Privacy Policy Swiss Paraplegic Centre

The Swiss Paraplegic Centre (SPC) dedicates its utmost attention to data privacy.

This information is intended to show you how we process your personal data at the SPC and inform you of your rights grounded in data protection law.

The SPG Privacy Policy informs you about data collected via the website.

Data processing is the responsibility of:

Swiss Paraplegic Centre
Guido A. Zäch Strasse 1
CH-6207 Nottwil

The data protection officer can be contacted at:

Swiss Paraplegic Group
Information security and data protection officer
Guido A. Zäch Strasse 1
CH-6207 Nottwil
E-mail: datenschutz@paraplegie.ch

We process all of your personal data that we receive from you in the context of a treatment relationship to you as a patient and any that we receive from the referring medical practice. We also collect data during the treatment.

If you are a business partner or customer, we process the data which we receive from you as part of this legal
relationship.

As part of an application procedure, you make your personal data available to SPC via your application for the
purpose of job searching. Your data is stored and processed on the systems of our software partner Haufe-umantis AG.

There is the possibility that you will be captured by our surveillance cameras at various public places (e.g. car parks, material handling areas, entrances and exits of SPG buildings) – the places will be marked.

For patients, we collect all data relating to their health which is relevant to the medical treatment and rehabilitation. Rehabilitation also includes our efforts to reintegrate you into your day-to-day working life. Health data is particularly sensitive personal data and will also be protected by professional secrecy (Article 321 SCC) within the context of the treatment.

For other contractual relationships, such as a business relationship or similar, we collect all data that we need in order to fulfil contractual or legal obligations.

Within the course of an application procedure, the data from the application documents such as your cover letter, CV, professional, educational and training qualifications as well as work references are collected.

Surveillance cameras on the Paraplegic Group campus (including car parks) film all people. Facial recognition
software is not used.

We process your personal data in accordance with data protection law. Your patient data is processed for the
purpose of ensuring the treatment is as successful as possible and for adhering to our legal obligations under health law. The purpose of the data processing is primarily based on the treatment/rehabilitation.

In our business relationships with you as a partner or customer, the data is solely collected for the purpose of the business relationship.

The data collected for an application is stored in the applicant database and is only stored, evaluated, processed or passed on within the company within the context of your application. The data will never be used for other purposes.

Video surveillance is used to deny access to the premises to unauthorised persons and to collect evidence in the event of theft and property damage. In the event of criminal offences, property damage, etc., it should also be possible to provide investigating authorities with relevant information which could help to determine the perpetrators.

Within the SPC, those bodies that need your data to fulfil our contractual and legal obligations will have access to it. Service providers and vicarious agents can receive data for these purposes. They must observe professional secrecy in this regard.

SPC employees are bound by professional secrecy and are obliged to keep confidential all patient-related facts and evaluations they have gained knowledge of as part of their work. Information about you may only be passed on if legal provisions stipulate this, you have given your consent or the supervisory authorities have released someone from the treatment team from their duty of confidentiality.

The transfer of data to health and accident insurance companies (they assume at least 45% of the costs) and to cantons (they assume 55% of the inpatient costs in the HIA area) constitutes a legal basis for the transfer of patient data.

If claims for benefits are lodged with invalidity insurance companies, the persons and authorities mentioned in the application are entitled to share all information with the bodies of the invalidity insurance company and provide all documents required to clarify benefit and recourse claims.

Information will only be passed on to Spitex, external therapists, nursing homes, employers, training and internship organisations and authorities with your consent. Your consent will be assumed if you are transferred to another hospital and you receive after-care from a doctor.

Data will only be passed on to other organisations of the Swiss Paraplegic Group if you have given us your consent to do so. Inpatients are regularly requested to give such consent.

Applicant data is stored and processed on the systems of our software partner Haufe-umantis AG. Secure transfer is ensured with 128-bit encryption. The data can only be accessed by employees of the HR department and the people at the SPC responsible for the selection process. Your data will never be passed on to companies or persons outside of the SPC (unless you addressed your application to another SPG organisation rather than the SPC, in which case the data will be passed on to that organisation).

The data collected from the video surveillance will only be disclosed to third parties on the basis of a legal obligation or for the assertion of a legitimate interest of an SPG organisation.

Data is never transferred to places outside of Switzerland (so-called third countries) without your consent.

We process and store your personal data for as long as it is required for the fulfilment of our contractual and legal obligations. It is worth noting in this respect that our relationships to you as a patient are a continuing obligation which are intended to last for years.

In the field of patient treatment, we are also legally obliged to store your documents for 10-20 years. We keep patient data for 20 years for reasons pursuant to liability law.

If the data is no longer necessary for the fulfilment of contractual or legal obligations, it will be erased on a regular basis.

If you are employed at SPC, your applicant data will be included in your employee file.

If you applied but were turned down, your information will be erased around 24 months after the application procedure has come to an end so that we can answer any questions the regional job centre may have. You are not informed of the data’s erasure. If we want to include your data in a talent pool, we will obtain your explicit consent.

Video recordings will be automatically deleted after 60 days at the latest. It is only possible to store the videos for longer if this is done so in connection with an assertion of claims.

As a data subject, you have the right to information, inspection, rectification and erasure (not applicable to patient data as this must also be retained in the public interest) as well as to the restriction of processing. You may revoke consent you have given for data processing at any time. Please note that the withdrawal of consent is only effective for the future. Processing executed before the withdrawal is not affected thereby.

The rights of the data subject can be asserted in an informal manner. A request is to be addressed to:

Swiss Paraplegic Group
Information security and data protection officer
Guido A. Zäch Strasse 1
CH-6207 Nottwil
E-mail: datenschutz@paraplegie.ch

The data we store will be erased as soon as it is no longer required for its purpose and the erasure is not in conflict with any legal retention obligations. If the user’s data is not erased because it is necessary for other purposes permitted by law, its processing will be restricted. This means that the data is blocked and not used for other purposes. The applies, for example, to user data which must be stored for reasons under trade or tax law.

The SPC does not carry out any fully automated decision-making based on the information we have.

No profiling is carried out with the data collected about you.

We take organisational, contractual and technical security measures according to the state of the art to ensure compliance with the provisions of data protection laws and thus protect any data we process from accidental or intentional manipulation, loss, destruction or access by third parties.

Changes to this Privacy Policy may be necessary as part of the further development of our websites and the implementation of new technologies. We therefore recommend that you reread this Privacy Policy from time to time.

SPC, January 2019