ALPENREICH
Privacy Policy
1. Controller
Patrick Mausfeld-Lafdhiya, trading as ALPENREICH, Kieler Str. 31, 24229 Schwedeneck, Germany, email contact@alpenreich.ch, telephone +4915129838287, is controller for the processing described here.
2. Scope and applicable frameworks
This notice covers alpenreich.ch, inquiries and ALPENREICH access-coordination activities. GDPR applies to processing in the context of the German establishment. Swiss data-protection law may also apply where its territorial rules are met. A Swiss clinic normally provides its own notice for its separate treatment and admission processing.
3. Initial website inquiries
The initial website form asks for your name, email address, area of interest, a brief message of up to 500 characters and acknowledgement of the Privacy Policy. The application also records the submission reference, acknowledgement wording and time, source, delivery/security metadata and processing status. We use this information to reply, consider whether the request falls within scope, prevent misuse and document the exchange. The usual basis is Article 6 paragraph 1 points b and f GDPR. Our legitimate interests are secure business communications, service scoping and legal evidence. Please do not include diagnoses, reports, test results, medication details or other sensitive medical information in this form.
4. Separate health-data pathway
Medical records are not requested through the initial website form. If a selected task requires symptoms, diagnoses, records, genetics, medications, treatment history or other health information, we first establish a separate health-data authorisation and a suitable transfer method. We process only the selected information for the authorised purposes, based on explicit consent under Articles 6 paragraph 1 point a, 7 and 9 paragraph 2 point a GDPR. If another lawful basis applies, we explain it before processing. A representative must show authority. Unnecessary information about relatives should be removed where feasible.
5. Information from other sources
We may receive information from your authorised representative, a clinic, hospital, physician, laboratory, interpreter or other person you identify. We record the source and provide Article 14 information within the applicable period unless an exception applies and is documented. Clinics may send us limited administrative status or payment information; we do not request clinical outcomes unless separately necessary and authorised.
6. Case-related purposes and data
Purposes include inquiry handling, service qualification, case opening, record collection and organisation, published-evidence research, question preparation, introductions, appointment and travel coordination, communications, conflict disclosure, security, consent and authorisation evidence, complaint handling, and legal compliance. Data may include identity, contact, authority, language, general preferences, case instructions, health data when selected, provider communications, appointment details, travel preferences, administrative status, clinic payment status relevant to the disclosed institutional fee, security logs, and legal records.
7. Recipients and access
Recipients may include specifically authorised Swiss clinics and hospitals, treating professionals, laboratories, interpreters, travel or logistics providers for non-medical details, professional advisers, authorities where legally required, and service providers for hosting, communication, document storage, signature and security. We disclose only data reasonably necessary for the purpose. Medical providers are generally independent controllers for their own care and records. Website inquiry contents are restricted in the application to explicitly authorised accounts. Other technical administrators see anonymous counts. The website form does not automatically forward the inquiry contents to WhatsApp, advertising platforms or an AI service.
8. Website storage and business systems
Initial website inquiries are stored in the configured website database. ALPENREICH uses Google Workspace Business Starter for business Gmail and Drive and encrypted local laptop storage. The website form does not automatically send submitted contents to Gmail or Drive.
9. International transfers
Transfer to Switzerland may rely on the European Commission adequacy framework while it remains effective and within scope. Vendors or recipients in other countries require a valid Chapter V mechanism, such as an adequacy decision or Article 46 safeguards, plus any necessary transfer assessment and supplementary measures. Article 49 derogations and explicit transfer consent are exceptional, not the standard operating model.
10. Retention
Basic inquiries that do not proceed are normally deleted or anonymised after 12 months. Health intake and coordination records are used during the active case and kept with restricted access for three years after closure. Contracts, invoices and tax records may require longer statutory retention. Consent, disclosure, complaint and legal-claim evidence may be retained for the applicable limitation or defence period. Litigation holds, security incidents and legal duties may suspend deletion. Contact contact@alpenreich.ch for a retention or erasure request concerning your information.
11. Security and medical records
The application restricts access to inquiry contents and uses measures to prevent misuse. No transmission is guaranteed secure. Do not send health records through a general website form or an unapproved channel. If sensitive information is accidentally included, contact contact@alpenreich.ch without resending the records so that the appropriate handling can be arranged.
12. Rights and withdrawal
Subject to legal conditions, you may request access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time for future processing. Send requests to contact@alpenreich.ch. We may verify identity proportionately and will record and propagate valid requests. You may complain to a competent data-protection authority. The authority competent for the German establishment may be contacted.
13. Required and optional information
The website form marks the name, email, area of interest, brief message and Privacy Policy acknowledgement as required for an initial submission. Health records are not required for that inquiry and should not be sent through it. A separately authorised task may require additional information. Refusing optional analytics does not prevent use of an otherwise available inquiry form.
14. Automated processing
The website inquiry workflow does not make clinical decisions or decisions producing legal or similarly significant effects solely by automated processing. Inquiries are reviewed personally. Automated validation and abuse prevention support the form.
15. Children and representatives
The service is not directed to children acting alone. A parent, guardian, health-care proxy or other representative must provide evidence of authority. Where the individual can participate in the decision, their wishes and applicable consent rules must be addressed.
16. Changes
We date and version this notice. Material changes affecting an active case will be communicated through an appropriate channel. A new legal basis or incompatible purpose will not be created merely by editing this notice.
17. Essential sessions and privacy preferences
Essential session cookies support form security and administrator sign-in. The application uses PHPSESSID and ci_session for these purposes. Native session-cookie lifetime follows the deployed PHP session configuration; the current framework session setting is 120 minutes. The alpenreich_preferences cookie remembers an optional-analytics choice for 180 days. It contains an opaque receipt; the database stores its hash, choice, policy version and dates. The cookie is used to remember acceptance or rejection.
18. Optional first-party analytics
Optional analytics start after acceptance and can be rejected or withdrawn through Privacy settings in the footer. Measurement uses pseudonymous browser and visit keys, general page paths, device categories, CTA locations, form-start/error identifiers, successful-submission events and legal-link destinations. It does not record names, email addresses, entered messages or the selected service area. New referrer values are not collected. This website implementation uses self-hosted fonts and images and does not include active GA4, Google Ads, external map/video/scheduling or session-replay integrations.
Return to homepage