Privacy Notice

SUPPLEMENTARY PRIVACY NOTICE/
WePractice AG

1. What is this Privacy Notice about?

WePractice AG is a company of Migros Group. The processing of personal data in connection with the platform accessible at www.wepractice.ch (the “Platform”) is explained in Migros Group's general privacy notice, which is available here: https://privacy.migros.ch/en.html#datenschutzerklaerung. This Supplementary Privacy Notice contains further information on data processing in connection with the Platform. It is to be taken into account in addition to the general privacy notice. Further information thereon can be found in section 6 below.

2. Who is the controller of the data processing?

Generally, the following company (“we” or “us”) is the controller of the data processing in connection with the Platform:

WePractice AG, Stockerstrasse 38, 8002 Zurich (CHE-136.324.653)

We are in particular the controller of the data processing in connection with the following activities:

operation of the Platform and the associated contract management
referral of individuals seeking therapy and self-employed therapists
leasing of premises to self-employed therapists and
practice operation, provided that employed therapists perform therapy services and we, as the practice operator, conclude the treatment contract.

These data processing activities may relate to all persons whose data we process, e.g. therapists, individuals seeking therapy and patients (each hereinafter referred to as “you”).

In contrast, we are not the controller if we support self-employed therapists in the administration of their practice (e.g. scheduling, keeping patient records, billing). This Supplementary Privacy Notice does not apply to such cases. In these cases, the respective self-employed therapist is the controller and we act as their processor. You can find out whether a therapist is self-employed and how you can contact this therapist via their profile card in the directory and on their profile.

In certain cases, another Migros Group company may be the sole controller or joint controller with us of the data processing.

If you have any questions about the processing of your personal data for which we are the controller in connection with the Platform or would like to exercise any of your data protection rights, please feel free to contact us as follows:

WePractice AG, Stockerstrasse 38, 8002 Zurich, datenschutz@wepractice.ch

3. What personal data do we process?

In connection with the Platform, we particularly process the following personal data, depending on the role in which you are involved with us:

master data, e.g. salutation, name, contact details or date of birth;
contract data, e.g. type and duration of a treatment contract concluded between you and us or – if you are a self-employed therapist – a contract concluded between you and us on the use of space and information on your professional expertise;
health data, e.g. about your emotional state, diagnosed symptoms or your social environment if you are a patient;
communication data, e.g. when you contact therapists employed by us and explain the reason for your inquiry;
transaction and behavior data, e.g. if you register as a therapist on our Platform or if you want to find a suitable therapist as a patient; and
technical data, e.g. your IP address or a device ID.

We may also process other master data, contract data, communication data, transaction and behavior data, preference data, technical data, image and sound recordings and other categories of personal data. Further information about this can be found in section 4 of the general privacy notice.

Such data may also include sensitive personal data, in particular health data. Further information on how we process sensitive personal data can be found in section 10 of the general privacy notice.

You often disclose personal data we process to us yourself, for instance when sending us data or communicating with us – also in the context of therapy. However, we may also collect personal data about you ourselves, for example when our therapists make a diagnosis or enter observations relevant to your therapy in the patient record. We may also receive personal data from third parties, in particular from other service providers (such as referring physicians or previous therapists). Further information about this can be found in section 5 of the general privacy notice.

4. For what purposes do we process personal data?

In connection with the Platform, we process personal data in particular for the following purposes:

Operation of the Platform, in particular to prevent misuse of our Platform and to ensure its administration;

Contract processing, in particular in order to:

find suitable therapists for you if you are looking for such;
handle orders that are transmitted to us by referring persons;
fulfil the treatment contract concluded with you if you are a patient of therapists employed by us;
refer patients to you at their request if you are a self-employed therapist;
provide you with premises and support you in the administration of your practice if you are a self-employed therapist;

Compliance with statutory requirements, in particular in order to

properly bill for therapy services in accordance with statutory requirements; and
comply with the professional obligations applicable in the field of psychotherapy;

Information and marketing, in particular to inform you regularly about mental health topics in our newsletter.

We may also process personal data for other purposes related to communication, contract processing, information and marketing, market research and product development, security and prevention, compliance with statutory requirements, law enforcement and administration and support within Migros Group. Further information about this can be found in section 5 of the general privacy notice.

5. To whom do we disclose personal data?

We may disclose personal data that we receive from you or third-party sources to other Migros Group companies. Further information about this can be found in section 8.1 of the general privacy notice.

We may also disclose your personal data to companies within and outside Migros Group if we make use of their services. For example, we use the cloud infrastructure of SFDC Ireland Ltd (“Salesforce”) to operate the Platform. These service providers generally process personal data on our behalf as so-called “processors”. We ensure through the selection of service providers and suitable contractual agreements that data protection is upheld during the entire processing of your personal data. More detailed information on how data protection is ensured in connection with the Salesforce Cloud can be found on the Salesforce Privacy Page.

In individual cases, it is also possible that we may disclose personal data to other third parties for their own purposes, for example if you have granted your consent or we are legally obliged or authorized to share such information. In such cases, the data recipient is legally responsible as the controller of the data. Examples of such cases include the following:

referral to hospitals or other in-patient facilities;
communication of information about your state of health to your relatives subject to professional secrecy;
notifications to health insurance companies for the evaluation of cost reimbursements;
communication of information about your state of health to other service providers;
transfer of claims to other companies, such as collection agencies.

Further information about this can be found in section 8.2 of the general privacy notice.

Naturally we comply with the rules of professional secrecy (especially medical confidentiality) as far as they apply. In such cases, we only disclose the personal data concerned (e.g. your health data) even within Migros Group in accordance with the requirements of professional secrecy (e.g. where necessary for your treatment). In addition, we reserve the right to disclose your personal data in accordance with section 8 of the general privacy notice. If, in the course of our professional activities, you wish to entrust us with information about yourself or others which we should treat differently from that set out in section 8 or which should be subject to special confidentiality and which is not already covered by professional secrecy, please inform us in advance so that we can review your concerns and, if necessary, take the necessary security measures.

6. Further information

Please also read the general privacy notice. It also applies to the processing of personal data in connection with the Platform and contains further information on data protection.

In the general privacy notice, you will learn, among other things:

what benefits our data processing has for you;
which legitimate interests we have in data processing and on which other legal bases our processing is based;
how we use your personal data within Migros Group and under which circumstances we may disclose your personal data to companies outside Migros Group;
how we transfer your personal data abroad and what safeguards we take to ensure adequate data protection;
how and for what purposes we use profiling and whether we make material decisions on a fully automated basis;
what measures we take to adequately ensure the security of your personal data;
for how long we generally process and store your personal data;
how we use cookies and similar technologies when you visit our websites and mobile apps;
what rights you have with respect to the processing of your personal data and how you can exercise them;
how you can contact the Migros Group Data Protection Officer or the European Union/European Economic Area representative.

7. Changes to this Privacy Notice

This Supplementary Privacy Notice may be updated over time, especially if we change our data processing activities or if new legal provisions become applicable. We will actively inform individuals whose contact details are registered with us of any material changes, provided that we can do this without disproportionate effort. In general, the version of the Privacy Notice in effect at the time at which the data processing activity in question commences is applicable.