Privacy.
Last updated 2 November 2026. The German version is legally binding.
Transparency and the responsible handling of personal data are essential to us. This privacy policy explains what personal data we, Medizinisches Zentrum Medikon AG (hereinafter Medikon, we or us), collect about our patients, visitors to the website medikon.ch, and other data subjects, the purposes for which we process these data, and the rights available to data subjects. The medical centre is a psychiatric and psychotherapeutic centre located at Leutschenbachstrasse 95, 8052 Zürich, Switzerland. The practice combines medical psychiatry with psychological psychotherapy and ensures evidence-based care. We maintain discretion and protect your privacy; personal information is treated confidentially and shared only where therapeutically necessary and legally permitted.
Controller and contact
Medizinisches Zentrum Medikon AG
Leutschenbachstrasse 95
8052 Zürich
Switzerland
Email: info@medikon.ch
Representative / Managing Director: Lukas Messmer.
Data Protection Officer: Hajrija Tahirovic (Director of Quality Management and Data Protection). You may contact our Data Protection Officer at the postal address above marked ‘Data Protection Officer’ or by email at info@medikon.ch.
General principles
Legal basis: We are subject to the revised Swiss Federal Act on Data Protection (revFADP; German: revDSG) and, where applicable, the EU General Data Protection Regulation (GDPR). We process health data and other particularly sensitive personal data only with explicit consent or on the basis of a statutory obligation.
Transparency: Data subjects are entitled to all information required to exercise their rights.
Rights of data subjects: These include access, erasure, restriction, provision, or transfer of data (data portability). The controller provides access free of charge and generally within 30 days.
Privacy by design and by default: We implement technical and organisational measures to ensure data protection right from the design stage and through default settings.
Data security: We host all patient and administrative data exclusively on Swiss IT systems and store them on encrypted servers within Switzerland. The Tomedo practice management software is operated locally or within a Swiss data centre; access is granted exclusively via secure connections and HIN-protected email addresses.
What data we collect
3.1 General personal data
We collect first and last names, address, date of birth, contact details (telephone number, email), emergency contacts, insurance numbers, as well as health insurance and billing details. You provide these details to us, for instance, when completing our registration and intake form, which contains personal details, an emergency contact, insurance details, and information regarding your GP practice or referring specialist.
3.2 Health data and sensitive personal data
As a psychiatric and psychotherapeutic centre, we process data concerning physical and mental health, diagnoses, treatment plans, medical history, medication details, clinical findings, test results, emergency plans, and details relating to intimate personal spheres. This information is considered particularly sensitive. We maintain patient records exclusively in electronic form, dated and unalterable; the data are stored on encrypted servers in Switzerland.
3.3 Contract and consent data
We process data in connection with the conclusion and implementation of the treatment contract as well as associated consents. Prior to the initial appointment, patients receive all required documents electronically via HIN Mail or a patient link; forms are signed digitally and filed automatically in the patient record. These include, among others:
Treatment contract / consent to treatment: Details regarding the clinical setting, therapy and treatment goals, appointment scheduling, and contact procedures during crises.
Privacy notices and consent to data processing: including specific releases from medical confidentiality in relation to general practitioners, referring professionals, as well as health, accident, or disability insurers.
Consent to electronic communication: Use of HIN Mail, SMS reminders, or secure online portals.
Telemedicine / video consultation consent: Information regarding technical safeguards for video or telephone consultations.
Referral order form for psychological psychotherapy: in accordance with the ordering model under the Federal Health Insurance Act (KVG) and Art. 11b of the Health Insurance Benefits Ordinance (KLV).
Consents for quality assurance and benchmarking: Participation in anonymised or pseudonymised outcome surveys and research projects.
Crisis / Emergency plan: Designation of emergency contacts and consent to establish contact in critical situations.
Consents for diagnostic and assessment procedures: such as ADHD assessments or third-party history reports obtained with the third party’s consent.
Supervision / Intervision: Consent to anonymised case discussions within the scope of clinical supervision or peer consultation.
Billing and payment agreements: Agreements regarding third-party payment (tiers payant), policyholder reimbursement (tiers garant), details on deductibles and co-payments, assignments of claims for services outside the KVG/LAMal, and for supplementary insurance or self-pay services.
EPR consent: where an electronic patient record is used; includes specifications on releases and access rights.
Proof of identity: Presentation of the health insurance card, identity card, or passport for identity verification.
Documentation for minors: in particular proof of custody and parental or guardian consent to treatment.
Confirmation of medication dispensing: in cases of in-house dispensing or the dispensing of controlled substances.
Consent for research and outcome assessments: Participation in anonymised or pseudonymised studies; these consents may be withdrawn at any time.
Consent to follow-up contact after conclusion of therapy: such as for follow-up appointments or evaluation purposes; this consent is voluntary.
Withdrawal form for consents: Forms through which you can formally withdraw previously granted consents for specific areas.
3.4 Communication and usage data
When visiting our website or communicating electronically (e.g. via email), additional information is generated: IP address, information regarding the browser and operating system, date and time of access, as well as data regarding website usage. We use these data to provide the website, ensure security, and improve our services.
