl, rue de Lausanne 65, 1202 Genève
• CHD Eaux-Vives SA, Rue François-Versonnex 7, 1207 Genève
• CHD Meyrin SA, Chemin de Riantbosson 19, 1217 Meyrin
• Ô Labo SA, Chemin de Riantbosson 19, 1217 Meyrin
• HD Clinics SA, Route de Berne 1, 1010 Lausanne, including its subsidiaries HD Clinics SA, succursale de Lausanne (Rue Saint-Martin 9, 1003 Lausanne) and HD Clinics SA, succursale d’Yverdon (Avenue Haldimand 105, 1400 Yverdon-les-Bains)

For the operation of this website, the controller is generally CHD Clinique d’Hygiène Dentaire Sàrl, rue de Lausanne 65, 1202 Genève.

For questions about data protection or to exercise your rights, please contact:
contact@cliniquehygienedentaire.ch

If you provide personal data about another person, for example when arranging an appointment for your child or another family member, please ensure that you are authorised to do so and that the information is accurate. Where appropriate, please also make this Privacy Notice available to that person or their legal representative.

3. How do we process personal data in connection with your dental care?

We process personal data to arrange and provide dental hygiene, preventive care and other dental treatments, and to manage the associated administrative processes. Depending on your treatment and how you interact with us, this may include:

• Appointments and patient registration: your name, contact details, date of birth, appointment details and, where relevant, information about your legal representative.
• Assessment, prevention and treatment: information about your medical and dental history, relevant conditions and medication, examination findings, diagnoses, dental images, treatment plans and treatments provided. We use this information to assess your needs, advise you on oral hygiene and prevention, and plan, provide and document your care.
• Follow-up care: information needed to monitor treatment outcomes, arrange follow-up appointments and send reminders for agreed check-ups or dental hygiene appointments.
• Administration and billing: information about treatment costs, estimates, invoices, payments and, where relevant, insurance or other arrangements for covering treatment costs.
• Patient enquiries and concerns: correspondence, feedback, complaints and information needed to resolve disputes or handle legal claims.

We also use anonymised information to evaluate the use of our services, improve preventive care and treatment processes, and plan staffing and clinic capacity. Information about marketing is provided separately in Section 4.

If you act on behalf of a supplier or another business partner, we usually process your professional contact details, role and correspondence to manage that business relationship.

4. How do we process data in connection with advertising?

We also process personal data in order to advertise our services:

• We may send you information about dental hygiene, prevention and our services. Where required by applicable law, we obtain your consent before sending electronic marketing. You can unsubscribe at any time using the link in the message or by contacting us. Please note that appointment confirmations and communications needed for your treatment are separate from marketing communications.
• Online advertising: where applicable, information on personalized presentation of own website and personalized display of advertising on third-party sites and platforms.

5. How do we disclose personal data?

Depending on the purpose, we may disclose personal data to the following categories of recipients, where permitted by applicable law and professional confidentiality requirements:

• Healthcare professionals and dental laboratories involved in your care, for example for referrals, specialist treatment or the preparation of dental restorations.
• Your legal representative or a person authorised to act on your behalf. We disclose information to relatives only where they are entitled to receive it or you have authorised the disclosure.
• Insurers and other parties responsible for treatment costs, where relevant to billing or reimbursement.
• Service providers supporting our operations, such as laboratories (including the CHD Group company Ô Labo, see section 2 above), providers of practice management software, appointment booking systems, IT hosting and support, payment processing, accounting and professional advice.
• CHD Group companies, as described in Section 6.
• Authorities, courts and other recipients where disclosure is legally required or permitted, including in connection with legal proceedings.
• Disclosures in connection with business transactions are described in Section 11.
• Website-related service providers are addressed in Section 9.

6. How do we work together in the group?

The companies covered by this Privacy Notice (see Section 2 above) are part of the CHD Group, but generally operate independently. However, the following companies work together in patient administration, and may share personal data to the extent necessary and subject to applicable data protection and professional confidentiality requirements: CHD Clinique d’Hygiène Dentaire Sàrl, CHD Eaux-Vives SA, and CHD Meyrin SA (see Section 2 above).

7. Can we disclose data abroad?

Not all data recipients are located in Switzerland. This includes in particular service providers which may be based in the EU or EEA (e.g., Align Technology GmbH in Germany), but also in other countries worldwide (e.g., IT service providers and potential subcontractors). We may also share data with foreign authorities if legally required or in connection with asset sales or legal proceedings (see Section 11). Not all these countries offer adequate data protection. To address this, we implement appropriate safeguards, particularly the EU standard contractual clauses, available here. In some cases, data may be shared abroad without such safeguards as allowed by applicable law, for instance, with your consent or if necessary to perform a contract, assert or defend legal claims, or serve overriding public interests.

8. How do we use artificial intelligence?

New technologies like artificial intelligence (AI) and machine learning offer significant potential but also present challenges. We ensure these technologies are used in alignment with our values and carefully weigh opportunities and risks in each case. We take responsibility for any content generated or decisions made by AI on our behalf. For decisions with significant impact on individuals, we ensure they can be reviewed by a human. If an AI we use interacts directly with you, we will inform you.

