Privacy Policy

Version of 16.07.2026

In this Privacy Policy, we, Qualitheke GmbH (hereinafter also "we" or "us"), explain how we collect and otherwise process personal data, in particular when you visit our website, in connection with the use of the digital online solution "eviflow", and when providing consulting services. This is not an exhaustive description; where applicable, other privacy policies or similar documents govern specific matters. Personal data means all information relating to an identified or identifiable person.

If you provide us with personal data of other persons (e.g. family members, data of work colleagues), please ensure that these persons are aware of this Privacy Policy and only share their personal data with us if you are authorised to do so and if this personal data is correct.

This Privacy Policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR") and the Swiss Federal Act on Data Protection ("FADP"). However, whether and to what extent these laws apply depends on the individual case.

1. Responsible body

The body responsible for the data processing described here is:

Qualitheke GmbH
c/o University of Basel
Pharmaceutical Sciences
Spitalstrasse 41
4056 Basel

info@qualitheke.ch or info@eviflow.ch

If you have any data protection concerns, you can contact us at the address given above. Unless otherwise stated in an individual case, you can also contact us at this address with questions relating to eviflow. In this regard, please also note the information under section 11.

2. Collection and processing of personal data

As part of the use of eviflow, we collect and process in particular contact and contract data of the pharmacies and their contact persons, insofar as this is necessary for the provision of our services. This data includes in particular the following information: name, e-mail address and telephone number of the contact person, name, address and e-mail address of the pharmacy.

Users of eviflow can in particular record the case and progress data required for documenting the service, such as age or symptoms, on eviflow. The respective responsible pharmacy can access this data insofar as this is necessary for the use of eviflow, the provision of the corresponding pharmaceutical services and documentation.

Insofar as usage, case and progress data are processed within eviflow, the respective pharmacy is generally responsible for the lawful collection, entry and processing of this data. Qualitheke processes this data as a processor on behalf of and in accordance with the instructions of the respective pharmacy, and on the basis of a corresponding data processing agreement. Qualitheke has no access to the key required for re-identification and can therefore generally not attribute this data to any specific person. Processing by Qualitheke is carried out in particular for the provision, operation, maintenance, troubleshooting and further development of eviflow. See also section 3 in this regard.

In addition, we process personal data that we receive from our customers and other business partners as well as other persons involved therein in the course of our business relationship, or that we collect from users when operating our websites, apps and other applications.

Insofar as this is permitted, we also obtain certain data from publicly accessible sources (e.g. debt collection registers, land registers, commercial registers, the press, the internet) or receive such data from authorities or other third parties (such as credit agencies, address dealers).

In addition to the data you provide directly, the categories of personal data that we receive about you from third parties include in particular:

  • Information from public registers
  • Information that we learn in connection with official and judicial proceedings
  • Information in connection with your professional functions and activities (e.g. in order to conclude and process transactions with your employer with your help)
  • Information about you in correspondence and meetings with third parties
  • Information about you provided to us by persons in your environment (family, advisers, legal representatives, etc.) in order to conclude or process contracts with you or involving you (e.g. references, your address for deliveries, powers of attorney)
  • Information for compliance with legal requirements (e.g. anti-money laundering, export restrictions)
  • Information from banks, insurers, distribution and other contractual partners of ours regarding the use or provision of services by you (e.g. payments made, purchases made)
  • Information about you from media and the internet (insofar as this is appropriate in the specific case, e.g. as part of a job application, press review, marketing/sales, etc.)
  • Your addresses and, where applicable, interests as well as other sociodemographic data (for marketing)
  • Data in connection with the use of the website (e.g. IP address, MAC address of the smartphone or computer, information about your device and settings, cookies, date and time of the visit, pages and content accessed, functions used, referring website, location data).

3. Purposes of data processing and legal bases

We process your personal data primarily in order to conclude and perform our contracts with you within the scope of the digital online solution eviflow, for the provision and operation of eviflow, and for support and troubleshooting.

With your express consent, we also use your contact data for the occasional sending of information about projects, events or studies relating to pharmaceutical practice.

