Y Thérapies Manuelles

Privacy Policy v2.0

Last updated: 01 July 2026  ·  Version 2.0

1. Data Controller

We are responsible for the processing of personal data under the Swiss Federal Act on Data Protection (FADP / revDSG) and the General Data Protection Regulation (GDPR), where applicable.

2. Scope of this Policy

This policy applies to all personal data collected in the context of:

• manual therapy services
• online booking and intake forms
• client communication and follow-up

3. Data We Collect

a) Contact data

• name, email address, phone number

b) Appointment data

• booking date and time, type of treatment, attendance history

c) Health data (sensitive data)

• medical history shared by you
• physical conditions or symptoms
• contraindications
• treatment-related notes

This data is considered sensitive personal data under Swiss FADP and GDPR.

d) Technical / service data

• form submissions
• communication logs related to appointments

We do not process payment card data directly. Payments are handled by third-party providers under their own privacy policies.

4. Purpose of Processing

• providing massage and therapeutic services
• managing appointments and scheduling
• ensuring safe and appropriate treatment
• maintaining a client record for continuity of care
• communicating with you regarding appointments
• fulfilling legal and administrative obligations (e.g. accounting)

5. Legal Basis for Processing

Swiss FADP

• processing necessary for provision of services (Art. 31 FADP)
• explicit consent for health-related data processing
• legal obligations (e.g. accounting requirements)

GDPR (where applicable)

• performance of a contract (Art. 6(1)(b))
• explicit consent for health data (Art. 9(2)(a))
• legal obligation (Art. 6(1)(c))

6. Health Data Processing

Health data is only collected and processed for therapeutic purposes, to ensure safe and appropriate treatment, and based on your explicit consent. Access is strictly limited to the treating therapist.

You may withdraw your consent at any time; however, this may affect our ability to continue treatment safely.

7. Data Sharing and Processors

We do not sell your personal data. We only share data with service providers acting as data processors, including:

• booking systems (e.g. Setmore / AnywhereWorks Inc.)
• form providers (e.g. Jotform Inc.)
• automation tools (e.g. Zapier Inc.)
• cloud and productivity services (e.g. Google LLC)

These providers process data strictly on our instructions.

8. International Data Transfers

Some of our service providers are located in the United States. Where applicable, we rely on the Swiss–U.S. Data Privacy Framework (DPF) adequacy decision for certified providers, together with data minimisation and access restriction measures.

Where a provider is not certified under the DPF, we limit data sharing to the strict operational minimum and avoid transferring sensitive health information where possible. We regularly verify provider certification status via the official DPF register.

9. Data Retention

• Appointment and contact data: typically up to 3 years after last contact
• Health records: up to 10 years, as necessary for therapeutic continuity and legal obligations
• Accounting records: up to 10 years as required by Swiss law

After expiry, data is securely deleted or anonymised.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• restricted access to health data
• password protection and authentication controls
• limited access to client records
• secure storage through service providers with appropriate safeguards

11. Cookies and Tracking

We do not use cookies for tracking or advertising purposes. Third-party services (such as booking or form providers) may use strictly necessary functional cookies for service operation.

12. Your Rights

Under Swiss FADP and GDPR (where applicable), you have the right to:

• access your personal data
• request correction of inaccurate data
• request deletion of data (where legally possible)
• restrict or object to processing
• withdraw consent at any time
• request data portability (GDPR only, where applicable)

To exercise your rights, contact us at y.manual.therapy@gmail.com. We aim to respond within 30 days.

You also have the right to lodge a complaint with:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch
• EU: your local supervisory authority (if applicable)

13. Changes to this Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website. Significant changes may be communicated directly to you.

14. Contact