We may use AI to improve our dental care and related services, increase the efficiency of internal processes, enhance security, prevent misuse, or for any other purpose outlined above. AI applications may process personal data, but this is not always the case. Possible uses of AI include:

• Creating and simplifying access to information about our dental care and related services;
• Assisting in the creation of stock images, product texts, and similar non-personalized content;
• Processing customer requests and analyzing customer feedback automatically to address needs more effectively;
• Improving customer experience when using our dental care and related services through targeted advice and tailored information;
• Processing data in connection with video cameras and sensor technologies, such as automated analysis and evaluation of recorded footage;
• Assisting in the creation of programming code.

9. How do we process data in relation to our website?

When you book an appointment or submit an enquiry through our website, we process the information you provide to arrange your visit and respond to your request. This may include your preferred clinic, appointment details and information about the reason for your visit. Further information about the processing of patient data is provided in Section 3.

In addition, for technical reasons, each time you use our website, certain data is temporarily stored in log files, including your device’s IP address, information about your internet service provider, operating system, browser, referring URL, date and time of access, and content accessed. We use this data to operate the website, ensure security and stability, optimize the site, and for statistical purposes.

Our website uses cookies, which are small files stored by your browser on your device. These allow us to distinguish individual visitors, usually without identifying them. Cookies may contain information about accessed content and visit duration. Some cookies (“session cookies”) are deleted when you close your browser, while others (“persistent cookies”) remain for a set period to recognize returning visitors. We also use other technologies, such as pixels and browser fingerprints. Pixels are invisible images loaded from a server, transmitting information via a coded link. Fingerprints use your device’s configuration to make it distinguishable from others.

You can adjust your browser settings to block certain cookies or delete cookies and other stored data. For more information, refer to your browser’s help pages (usually under “privacy”).

Third parties providing services to us may also use cookies and other technologies. These third parties may be located outside Switzerland and the EEA (see Section 7 for details). For example, we use analytics services to optimize and personalize our website.

Cookies and similar technologies from third-party providers may also enable them to target you with personalized advertising on our websites, other websites, or social networks working with these providers, and to measure ad effectiveness (e.g., tracking whether you arrived at our website via an ad and your subsequent actions).

These providers may record website usage and combine it with data from other websites. They may track user behavior across multiple websites and devices to provide us with statistical insights. Providers may also use this data for their purposes, such as personalized advertising on their platforms or other websites. If a user is registered with the provider, the provider can link the usage data to that individual.

Cookies and other technologies may also be used by third parties that provide services to us. These may be located outside of Switzerland and the EEA (for more information, see Section 7). For example, we use analytics services so that we can optimize and personalize our website. Cookies and similar technologies from third-party providers also enable them to target you with individualized advertising on our websites or on other websites as well as on social networks that also work with this third party and to measure how effective advertisements are (e.g., whether you arrived at our website via an advertisement and what actions you then take on our website). The relevant third-party vendors may record website usage for this purpose and combine their records with other information from other websites. They can record user behavior across multiple websites and devices to provide us with statistical data. The providers may also use this information for their own purposes, e.g. for personalized advertising on their own website or other websites. If a user is registered with the provider, the provider can assign the usage data to the relevant person.

Two of the most important third-party providers are Google and Facebook. You can find more information about them below. Other third parties generally process personal and other data in a similar way.

• We use Google Analytics on our website, an analysis service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, USA) and Google Ireland Ltd (Google Building Gordon House, Barrow St, Dublin 4, Ireland). Google collects certain information about the behavior of users on the website and about the terminal device used. The IP addresses of visitors are shortened in Europe before being forwarded to the USA. Google provides us with evaluations based on the recorded data, but also processes certain data for its own purposes. Information on the data protection of Google Analytics can be found here, and if you have a Google account yourself, you can find further details here.
• We may provide Facebook with user information, such as email addresses, for the purpose of advertising on Facebook. Facebook matches these with corresponding details of its members in order to be able to play advertising specifically to our users (“Custom Audiences”). You can object to this matching at any time (see Section 15). Our websites may further use the “Facebook Pixel” and similar technologies of Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). We use these technologies to display the Facebook ads placed by us only to users on Facebook and on partners cooperating with Facebook who have shown an interest in us. We can further use these technologies to track the effectiveness of the Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called “conversion measurement”). Further details can be found here. We share responsibility (but not further processing) with Facebook for displaying advertising information that matches users’ interests, improving ad delivery, and personalizing features and content. We have therefore concluded a corresponding supplementary agreement with Facebook. Users can therefore address requests for information and other data subject requests in connection with shared responsibility directly to Facebook.

10. How do we process data via social media?

We maintain presences on social networks and platforms (e.g., Facebook, YouTube, Instagram, TikTok). If you communicate with us, comment on, or share content there, we collect information for communication, marketing, and statistical purposes (see Sections 4 and 10). Please note that platform providers also collect and use data (e.g., user behavior) independently, potentially combining it with other data they hold (e.g., for marketing or content personalization). Where joint responsibility with the provider applies, we enter into an agreement, details of which can be obtained from the provider.

