Privacy notice
Last updated 24 August 2026
Who is responsible
The controller for this booking service is Prevenova GmbH, Baarerstrasse 19, 6300 Zug, Switzerland (Bindex bone scan service at Expopharm 2026, Hall A2 / Stand B43, Munich). Contact for all data protection matters: juho@boneindex.ch.
What we collect and why
To reserve a scan slot we collect your full name, organization and email address. Optionally you may provide date of birth, weight and height; together with the scan result these are health data (special category data under Art. 9 GDPR and the revised Swiss FADP). We use them solely to perform the measurement, calculate your reference values and send you your personal bone health report. For a pharmacy consultation we collect name, organization, email, optional phone number and your topic — no health data.
Legal basis
Health data is processed only on the basis of your explicit consent (Art. 9(2)(a) GDPR; Art. 6 revFADP), which you give with the consent checkbox on the booking form. Booking administration itself is based on Art. 6(1)(b) GDPR (steps taken at your request).
Where the data is hosted
Bookings are stored in a managed PostgreSQL database hosted in the European Union (Frankfurt, Germany). Confirmation emails are sent via an EU-based transactional email provider. No data is transferred outside the EU/EEA or Switzerland.
How long we keep it
Booking records and any health data you provided are deleted at the latest 90 days after the end of Expopharm 2026 (i.e. by 16 December 2026). Scan results are deleted once your report has been delivered, unless you ask us to keep them longer. Email delivery logs are kept for a maximum of 30 days.
Withdrawing consent and your rights
You can withdraw your consent at any time with effect for the future by emailing juho@boneindex.ch — we will delete your booking and any health data without undue delay. You also have the right to access, rectification, erasure, restriction, data portability and to object, and the right to lodge a complaint with a supervisory authority (in Germany, your state data protection authority; in Switzerland, the FDPIC).
No profiling, no marketing
We do not use your data for automated decision-making or profiling, and we do not send marketing emails or reminders on the basis of a booking. Data is never sold or shared with third parties other than the hosting and email providers acting as processors on our behalf.
Website data (boneindex.ch policy)
When you contact us via a form or email we collect your name and salutation, email address and phone number, company name and role, and the content of your message. When you visit our sites, our servers and analytics tools automatically record your IP address (anonymized where technically possible), browser type and version, operating system, referrer URL and pages visited, date and time of access, and visit duration and interaction data.
Purposes and legal bases
Answering enquiries and providing information about Bindex PRO (legitimate interest / pre-contractual steps); marketing communication to business contacts under B2B rules (legitimate interest, revocable at any time); website analytics to improve our offering (legitimate interest / consent via the cookie banner); compliance with legal obligations (legal obligation).
Third parties and data transfers
We use the following third-party services, which may transfer data to the USA. Transfers outside Switzerland/the EEA rely on Standard Contractual Clauses (SCC) or adequacy decisions. Google Analytics — Google LLC (USA), website traffic analysis with IP anonymization enabled; opt out via the browser add-on or our cookie banner. HubSpot — HubSpot Inc. (USA), CRM and marketing; HubSpot is certified under the EU-U.S. Data Privacy Framework.
Retention (website and CRM)
Contact enquiries: up to 3 years after last contact. CRM records (HubSpot): duration of the business relationship plus 3 years. Analytics data: 14 months (Google Analytics default). Invoices and accounting records: 10 years (Art. 958f Swiss CO).
Data security
We apply appropriate technical and organizational measures, including TLS encryption, access controls and regular security reviews. Complete security of transmission cannot, however, be guaranteed.
Links to third-party sites
We accept no responsibility for external linked sites. Please review their own privacy notices.
Changes
We may amend this notice. The current version of the group privacy policy is always available at boneindex.ch/privacy-policy.