Privacy policy of Zahnklinik Küsnacht for patients and website visitors

Who is responsible for your personal data

Zahnklinik Küsnacht AG, Goldbacherstrasse 3a, 8700 Küsnacht, Switzerland, is the controller of your personal data. That means we are responsible for how it is processed. You can reach us by phone on +41 44 915 17 77 and by email at klinik@zk-k.ch. You can also use this email address for any questions or requests about data protection.

What personal data we process

When we treat you, we process your personal details, such as your name and date of birth. We also process contact details, such as your address, phone number and email address. For billing, we also need details of your insurance. Where your treatment requires it, we process health data as well. Examples are your dental and medical history, X-rays or known allergies.

Under Swiss data protection law, health data is sensitive personal data. Stricter rules apply to it, especially when it is passed on.

We receive most of this information from you. If you are referred to us, we also receive information from the referring doctor. If someone else requests an appointment for you, for example a relative, we receive your details from that person. The sections further down explain what data is processed when you visit this website.

What we use your data for

We process your data to arrange appointments, to provide your dental treatment and to document it. We also use the data for billing, to answer your enquiries and to meet our legal obligations, such as keeping patient records. We use the data generated when you visit this website to deliver the pages to you and to protect them from misuse.

Professional secrecy and who receives your data

Everyone who treats patients or works at our clinic is bound by professional secrecy. This is set out in Article 321 of the Swiss Criminal Code and section 15 of the Health Act of the canton of Zurich. Professional secrecy also protects the fact that you are being treated by us. We therefore only pass on health data and other information covered by professional secrecy if you have consented or the law provides for it. It is also permitted if the cantonal Health Department has released us from professional secrecy at our request.

Within our clinic, the staff who are responsible for your treatment or for organising it may see your data. The Health Act of the canton of Zurich presumes your consent to this. Professional secrecy also applies towards relatives. If a child cannot yet understand what the treatment means, we inform the parents or the legal representative. Children and young people who do understand it decide for themselves who we give information to.

We only pass data on to the recipients listed below where your treatment, billing or the running of our clinic requires it. They only receive the information they need for their task. The rules of professional secrecy apply. In all other cases, your data stays with us.

• laboratories that work on your treatment
• referring doctors
• insurers, if they contribute to the cost of your treatment
• authorities, if the law requires us to disclose data
• service providers that process data on our behalf, for example to run this website, to send the appointment form and for our email inbox

How long we keep your data

We keep your patient records for at least ten years after your last treatment has ended. This includes your X-rays. Section 13 of the Health Act of the canton of Zurich sets this period. Under the Swiss Code of Obligations, we also keep business records and accounting vouchers, such as invoices, for ten years from the end of the financial year concerned.

We delete enquiries, emails and messages that do not lead to treatment as soon as we no longer need them. We only keep them for longer if the law requires it or if we need them as evidence in an individual case.

How we protect your data

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. The pages of this website and the details in the appointment form are transmitted in encrypted form (HTTPS) between your browser and Cloudflare. Your request then goes to our inbox by email (see “Appointment requests through the online form”).

This website and cookies

We have deliberately kept this website simple. We do not use analytics tools that analyse your behaviour on the site. We do not use advertising networks either. We do not load fonts from other providers. Cloudflare Pages delivers all files of this website, including the fonts, on our behalf (see below). A map from Google Maps only appears if you load it yourself (see “Map from Google Maps”).

The website itself does not set any cookies.

The only thing that works in a similar way to a cookie is a short note in your browser's storage. The first time you open the home page, we show a short introduction. So that it does not appear again every time you return to the home page, the page stores a note in your browser's session storage (sessionStorage). The note contains no information about you and is not sent to us. Your browser normally deletes it as soon as you close the tab or window. If your browser restores closed tabs, the note may be kept. If you do not want this, you can stop websites from storing data in your browser settings. The website still works, usually without the introduction.

This website is delivered through Cloudflare Pages, a service of Cloudflare, Inc., which is based in the USA. Each time a page is requested, Cloudflare processes technically necessary data. This includes your IP address, the page requested, the date and time, and information about your browser and operating system. This is needed to deliver the pages to you and to protect them from attacks. Cloudflare processes this data on our behalf and records it in logs. We do not analyse these logs to study how visitors behave. Cloudflare's servers are located around the world, including outside Switzerland (see “Disclosure abroad”).

Map from Google Maps

On our contact page and our location page, you can display a map from Google Maps. The map does not load by itself. Until you click “Load map”, the page does not connect to Google. Only when you click does your browser load the map from Google's servers.

When you click, Google receives data such as your IP address, information about your browser, the address of our website and the time of access. Google may also set cookies. For users in Switzerland and the European Economic Area, the responsible company is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also transfer data to the USA (see “Disclosure abroad”). We decide whether the map is offered on our website. What Google then does with the data is decided by Google. Google's privacy policy explains this.

If you do not want this, do not load the map. The clinic's address is also shown as text on the page. The map only stays loaded while you are on the page. On your next visit, it only appears again after a click. This does not affect data that Google has already received or cookies set by Google. You can delete cookies in your browser.

The link “Open the address in Google Maps” takes you straight to Google Maps. Google's privacy policy applies there too.

Appointment requests through the online form

When you send a request through the appointment form, we process the details you enter. You must enter your name, your phone number, the treatment you are asking about and your patient status, meaning whether you are already a patient with us. Your email address, a preferred date, your preferred time of day and a message are optional. If you are asking for someone else, tick the optional box “I am asking on behalf of another person”. The name and patient status then refer to that person. We use these details only to organise your appointment and to get back to you.