11. Are there other processing purposes?

Yes. Typical (though not necessarily frequent) cases are as follows:

• Communication: When we are in contact with you (e.g. when you call us or when you communicate with us on social media), we may process the content as well as information about nature, time, and location of communication. For your identification, we may also process information about proof of identity. If you contact us through a messaging service such as WhatsApp, we process your contact details and messages to handle your enquiry. The service provider also processes data under its own privacy terms. For confidential treatment-related information, please use the phone.
• Job applications: We process personal data provided by applicants during the application process, including contact details, CVs, references, and other supporting documents. This data is used to assess suitability for the position, communicate with applicants, and manage the recruitment process. If necessary, data may be shared with third parties, such as background check providers, in accordance with applicable law. Applicant data is stored securely and retained only as long as necessary for the recruitment process or as required by law. Unsuccessful applications are deleted after an appropriate retention period unless consent is given for longer storage.
• Compliance with legal requirements: We may disclose data to authorities as required by law or to meet internal regulations.
• Prevention of fraud and misuse: Data may be processed to prevent crime or misuse, such as fraud prevention or internal investigations.
• Legal proceedings: If involved in legal proceedings (e.g., court or administrative), we may process and disclose data about parties, witnesses, and others involved to courts, authorities, or other relevant entities, including abroad.
• IT security: We may process data to monitor, control, analyze, secure, and assess IT infrastructure and manage backups and archives.
• Competition: We may process data on competitors and the market (e.g., political environment, associations) and key individuals, including names, contact details, roles, and public statements.
• Transactions: In asset, business unit, or company sales or acquisitions, we may process data to prepare and execute transactions, including disclosing customer or employee data to potential buyers or sellers.
• Other purposes: Data may be processed for training, administration (e.g., contract management, accounting, claims management, process improvement), anonymous statistics, or securing other legitimate interests.

12. How do we protect your data?

We implement appropriate technical and organizational measures to ensure the security of your personal data is commensurate with the respective risk. However, absolute data security cannot be guaranteed, and some residual risks may remain.

13. How long do we process personal data?

We retain personal data for as long as necessary for the purposes described in this Privacy Notice and to meet applicable legal requirements.

For patient records, we take account of the documentation and retention requirements applicable to the clinic concerned, the needs of ongoing care and any justified need to establish, exercise or defend legal claims.

Different retention periods apply to other data, such as appointment enquiries, billing records, job applications and website logs. Once personal data is no longer required and there is no obligation or other justification to retain it, we delete or anonymise it.

14. Additional information where the GDPR applies

Depending on the applicable law, data processing is permitted only if explicitly authorised. This restriction does not apply under the Swiss Data Protection Act but does apply under the European General Data Protection Regulation (GDPR), if applicable. In such cases, we rely on the following legal bases for processing your personal data:

• Art. 6 para. 1 lit. b GDPR for processing necessary to perform a contract with the data subject or to take pre-contractual measures (see para. 3).
• Art. 6 para. 1 lit. f GDPR (and Art. 9 para. 2 lit. f GDPR for special-category data, if applicable) for processing necessary to protect our or third parties’ legitimate interests, unless overridden by the data subject’s fundamental rights and freedoms. This includes compliance with Swiss law, ensuring sustainable, user-friendly, secure, and reliable operations, and the purposes outlined in Section 7.
• Art. 6 para. 1 lit. c GDPR for processing necessary to comply with a legal obligation under the laws of an EEA Member State. The EEA includes EU member states, Iceland, Norway, and Liechtenstein.
• Art. 6 para. 1 lit. a GDPR (and Art. 9 para. 2 lit. a GDPR for special-category data, if applicable) for processing based on your separate consent.

In general, you are not required to disclose data to us, except in specific cases (e.g., fulfilling contractual obligations that necessitate data disclosure). However, we may need to process data for legal or contractual purposes. The use of our website would also not be possible without some data processing (see Section 9).

15. What are your rights?

You have certain rights, subject to conditions and restrictions under applicable law:

• You can request a copy of your personal data and further information about our data processing.
• You can object to our data processing, especially in connection with direct marketing.
• You can have incorrect or incomplete personal data corrected or completed or supplemented by a note of dispute.
• You also have the right to receive the personal data that you have provided to us in a structured, common, and machine-readable format, insofar as the corresponding data processing is based on your consent or is necessary for the performance of the contract.
• To the extent that we process data based on your consent, you can withdraw your consent at any time. The withdrawal is only valid for the future, and we reserve the right to continue to process data based on another basis in the event of a withdrawal.
• You may request the deletion of your personal data, subject to applicable conditions and exceptions. In particular, we may need to retain patient records to comply with legal retention obligations or to establish, exercise or defend legal claims.

If you wish to exercise such a right, please feel free to contact us (Section 2). We will usually have to verify your identity (e.g. by means of a copy of your ID card). You are also free to file a complaint against our processing of your data with the competent supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).