In addition, insofar as this is permitted and appears appropriate to us, we also process personal data for the following purposes in which we (and sometimes also third parties) have a legitimate interest:

  • Offering and further developing our offerings, services, websites, apps and other platforms on which we are present.
  • Communicating with pharmacies and third parties and processing enquiries (e.g. job applications, media enquiries).
  • Reviewing and optimising procedures for needs analysis for the purpose of directly approaching customers, as well as collecting personal data from publicly accessible sources for customer acquisition.
  • Advertising and marketing (including holding events), insofar as you have not objected to the use of your data. If we send you advertising as an existing customer, you can object to this at any time, and we will then place you on a blocking list against further advertising mailings.
  • Market and opinion research as well as media monitoring.
  • Asserting legal claims and defending ourselves in legal disputes and official proceedings.
  • Preventing and investigating criminal offences and other misconduct (e.g. internal investigations, data analyses to combat fraud).
  • Ensuring our operations, in particular IT, our websites, apps and other platforms.
  • Measures for IT, building and plant security, including access controls, visitor lists, network and mail scanners as well as video surveillance to safeguard our house rules and to protect employees, other persons and assets entrusted to us.
  • Purchase and sale of business divisions, companies or parts thereof as well as other corporate transactions associated with the transfer of personal data, and measures for business management as well as compliance with legal and regulatory obligations.

Insofar as you have given us consent to process your personal data for certain purposes (e.g. when you register to receive newsletters or to carry out a background check), we process your personal data within the scope of and on the basis of this consent, unless we have another legal basis. Consent that has been given can be revoked at any time, without affecting data processing that has already taken place.

4. Cookies / tracking and other technologies in connection with the use of our website

On our websites, we typically use "cookies" and comparable techniques by which your browser or device can be identified. A cookie is a small file that is sent to your computer or automatically stored by the web browser used on your computer or mobile device when you visit our website. When you access this website again, we can thereby recognise you again, even if we do not know who you are.

In addition to cookies that are used only during a session and deleted after your website visit ("session cookies"), cookies can also be used to store user settings and other information over a certain period of time (e.g. two years) ("permanent cookies").

Purposes of cookies

Our website uses cookies for the following purposes:

  • Necessary cookies: These cookies are required for the operation of the website and enable basic functions such as page navigation and access to protected areas of the website.
  • Analytical cookies: These cookies help us to understand the use of our website and to optimise its performance. They provide anonymised information about visitor behaviour so that we can improve the user experience.

Extended use of cookies

We use permanent cookies to:

  • store your user settings (e.g. language, auto-login).
  • better understand how you use our offerings and content.

Settings and control

You can set your browser to reject cookies, to store them only for one session or to delete them prematurely. Please note that disabling cookies can impair the functionality of our website (e.g. language selection, order processes).

5. Data disclosure and data transfer

As a matter of principle, we only disclose your personal data if this is necessary for the performance of our services, is legally required, or has been expressly permitted by you.

Within eviflow, users enter their data themselves. The respective pharmacy can access this data insofar as this is necessary for the use of eviflow, the provision of the corresponding pharmaceutical services and documentation. Qualitheke provides the technical platform and processes the data as a processor on behalf of and in accordance with the instructions of the respective pharmacy, and on the basis of a corresponding data processing agreement. See also section 2 above in this regard.

Disclosure to other third parties only takes place:

  • with your express consent,
  • if we are legally obliged to do so, or
  • if this is necessary within the scope of our business activities and is in line with the purposes stated under section 3.

In these cases, data may in particular be disclosed to the following recipients:

  • External service providers: including IT providers and cloud service providers
  • Authorities and courts: domestic and foreign bodies, insofar as legally required.
  • Other business partners: including dealers, suppliers, subcontractors as well as customers.
  • Media and the public: within the scope of legal requirements or in the case of generally accessible information.

The recipients may be located domestically or abroad. Both the website and eviflow are hosted in Switzerland.

If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection (for this purpose we use the revised standard contractual clauses of the European Commission, which are available here), insofar as it is not already subject to a legally recognised set of rules to ensure data protection and we cannot rely on an exception provision. An exception may apply in particular in the case of legal proceedings abroad, but also in cases of overriding public interests or where the performance of a contract requires such disclosure, where you have consented, or where the data is data that you have made generally accessible and whose processing you have not objected to.