3.5 Data from third parties and publicly accessible sources
We may receive information from doctors, psychotherapists, referrers, health insurers, accident and disability insurers, and public authorities. In addition, we process data that you provide to us regarding third parties (such as emergency contacts). Please ensure that these individuals have given their agreement. In justified cases, we use publicly accessible data (e.g. entries in professional or commercial registers).
3.6 Automatically collected data
When using our online services, we automatically collect data concerning your device (e.g. IP address, browser type, operating system), page usage, and technical metrics to keep the website operational.
3.7 Forms on this website
Registrations, referrals, applications, and other enquiries submitted via the forms on this website are processed using the Formsly form service. Your details are transmitted in encrypted form and stored exclusively on servers in Switzerland. They are delivered to a HIN-protected email address at Medikon and used solely to attend to your request.
Purposes for which we process data
We process your personal data exclusively for the following purposes and only to the extent necessary for the respective task:
Treatment and care: Conducting psychiatric or psychotherapeutic consultations, assessments, and treatment, as well as organising appointments. This includes compiling medical histories, diagnoses, therapy and medication plans, liaising with referrers, and documentation in the patient record.
Compliance with legal obligations: We are subject to the Swiss Federal Health Insurance Act (KVG/LAMal), cantonal health legislation, and the revFADP. These include obligations concerning proper documentation, archival retention (20 years following the last entry), medical confidentiality, and billing towards health insurers.
Contractual performance and billing: Processing invoices, transferring data to compulsory basic health insurance (OKP), accident or disability insurers, supplementary insurance providers, employers (for corporate clients), and payment clearing centres.
Quality and risk management: Participation in national quality assessments. We use the Tomedo practice software, an FADP- and GDPR-compliant all-in-one solution with an integrated quality module. Critical incident reports are processed anonymously in our CIRS system, evaluated, and, where appropriate, reported to national networks.
Security and compliance: Ensuring information security, identity verification, access controls, audit trails, backups, and encryption.
Communication: Contacting you by telephone, post, email, or encrypted HIN Mail, appointment reminders via SMS, replying to enquiries, and preparing clinical reports or referrals.
Telemedical services: Conducting video or telephone consultations in accordance with separate consent.
Research, quality improvement, and statistics: Conducting anonymised or pseudonymised outcome surveys, quality assurance, benchmarking, and research, provided you have consented to this.
Marketing and public relations: With your agreement, we provide information regarding updates from our centre or contact you for evaluations following the conclusion of therapy.
Operational administration: Human resources administration, financial accounting (in collaboration with FMH Consulting Services and TBO), procurement, facilities management, and adherence to hygiene standards.
Legal bases for data processing
We base our data processing on the following legal grounds:
Performance of a contract (Art. 31 para. 2 revFADP): Processing is necessary for the performance of the treatment contract with you or to take pre-contractual steps (e.g. arranging appointments).
Statutory basis: The processing of health data is carried out on the basis of legal obligations pursuant to the KVG/LAMal, cantonal health legislation, professional confidentiality, and other public interests.
Consent: For voluntary services (e.g. electronic communication, telemedicine, research, marketing, consent to disclose data to third parties), we obtain your express consent. You may withdraw your consent at any time; such withdrawal is effective only for the future.
Legitimate interests: Where necessary, we process data to safeguard legitimate interests, such as ensuring operational security, improving the quality of our care, preventing misuse, or defending legal claims. In doing so, we ensure an appropriate balance between your interests and rights.
To whom do we disclose data?
We share personal data only when necessary for the stated purposes, where a statutory obligation exists, or where you have given consent:
Staff and clinicians: Within the centre, access to the patient record is limited strictly to doctors, psychotherapists, and authorised administrative staff involved in your care.
Referring and external treating professionals: In the event of referrals or consultation reports, we share relevant clinical details with other doctors and psychotherapists. Communication takes place in encrypted form via HIN-certified email addresses or secure electronic medical letters.
Health, accident, and disability insurers: For billing purposes or cost coverage confirmations, we share required data with insurers.
Public authorities: Pursuant to legal obligations, data may be disclosed to public health authorities, social insurance bodies, tax authorities, or law enforcement agencies.
Processors / Service providers: We engage service providers (e.g. hosting providers, IT service provider Datacure, software vendor Zollsoft AG for Tomedo, FMH Consulting Services AG, TBO for accounting). These parties process data solely on our behalf and in accordance with our instructions.
Research and quality assurance: Data are shared exclusively in anonymised or pseudonymised form.
We process and store patient data and other personal data arising from treatment within Switzerland. When visiting this website, technical data such as your IP address may be transmitted to providers abroad, in particular to the website hosting provider, to Google (Google Web Fonts), and to the content delivery network jsDelivr, see section 11.4. These providers may also process data in countries that do not offer an adequate level of data protection, such as the United States. In such instances, we take into account the list of countries with adequate data protection published by the Federal Council and rely on suitable safeguards, such as Standard Contractual Clauses. Upon request, we will provide information concerning the recipient countries and the safeguards put in place.
