Política de privacidade

Kralys SA, Avenue des Alpes 29, 1820 Montreux, Switzerland, is responsible for the processing described in this policy (the controller). For data protection requests, write to dpo@katarinahealth.com. You can also reach us through our contact page or by post. Please say that your request concerns data protection.

When a practice or another organisation uses Katarina's professional software to manage its patients or clients, that organisation is the controller of their data, and we process the data on its behalf under a data processing agreement. If you are a patient of such an organisation, please contact it first. We forward to it any request we receive about its data.

This policy covers the Katarina website, your Katarina account, the public pages and the search, and our communication with you by email, text message and post. Our cookie policy gives details about the cookies and browser storage we use.

Our hosting provider processes technical data for every request, to deliver the page and to protect the service against attacks and misuse: your IP address, the date and time, the page requested, your browser and device (user agent) and the page you came from. We do not use this data to identify you.

We do not use analytics, advertising or tracking tools.

We rely on our legitimate interest in a secure, working website (art. 6(1)(f) GDPR).

For your account, we process:

• your name, email address and mobile number, and whether you have confirmed them;
• your password, which we store only in hashed form so that nobody can read it;
• your language and, if you have one, your profile picture;
• for each session, the IP address, the browser and device (user agent), and the times of sign-in and expiry;
• the organisations and teams you belong to, and the invitations you send or receive.

We send one-time codes by email and text message to confirm that the email address and the mobile number are yours. A code is valid for 5 minutes. We use your mobile number to verify your account and to contact you about it, not for marketing, and we do not show it to other users.

We use this data to create and protect your account, to sign you in, to prevent misuse and to write to you about your account. We rely on our contract with you (art. 6(1)(b) GDPR) and on our legitimate interest in security (art. 6(1)(f) GDPR).

If you sign in with Google or Microsoft, that provider sends us your name, email address, profile picture and an account identifier. We store the access tokens it issues with your account. We ask only for your basic profile, not for access to your emails, files or contacts, and we never receive your password.

The provider learns that you use Katarina. Its own privacy policy applies to the processing on its side.

When you search, we process the words you type and the place you choose, to show matching pages. To suggest places and addresses, our server sends the text you type to Google. Google does not receive your IP address from us.

If you allow your browser to share your location, we use your coordinates to show results near you and send them to Google to find the name of your town. Your browser keeps the location for the current tab, and the coordinates appear in the address (URL) of the results page. We do not save them with your account. We rely on the permission you give in your browser, which you can withdraw there at any time (art. 6(1)(a) GDPR).

When you open the map view, your browser loads the map from CARTO and the map software from unpkg. Both receive your IP address.

For the search itself, we rely on our legitimate interest in offering a useful service (art. 6(1)(f) GDPR).

Katarina publishes pages about health professionals and organisations so that people can find them. A page can show the name, profession and specialties, workplaces and addresses, contact details, languages, opening hours, a description and photos.

This data comes from the professionals and organisations themselves or from sources they have made public, such as their own website. We publish a page only when it is marked as public, and we add it to our search index.

We rely on our contract with the professional or organisation, or on the legitimate interest of the public and of Katarina in finding health professionals (art. 6(1)(b) and (f) GDPR). A professional can ask us at any time through our contact page to correct the page or to take it offline.

When you write to us through the contact form, by email or by post, or ask for a demonstration, we process your name, your contact details, your organisation and your message to answer you. We rely on your request and on our legitimate interest in answering it (art. 6(1)(b) and (f) GDPR).

To book a video call, you can use our appointment schedule in the Video call tab of the contact page. It is a booking page of Google Calendar, a service of Google, and it loads only once you open that tab. Google then receives your IP address and data about your browser, and can set or read its own cookies. To book, you give Google your name, your email address, the time you choose and any other details the form asks for. Google sends you a confirmation with the Google Meet link and adds the appointment to our calendar. We use the booking to hold the call, on the same legal basis. Google's own privacy policy applies to the processing on its side.

If you subscribe to our newsletter, we add the email address of your account and your language to our mailing list at our email provider, Resend, to send it to you. We send it only with your consent (art. 6(1)(a) GDPR). Each newsletter contains a link to unsubscribe, which withdraws your consent.

Health data is sensitive personal data under the FADP and a special category of personal data under the GDPR. You may enter health data when you create health records, prepare a consultation or use other health features as they become available.

We process health data only to provide the feature you use, and only with your explicit consent (art. 9(2)(a) GDPR). You can withdraw your consent at any time; this does not affect the processing carried out before. You decide with whom you share your records.

We do not sell health data and do not use it for advertising. We do not use it to train AI models without your separate consent. Features marked as coming soon do not process health data. If you type a question in the consultation box before that feature is available, the text stays in your browser for the current tab and is not sent to us.

Katarina does not yet offer AI features that process your personal data. Before we introduce one, we update this policy to explain which data it uses, for which purpose and which providers process it.

We use the following providers to run Katarina:

Supabase, Vercel, Typesense, Resend and Twilio process data on our behalf, under contracts that bind them to our instructions, to confidentiality and to appropriate security. Google, Microsoft, CARTO and unpkg receive data as independent controllers; their own privacy policies apply.

Professionals and organisations receive your data only when you share it with them. We disclose data to authorities only when the law requires it. We do not sell personal data.

Our database is in Switzerland. Some providers process data in other countries, in particular the USA. Switzerland and the European Union recognise each other's data protection as adequate.

For a country without adequate protection, we rely on the provider's certification under the Swiss-U.S. or EU-U.S. Data Privacy Framework, or on the standard contractual clauses of the European Commission, adapted for Switzerland. You can ask us for a copy of these safeguards.

Deleted data can remain in backups until they are overwritten.

We protect personal data with technical and organisational measures suited to the risk. All connections are encrypted (HTTPS). We store passwords only in hashed form. Only the people who need personal data for their work can access it, and they are bound by confidentiality. We limit repeated attempts to sign in and to request codes.

No system is completely secure. If a security breach is likely to result in a high risk for you, we inform you and the competent authority as the law requires.

Under the FADP and, where it applies, the GDPR, you have the right to:

• know whether we process data about you, and receive a copy of it;
• have incorrect data corrected;
• have data deleted, or its processing restricted;
• object to processing based on our legitimate interests;
• receive the data you gave us in a common electronic format, or have it sent to another provider;
• withdraw your consent at any time, with effect for the future.

To exercise a right, write to dpo@katarinahealth.com, through our contact page or by post. We may ask you to prove your identity. We answer within 30 days, free of charge unless the law allows a fee.

We do not take decisions about you based solely on automated processing, and we do not build profiles for advertising.

If you think we process your data unlawfully, please tell us first so that we can put it right. You can also complain to a data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. In the European Union, it is the authority of the country where you live or work.

You must be at least 16 years old to create an account. A parent or legal representative can manage health records for a child. If you think that a child under 16 has given us personal data without this permission, please contact us so that we can delete it.

We update this policy when our processing changes, and publish each version on this page with its date. If a change is significant, we inform account holders by email or in the service.