Privacy Policy

Last updated: 3 August 2026

1. Controller

The party responsible for processing the personal data collected on this website is:

Please direct any question about data protection, and any request to exercise your rights, to that address. No data protection officer has been appointed; a practice of this size is not required to have one.

2. Legal basis

Processing is governed by the Swiss Federal Act on Data Protection (revFADP). For visitors from the European Economic Area the General Data Protection Regulation (GDPR) applies in addition. The basis that applies is named separately for each purpose below.

3. What this website does not do

Because a great many privacy policies describe the opposite, stated explicitly:

• No analytics service is embedded – no Google Analytics, no Matomo, no tracking pixel, and no traffic measurement by the hosting provider.
• No advertising tracker is embedded – no conversion pixels, no retargeting scripts, no social media plugins.
• No captcha is embedded – including no Google reCAPTCHA. The forms' spam protection runs entirely on this site's own server (see section 6).
• No cookies are set while you are simply browsing the site. That is also why there is no cookie banner: there would be nothing to consent to.
• Fonts and images are served from this site's own server, not from a third-party CDN.

Loading a page opens no connection to any third party. The single exception is the map, and only if you ask for it yourself – see section 7.

4. Server logs

Each time a page is requested, your browser transmits technically necessary information that the hosting provider records in log files:

• IP address of the requesting device
• date and time of the request
• name and path of the file requested
• volume of data transferred and status code
• browser type, browser version and operating system
• the previously visited page, where sent (referrer)

Purpose: delivering the website, operational security, and investigating faults or attacks.
Basis: legitimate interest in secure and reliable operation (Art. 31(1) revFADP; Art. 6(1)(f) GDPR).
Retention: according to the hosting provider's own periods, typically a few days to a few weeks.

These logs are not analysed to trace the behaviour of individual people, and they are not combined with any other data.

5. Appointment requests through the contact form

When you submit the contact form, the following is processed: name and first name, telephone number, e-mail address, and where given your address and postcode/town, preferred date, type of massage or therapy, together with the text of your message.

Purpose: handling your enquiry, arranging and carrying out the appointment.
Basis: pre-contractual steps and performance of the treatment contract (Art. 31(2)(a) revFADP; Art. 6(1)(b) GDPR).
Retention: as long as the treatment and statutory retention obligations require.

Health information

The message field is free text, and many enquiries include details of complaints, injuries or pre-existing conditions. Such details are sensitive personal data (Art. 5(c) revFADP) and health data within the meaning of Art. 9 GDPR.

You are under no obligation to describe your health in the form – a single keyword is enough to arrange an appointment, and everything else can be discussed in person. If you do include such details, processing rests on your consent given by submitting the form (Art. 6(7) revFADP; Art. 9(2)(a) GDPR) and on the purposes of health care and treatment (Art. 9(2)(h) GDPR). The treatment itself is additionally covered by professional confidentiality.

Delivery by e-mail

The form entries are delivered as an e-mail to info@flexmassage.ch. Delivery uses Resend, operated by Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA, acting as a processor. Your form entries are therefore transferred to the United States.

The transfer relies on the European Commission's Standard Contractual Clauses and on the adequacy decision for the EU-U.S. Data Privacy Framework and its Swiss extension. Resend's privacy policy: resend.com/legal/privacy-policy.

If you would rather avoid that transfer, you can reach me just as well by telephone on +41 77 957 43 12, on WhatsApp, or in person at the practice.

6. Guestbook

You may leave an entry in the "Reviews" section. Exactly two pieces of information are processed: the name your entry is to appear under, and the text of the entry. No e-mail address, no postal address and no other identifier is collected – a guestbook does not need them.

Purpose: publishing your feedback on this website.
Basis: your explicit consent given through the checkbox in the form (Art. 6(6) revFADP; Art. 6(1)(a) GDPR).
Retention: until you withdraw that consent.

Your entry does not appear straight away. It is first stored with the content management service Sanity (see section 10) and released only after it has been read in person. If it is not released, it is deleted. You may withdraw your consent at any time without formality – a message to info@flexmassage.ch is enough and the entry will be removed.

Please bear in mind that a guestbook entry is publicly visible. Choose the name and the content as you would when speaking to a stranger, and do not disclose anything about your health there that you would not want read in public.

Spam protection

To keep automated programs from abusing the forms, four checks run on this site's own server when you submit. One of them processes personal data and is therefore disclosed here: to limit how many entries can come from one connection, an irreversible check value (HMAC-SHA256) is derived from your IP address and counted. The IP address itself is not stored and cannot be reconstructed from that value. The counters are deleted after 24 hours at the latest.

Basis: legitimate interest in preventing abuse (Art. 31(1) revFADP; Art. 6(1)(f) GDPR).

7. Map (Google Maps)

The "Location" section contains a map. It is not embedded when the page loads: a button appears in its place, and no connection to Google is made.

Only when you click that button is the map loaded from Google. Google then receives your IP address and further information from your browser, and where you are signed in to a Google account it can attribute the request to that account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Basis: your consent given by clicking the button (Art. 6(6) revFADP; Art. 6(1)(a) GDPR).
Google's privacy policy: policies.google.com/privacy.

If you do not click the button, that transfer does not happen. The practice address is printed in plain text beside the map in any case.

8. Links to other services

This website links to external pages, among them the therapist directories of EMR and ASCA, the SVMM association, and Facebook and Instagram. These are ordinary links, not embedded content: no social media plugin is loaded and no data leaves this site unless you click such a link yourself. Processing on the linked pages is the responsibility of their respective providers.

9. Cookies

No cookie is set for visitors to this website.

10. Recipients

Your data is not sold and not passed on for advertising purposes. Access is limited to:

• the hosting provider, which delivers the website and keeps the server logs described in section 4;
• Resend, Inc. for delivering the form e-mails described in section 5;
• Sanity (sanity.io/legal/privacy) for storing the guestbook entries described in section 6 and the content of this website;
• Google Ireland Limited, if you request the map yourself as described in section 7.

Any disclosure beyond this happens only where the law requires it.

11. Your rights

Within the scope of the applicable law you have in particular the right to:

• access – to learn whether and what data about you is processed;
• rectification of inaccurate data;
• erasure of your data, unless a retention obligation stands in the way;
• withdrawal of a consent you have given, with effect for the future;
• objection to processing that rests on legitimate interest;
• release or portability of your data in a common electronic format;
• restriction of processing.

An informal message to info@flexmassage.ch is enough. Exercising these rights is free of charge.

12. Complaints

If you believe that the processing of your data breaches the applicable law, you may complain:

• in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern – edoeb.admin.ch;
• in the EEA to the supervisory authority of your country of residence.

Raising it with me first is welcome but not a precondition.

13. Data security

The website is served exclusively over an encrypted connection (HTTPS), so what you type into a form cannot be read in transit. The content and the guestbook entries are managed in a password-protected Sanity account.

14. Changes

This policy is updated whenever something changes on the website or in the law that affects it. The version published here, bearing the date given above, is the one that applies.