Privacy Policy

This Privacy Policy describes how CareTrack ("CareTrack", "we", "us") processes personal data — including health-related information — in the course of providing its between-visit patient follow-up and appointment-preparation platform (the "Service") to private clinics, their staff, and the patients those clinics invite.

It applies to all personal data we process on behalf of clinics, as well as data we collect directly from visitors to our website and from clinic users of the Service. It is written to align with the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Swiss Federal Act on Data Protection ("FADP"), and to be intelligible to a non-legal reader.

For most personal data processed through the Service — in particular patient identifiers, patient-reported updates, and any clinical context entered by clinic staff — the clinic is the Data Controller and CareTrack acts as a Data Processor on the clinic's documented instructions, governed by a Data Processing Agreement (DPA).

For a limited set of data we control directly — such as account information of clinic administrators, billing records, support communications, and website analytics — CareTrack acts as an independent Data Controller.

Patients interact with the Service through the clinic that invited them. Questions about how a specific clinic uses CareTrack should be directed to that clinic in the first instance.

We collect and process the following categories of personal data:

• Clinic and staff data — names, work email addresses, role within the clinic, and authentication credentials.
• Patient identifiers provided by the clinic — typically name, contact channel (email or mobile), and an internal patient reference.
• Patient-reported updates — structured responses to between-visit check-ins (e.g. pain levels, adherence, free-text notes for the next appointment).
• Service usage data — log records, IP address, device and browser information, and timestamps necessary to operate and secure the Service.
• Support and correspondence — messages you send to us, and our replies.

We deliberately do not ingest full electronic medical records. Data minimisation is a default, not an afterthought.

Patient-reported updates may constitute "special category data" under Article 9 GDPR and "sensitive personal data" under the FADP. CareTrack treats such data with elevated safeguards: it is encrypted in transit and at rest, isolated per clinic, accessible only to authorised clinic staff under role-based controls, and never used to train external AI models.

Processing of sensitive health data on the clinic's behalf is performed on the legal basis chosen by the clinic — typically explicit patient consent (Art. 9(2)(a) GDPR) or the provision of healthcare (Art. 9(2)(h) GDPR).

We use personal data only for clearly defined purposes:

• To provide the Service — collecting check-ins, generating summaries, and surfacing them to authorised clinic staff.
• To secure the Service — authenticating users, detecting abuse, and maintaining audit logs.
• To support clinics — responding to enquiries and resolving incidents.
• To improve the Service — using aggregated, non-identifying signals to refine usability and reliability.
• To meet legal obligations — including record-keeping, tax, and lawful requests by competent authorities.

We do not sell personal data. We do not use patient data for marketing, profiling, or behavioural advertising. We do not permit third parties to do so on our infrastructure.

CareTrack uses AI models to draft pre-visit summaries from structured patient updates. These summaries are assistive only: they exist to help clinic staff prepare faster, not to replace clinical judgement.

A qualified clinic user reviews and edits the summary before it is used in care. Patient inputs and generated summaries are not used to train external models and contractual safeguards are in place with AI subprocessors to that effect. CareTrack does not provide medical advice, does not diagnose, and is not a medical device.

Where CareTrack acts as a Data Processor, processing is governed by the clinic's DPA and the legal basis the clinic relies on. Where CareTrack acts as a Data Controller, our legal bases under Article 6 GDPR are:

• Contract — to provide the Service to the clinic.
• Legitimate interests — to operate, secure, and improve the Service, balanced against your rights.
• Legal obligation — where applicable law requires retention or disclosure.
• Consent — for optional communications you specifically opt into.

For sensitive health data we additionally rely on the Article 9 GDPR conditions described above, or their FADP equivalents.

We share personal data only with vetted subprocessors who provide infrastructure, AI processing, or operational support under written agreements that mandate confidentiality, security, and processing limited to documented instructions.

A current list of subprocessors is available on our Security page. We notify clinics of material changes before they take effect, where contractually required.

We do not sell personal data and we do not share it with advertising networks or data brokers.

We apply technical and organisational measures appropriate to the sensitivity of the data, including: encryption in transit (TLS 1.2+) and at rest, role-based access controls and least privilege, multi-factor authentication for administrative access, per-clinic data isolation, centralised audit logging, dependency and vulnerability scanning, and documented incident response procedures.

No system can guarantee absolute security; CareTrack does not make absolute claims. Full detail is available on our Security & Compliance page.

Patient data is processed and stored within Switzerland or the European Economic Area (EEA), depending on the clinic's region. Where data is transferred to a country outside the EEA or Switzerland — for example to an AI subprocessor — we rely on lawful transfer mechanisms, including the European Commission's Standard Contractual Clauses (SCCs), the Swiss FADP-compatible addendum where required, and supplementary technical and contractual measures.

The current transfer arrangements are documented in the DPA and on our Security page.

Personal data is retained only as long as necessary for the purposes for which it was collected, the duration of the clinic's contract, and any applicable legal retention obligations.

• Patient data is retained according to the clinic's documented instructions and applicable medical-records law.
• Account and billing records are retained for the duration of the contract and a reasonable period thereafter.
• Operational logs are retained for a defined window appropriate to security and audit needs.

On termination, clinic data is exported on request and permanently deleted within a defined retention window, as specified in the DPA.

Subject to GDPR, FADP, and other applicable law, individuals have the right to:

• access the personal data we hold about them;
• request rectification of inaccurate or incomplete data;
• request erasure ("right to be forgotten");
• request restriction of processing;
• data portability, in a structured, machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting prior lawful processing;
• lodge a complaint with a supervisory authority.

Because the clinic is typically the Data Controller, patients should usually contact their clinic first. CareTrack will support clinics in responding to any verified request.

We use a small number of strictly necessary cookies to operate the Service — for example, to maintain authenticated sessions. Where we use analytics on our marketing website, we configure it to minimise personal data collection (IP anonymisation, short retention, no cross-site tracking).

We do not place advertising cookies, behavioural-tracking pixels, or third-party marketing trackers on the patient-facing surfaces of the Service.

CareTrack is intended for use by clinics with their patients. Where a clinic invites a minor to use the Service, it is the clinic's responsibility to obtain the appropriate parental or guardian consent and to determine the lawful basis for processing the minor's data under applicable law. We do not knowingly collect data from minors outside of a clinic-initiated workflow.

We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, or applicable law. The "Last updated" date at the top of this page reflects the most recent revision. Where changes are material, we will notify clinic administrators in advance through the Service or by email.

For privacy questions, requests to exercise rights, or to request our DPA, contact our Data Protection point of contact:

• Email: privacy@caretrack.health
• General enquiries: hello@caretrack.health
• Postal address: provided on request to verified clinic contacts.

Patients should contact their clinic in the first instance for requests relating to their own data.