Please only ask on behalf of another person if they agree or if you are entitled to represent them. Please also tell them about this privacy policy. We only give you information about that person if they have consented or if you are entitled to represent them.

The treatment you choose and your patient status may already reveal something about your health. They are then health data and are specially protected. Please do not enter any further health information in the form. This includes symptoms, previous illnesses, allergies and findings. Please discuss these with us in person at the clinic, not in an online form.

Your details are sent in encrypted form (HTTPS) to a sending service of Cloudflare, Inc. (Cloudflare Workers). Cloudflare processes the content of your request on our behalf. The sending service forwards the request by email to our inbox at klinik@zk-k.ch using Cloudflare Email Routing. Like any normal email, this email is not end-to-end encrypted. With the request, we also receive the language of the page and the time it arrived.

The sending service does not keep its own copy of your request. However, Cloudflare keeps technical logs of the sending. These include the sender, recipient, time and subject line of the email. The subject line contains your name and the treatment you are asking about. According to Cloudflare, it keeps these logs for about one month. Your request is only stored permanently as an email in our inbox.

To prevent misuse, the sending service accepts no more than five requests per minute from the same IP address. To do this, Cloudflare briefly counts the requests per IP address. The sending service also checks how quickly the form was sent after the page was opened. This helps us recognise requests that a program sends automatically.

Messages by email and WhatsApp

If you send us an email or a WhatsApp message, we process your details in order to reply. These include your name, your email address or phone number and the content of your message.

For users in Switzerland, WhatsApp is a service of WhatsApp Ireland Limited in Dublin, Ireland, a Meta company. Personal messages are end-to-end encrypted while they are being sent. However, WhatsApp receives details such as your phone number and when you write to us. WhatsApp may also transfer data to the USA (see “Disclosure abroad”). WhatsApp's privacy policy explains what WhatsApp does with the data.

A normal email is not end-to-end encrypted. This means the email services involved can in principle see its content. Please do not send us findings, X-rays or details of symptoms or previous illnesses by email or WhatsApp. We are happy to discuss these by phone or at the clinic. WhatsApp is not intended for emergencies. In an emergency, please phone us.

Links to other websites

This website links to services of other providers. These are WhatsApp, Google Maps and the smile simulation by Angel Aligner. On most guide pages, there are also links for sharing via WhatsApp, LinkedIn and Facebook. These are ordinary links. As long as you do not click on them, none of these providers receives any data from this website. When you click, the other website opens. The privacy policy of that provider applies there.

Disclosure abroad

Some of the services we use for this website also process data outside Switzerland. The Swiss Federal Council decides which countries offer adequate data protection. Ireland is one of them. The USA has been one since 15 September 2024, but only for companies certified under the Swiss-U.S. Data Privacy Framework. For other countries without adequate data protection, special safeguards are needed, such as the European Commission's standard contractual clauses with the adjustments for Switzerland.

• Cloudflare, Inc. (delivering the website, sending the form): based in the USA, certified under the Swiss-U.S. Data Privacy Framework. Cloudflare operates data centres in many other countries around the world. Transfers to countries without adequate data protection are covered by the European Commission's standard contractual clauses with the adjustments for Switzerland. Cloudflare has included them in its data processing terms.
• Google (only if you load the map or open Google Maps): Google Ireland Limited in Ireland. Google may transfer data to Google LLC in the USA, which is certified under the Swiss-U.S. Data Privacy Framework.
• WhatsApp (only if you write to us on WhatsApp): WhatsApp Ireland Limited in Ireland. WhatsApp may transfer data to WhatsApp LLC in the USA, which is certified under the Swiss-U.S. Data Privacy Framework.

Your rights under Swiss data protection law (FADP)

Under the Swiss Federal Act on Data Protection (FADP) and the Health Act of the canton of Zurich, you have the following rights in particular:

• Access: you can find out whether and what data we process about you, why, for how long and who we disclose it to. Access is normally free of charge, and we normally reply within 30 days.
• Copy of your patient records: you are entitled to a copy of your patient records.
• Correction: you can have incorrect data corrected. Patient records must stay traceable. We therefore do not change entries afterwards but add a dated entry. If it cannot be established what is correct, you can ask us to add a note that you dispute the entry.
• Deletion and objection: you can ask us to delete data or to stop processing it. We may still process data if the law requires it or another legal ground permits it, for example the obligation to keep patient records.
• Data portability: you can ask for data that you gave us yourself in a common electronic format, if the legal requirements are met. Under the same requirements, you can ask us to transfer it directly to another controller, such as another practice.
• Withdrawal of consent: if you consented to processing, you can withdraw your consent at any time with effect for the future. What happened before then remains valid. The duty to keep patient records stays in place.

How to exercise your rights

Write to us at klinik@zk-k.ch or by post to Zahnklinik Küsnacht AG, Goldbacherstrasse 3a, 8700 Küsnacht. So that we do not give your data to anyone else, we may ask you to prove your identity. If you wish, we can also give you health data through a healthcare professional of your choice. In cases provided for by law, we may restrict access. If we do, we will tell you why.

Reporting to the FDPIC

If you believe that we are breaching data protection law, you can report this to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. The FDPIC decides whether to open an investigation. You can also assert your claims before a civil court.

Contact

If you have questions about data protection, you can reach us at klinik@zk-k.ch. We are also happy to answer your questions by phone on +41 44 915 17 77.

Changes to this privacy policy

We update this privacy policy when our data processing or the law changes. The version published on this website applies.