6. Duration of retention of personal data

We process and store your personal data for as long as is necessary for the performance of our contractual and legal obligations or otherwise for the purposes pursued with the processing, i.e. for example for the duration of the entire business relationship (from the initiation and handling through to the termination of a contract) as well as beyond that in accordance with the statutory retention and documentation obligations. It is possible that personal data will be retained for the period during which claims can be asserted against our company and insofar as we are otherwise legally obliged to do so or legitimate business interests require it (e.g. for evidentiary and documentation purposes). As soon as your personal data is no longer required for the above-mentioned purposes, it is generally deleted or anonymised as far as possible. For operational data (e.g. system logs, logs), shorter retention periods of twelve months or less generally apply.

7. Data security

We take appropriate technical and organisational security measures to protect your personal data against unauthorised access and misuse, such as the issuing of directives, training, IT and network security solutions, access controls and restrictions, encryption of data carriers and transmissions, pseudonymisation and further controls.

8. Obligation to provide personal data

In the course of our business relationship, you must provide those personal data that are necessary for the establishment and conduct of a business relationship and the performance of the associated contractual obligations (as a rule, you are not under a legal obligation to provide us with data). Without this data, we will generally not be in a position to conclude or perform a contract with you (or the body or person you represent). The website can also not be used if certain information required to ensure data traffic (such as the IP address) is not disclosed.

9. Profiling

We may evaluate usage data of our website and our services in order to improve our offerings and, where there is an appropriate basis, to inform you in a targeted manner about our services. In connection with eviflow, we do not use profiling that has legal effects for you or similarly significantly affects you. Likewise, we do not make any fully automated decisions with such effects.

Should we use profiling or automated decision-making procedures in the future, we will inform you of this in an appropriate manner insofar as this is legally required.

10. Social media

We may operate pages and other online presences on social networks and other platforms operated by third parties and, in this context, process data about you. In doing so, we receive data from you (e.g. when you communicate with us or comment on our content) and from the platforms (e.g. statistics). The providers of the platforms can analyse your usage and process this data together with other data they have about you. They also process this data for their own purposes (e.g. marketing and market research purposes and to manage their platforms) and, for this purpose, act as controllers in their own right. For further information on processing by the platform operators, please refer to the privacy policies of the respective platforms.

On our website, we may use so-called plug-ins from social networks. This is always apparent to you (typically via corresponding symbols). We have configured these elements so that they are deactivated by default. If you activate them (by clicking), the operators of the respective social networks can register that you are on our website and where, and can use this information for their purposes. The processing of your personal data then takes place under the responsibility of that operator in accordance with its data protection provisions. We receive no information about you from it.

We currently use the following platform, whereby the identity and contact details of the platform operator are in each case available in its privacy policy: LinkedIn; privacy policy: https://de.linkedin.com/legal/privacy-policy.

We are entitled, but not obliged, to review third-party content before or after its publication on our online presences, to delete content without notice and, where applicable, to report it to the provider of the platform concerned.

11. Rights of the data subject

Within the scope of the data protection law applicable to you and insofar as provided for therein (such as in the case of the GDPR), you have the right to information, rectification, erasure, the right to restriction of data processing, and otherwise to object to our data processing, in particular that for the purposes of direct marketing, profiling carried out for direct advertising and further legitimate interests in the processing, as well as to the release of certain personal data for the purpose of transfer to another body (so-called data portability).

Please note that, in connection with eviflow, Qualitheke is not able to identify users on the basis of the usage, case and progress data processed in eviflow, since Qualitheke has no access to the re-identification key required for this. Requests for erasure, rectification or other exercise of data subject rights in relation to this data must therefore, as a matter of principle, be addressed to the respective responsible pharmacy.

Please note, however, that we reserve the right to assert the restrictions provided for by law on our part, for example where we are obliged to retain or process certain data, have an overriding interest in doing so (insofar as we are permitted to rely on this) or need it for the assertion of claims.

If costs arise for you, we will inform you in advance. We have already informed you about the possibility of revoking your consent in section 3. Please note that the exercise of these rights may conflict with contractual arrangements and that this may have consequences such as the premature termination of the contract or cost consequences. In such cases, we will inform you in advance, where this is not already contractually regulated.

The exercise of such rights generally requires that you clearly prove your identity (e.g. by a copy of your ID, where your identity is otherwise not clear or cannot be verified). To assert your rights, you can contact us at the address given in section 1.

Every data subject also has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent data protection authority of Switzerland is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

12. Changes

We may amend this Privacy Policy at any time without prior notice. The respective current version published on our website applies. Insofar as the Privacy Policy is part of an agreement with you, we will inform you of the change by e-mail or in another appropriate manner in the event of an update.