In this privacy policy (this “Privacy Policy”), we, Nadia Elaine Banna and Dr. med. Florian Pfefferkorn (hereinafter, we or us), explain how we collect and otherwise process personal data.
The term “personal data” or “data” refers to all information that relates to a specific or identifiable person. If you provide us with the personal data of other persons (for example, family members or work colleagues), please make sure that these persons are aware of this Privacy Policy and only share their data with us if you are allowed to do so and if this personal data is correct.
Note that other privacy policies or general terms and conditions, conditions of participation, and similar documents may govern specific data privacy topics. This Privacy Policy is aligned with the EU General Data Protection Regulation (“GDPR”) and the Swiss Data Protection Act (“DPA”). However, the application of these laws depends on each case. The terms used are not gender-specific.
1. Controller and Data Protection Officer
Nadia Elaine Banna, Uetlibergstrasse 111A, 8045 Zürich, is responsible for the data processing that we describe here unless otherwise specified in individual instances. If you have any data privacy concerns, you can communicate them to us at the following contact address:
Postal address: Uetlibergstrasse 111A, 8045 Zürich
Email: nadia@nadiabanna.com
2. Collection and Processing of Personal Data
We primarily process the personal data that we receive from our patients and other business partners in the course of our relationship with them, or that we collect from visitors when operating our website. To the extent permitted, we also collect certain data from publicly accessible sources or receive such data from authorities and other third parties.
In addition to the data you give us directly, the categories of personal data we may receive about you include information relating to your professional functions and activities, information in correspondence and meetings, your contact and address details, and data in connection with the use of the website (for example, IP address, information about your device and settings, date and time of visit, and pages viewed).
3. Purpose of Data Processing and Legal Grounds
We use the personal data we collect primarily to enter into and perform our agreements with our patients and business partners (in particular the practice of medicine and the practice of the Alexander Technique, a complementary-medicine method) and to comply with our legal obligations at home and abroad.
We also process data, to the extent permitted and as we deem appropriate, for the following purposes, in which we (and sometimes third parties) have a legitimate interest:
- Offering and further developing our services and website;
- Communicating with third parties and processing their inquiries (for example, job applications, media inquiries);
- Asserting legal claims and defending ourselves in connection with legal disputes and official proceedings;
- Preventing and investigating criminal offenses and other misconduct;
- Ensuring that our operations, in particular our IT and website, run properly and securely;
- Complying with legal and regulatory obligations and our internal regulations.
4. Website Hosting, Cookies, Tracking and Forms
Hosting (GitHub Pages). This website is hosted by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, as a static site on GitHub Pages. When you visit the website, GitHub automatically collects and stores technical access data in server log files (such as your IP address, the date and time of the request, the page requested and your browser type) for the purpose of delivering the website securely and reliably. For more information, see GitHub’s privacy statement: GitHub General Privacy Statement.
No cookies or tracking. This is a static website. We do not set our own cookies, and we do not use analytics, advertising, profiling or social-media tracking tools. We do not create profiles of your browsing behavior, and no third-party plug-ins (such as social-network buttons) are embedded that would transmit data while you browse.
4.1 Contact and Appointment Forms (Formspree)
If you contact us through the contact form or the appointment-request form, the data you enter (such as your name, email address, telephone number and message) is transmitted to and processed on our behalf by our form provider Formspree, Inc. (USA), which forwards your message to us by email. We use this data solely to process and respond to your inquiry. As the data is processed in the United States, the notes in Section 6 apply. For more information, see Formspree’s privacy policy: Formspree Privacy Policy. You can always contact us directly by email or telephone instead of using the forms.
5. Transfer of Data to Third Parties
In the context of our activities and in line with the purposes set out in Section 3, we may transfer data to third parties insofar as such a transfer is permitted and we deem it appropriate, for them to process data for us or for their own purposes. In particular, the following categories of recipients may be concerned:
- our service providers, including processors such as IT and website-service providers (for example, our hosting and form providers named above);
- suppliers, subcontractors and other business partners;
- patients and other clients;
- domestic and foreign authorities or courts;
- acquirers or parties interested in the acquisition of business units;
- other parties in potential or pending legal proceedings.
If we pass on data to third parties, we comply with the relevant legal requirements and, in particular, conclude data-processing agreements or similar agreements with the respective recipients to protect your data.
6. Transfer of Data Abroad
We may share data with persons, authorities, organizations or companies abroad. In particular, we may transfer personal data to all countries in which our service providers process personal data. In particular, when you use our website and our forms, data may be processed in the United States by our hosting provider (GitHub) and our form provider (Formspree).
If a recipient is located in a country without adequate statutory data protection, we require the recipient contractually to comply with applicable data protection (for this purpose, we use the standard contractual clauses of the European Commission, available here), unless the recipient is already subject to a legally recognized set of rules to ensure data protection or we can rely on an exemption provision (for example, your consent, the performance of a contract, or the establishment, exercise or defense of legal claims).
7. Duration of the Retention of Personal Data
We process and retain your data for as long as it is necessary for the fulfillment of our contractual and legal obligations or otherwise for the purposes pursued with the processing, for example, for the duration of the entire business relationship and beyond, under statutory retention and documentation obligations. As soon as your data is no longer required, it will, as a matter of principle and to the extent possible, be deleted or anonymized. For operational data (such as server logs), shorter retention periods of twelve months or less generally apply.
8. Data Security
We take appropriate technical and organizational security measures to protect your data from unauthorized access and misuse. We follow best practices for secure data processing and storage, take the protection of personal data into account when designing or choosing hardware, software and processes, and ensure data-protection-friendly default settings.
9. Obligation to Provide Personal Data
In the course of our relationship, you must provide those personal data that are necessary to start and perform the relationship and to fulfill the associated obligations. Without this data, we will generally not be able to enter into or perform an agreement with you. Our website also cannot be used if certain traffic-securing information (such as your IP address) is not disclosed.
10. Profiling and Automated Individual Decision-Making
We do not carry out profiling that has legal effects on you, and in establishing and carrying out our relationship we generally do not use fully automated individual decision-making. Should we use such procedures in certain cases, we will inform you separately where required by law and advise you of your relevant rights.
11. Your Rights
To the extent provided by applicable law (as is the case where the GDPR applies), you have the following rights:
- the right to request information about whether and what data we process about you;
- the right to have us correct data if it is inaccurate;
- the right to request that we delete data;
- the right to request that we provide certain personal data in a commonly used electronic format or transfer it to another controller;
- the right to withdraw consent, insofar as our processing is based on your consent;
- the right to object to the processing of your data.
Please note that we reserve the right to assert the restrictions provided for by law, for example, if we are required to retain or process certain data, or need it for the assertion or defense of claims. To exercise your rights, you may contact us at the address provided in Section 1; we may require you to prove your identity. Every data subject also has the right to file a complaint with the competent data-protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
12. Amendments to this Privacy Policy
We may amend this Privacy Policy at any time without prior notice. The current version published on our website shall apply. If this Privacy Policy is part of an agreement with you, we will notify you by email or other appropriate means in the case of an amendment.