How long do we retain data?
Patient records are retained for a minimum of 20 years following the last entry. Statutory retention periods (e.g. under the Swiss Code of Obligations, tax legislation, or the KVG/LAMal) may require longer retention. Upon expiry of the retention period, the data are blocked and subsequently erased in compliance with data protection legislation; withdrawals of consent are noted in the record without delay. We store website communication and usage data for as long as necessary to fulfil the intended purposes or as required by statutory or contractual retention duties.
Data security
We implement technical and organisational security measures to preserve the confidentiality, integrity, and availability of personal data. These measures include:
Encryption and access controls: Patient records are maintained via the Tomedo practice management software and stored on encrypted servers. Access is role-based and available only to authorised staff using robust passwords.
Audit trails and logging: Tomedo logs all access events and modifications.
Backups: Daily backups are created locally and with a cloud provider (Datacure) on servers located in Switzerland.
Encrypted communication: Using HIN-certified email addresses, two-factor authentication for SMS services, and secure electronic clinical correspondence.
Data protection training: All staff members sign a data protection declaration and receive regular training in data protection and information security.
Erasure and blocking procedure: Following the expiry of the retention period, data are blocked and later erased; incoming paper documents are destroyed in compliance with data protection law following digitisation.
Incident management: Reports of errors or potential risks are recorded in a Critical Incident Reporting System (CIRS); corrective measures are derived from these analyses.
Rights of data subjects
Subject to statutory conditions, data subjects have the following rights:
Right of access: You may request information free of charge concerning the personal data stored about you. The controller generally provides this information within 30 days.
Right to rectification: You may request the correction of inaccurate or incomplete data.
Erasure or restriction: You may request the erasure of your data or the restriction of processing, provided that no statutory retention obligations apply.
Right to object: You may object to data processing, particularly where we process your data on the basis of a legitimate interest.
Withdrawal of consent: You may withdraw previously granted consent at any time; the lawfulness of processing carried out prior to the withdrawal remains unaffected.
Right to data delivery or transfer (data portability): Under the conditions of the revFADP, you may request that we provide your data to you in a conventional electronic format or transfer them to a third party.
Right to lodge a complaint: You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
To exercise these rights, please write to us (see section 1). Please include details of your request, your contact address, and proof of identity.
Profiling and automated decision-making
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you. Automated evaluation of your health data may take place in connection with quality assurance or within anonymised assessments; however, this is conducted without any link to your identity and solely with your consent.
Cookies and third-party services on our website
Our website uses cookies and similar technologies to ensure functionality and improve user experience. Cookies are small text files stored on your terminal device. You can configure your browser to decline cookies or to request your prior permission; however, this may restrict the functionality of the website.
11.1 Necessary cookies
These cookies are essential for operating the website and delivering core features. They are placed automatically and cannot be deselected.
11.2 Analytics without cookies
We measure visits to our website using Framer Analytics, the statistics tool of our hosting provider Framer B.V. (Netherlands). Only aggregated metrics such as viewed pages, referring websites, device type, and country are gathered. Framer Analytics does not place cookies, does not build user profiles, and does not associate information with health data. We do not use Google Analytics.
11.3 Saved location selection
If you select a location at the top of the website, your browser stores this preference on your device (in local storage under the key ‘medikon-standort’), allowing us to display the telephone number and email address for that location. This setting remains on your device, is not transmitted to us, and is not a cookie. You may clear it at any time in your browser settings.
11.4 Third-party services
Google Web Fonts: For a consistent presentation of typefaces, we use Web Fonts provided by Google. Your browser loads the required fonts from Google servers; Google is thereby informed that our website was accessed via your IP address.
swisstopo: For the locations map and location search, we use services from the Federal Office of Topography swisstopo (Wabern, Switzerland). Your browser loads map tiles from federal servers; swisstopo receives your IP address and technical information concerning your browser and device. If you enter a postcode or town in the location finder, this input is sent to swisstopo for the search. If you enable geolocation, your browser determines your position to show you the nearest locations. Your location is not transmitted to us; the map subsequently loads tiles surrounding your location from swisstopo.
jsDelivr: We load the map script library (MapLibre) via the content delivery network jsDelivr from Prospect One sp. z o.o. (Poland). Your IP address is transmitted to network servers, which may also be located outside Switzerland.
Additional services: Where we use additional services (e.g. video platforms or analysis tools), we will inform you on our website or request your consent.
Amendments to this privacy policy
We reserve the right to adapt this privacy policy at any time. The current version published on our website shall apply. If material changes are made, we will provide proactive notification (e.g. by email or on the website).
Contact
If you have questions regarding this privacy policy, our data processing, or the exercise of your rights, please contact:
Medizinisches Zentrum Medikon AG
Leutschenbachstrasse 95
8052 Zürich
Switzerland
Email: info@medikon.ch
This privacy policy enters into force on 2 November 2026 and supersedes earlier versions.