Privacy policy
In accordance with the revised Swiss Federal Act on Data Protection (revFADP, effective since 1 September 2023) and the related ordinance.
1.Data controller
The data controller within the meaning of the revFADP is:
Poncura GmbHHerzogstrasse 22
3014 Bern
Switzerland
- datenschutz@poncura.ch
- UID number
- CHE-226.282.551
2.Scope and purpose of data processing
We process personal data exclusively within the scope of applicable law and only to the extent necessary to provide our services. Processing serves the following purposes:
- Employment and management of family caregivers as care staff
- Recording and documentation of care services (care reports)
- Billing with health insurers under KVG/LAMal Art. 25a
- Communication with users, patients, and relatives
- Quality assurance (four-eyes principle)
- Compliance with statutory retention obligations
3.Sensitive personal data (health data)
Important note
As part of our activities, we process health data which is considered sensitive personal data under revFADP Art. 5 lit. c. This includes:
- Care reports (type, duration, and description of care services)
- Care level and needs assessment
- Health condition and diagnoses (as relevant for care)
- Insurance identifiers (RCC/ZSR number, insurance card)
- Medication administration
We process this data only with your explicit consent (revFADP Art. 6 para. 7). This processing is necessary to provide contractual care services.
4.Legal basis
Processing of your data is based on the following legal grounds:
| Legal basis | Use case |
|---|---|
| revFADP Art. 6 para. 6 | Performance of contract (employment contract, care services) |
| revFADP Art. 6 para. 7 | Explicit consent (health data) |
| revFADP Art. 6 para. 3 | Legal obligations (social insurance, LAMal) |
| KVG/LAMal Art. 25a | Billing of care services with health insurers |
| CO Art. 328b | Employee data protection |
5.Data storage and security
Primary storage of personal data takes place in Switzerland:
- Cloud provider
- Amazon Web Services (AWS)
- Region
- eu-central-2 (Zürich, Switzerland)
- Encryption
- AES-256 (storage), TLS 1.3 (transmission)
- Authentication
- AWS Cognito (email/password with MFA option)
The following processors are additionally engaged:
| Processor | Purpose | Data |
|---|---|---|
| Skribble | Electronic signature | Name, e-mail, document to be signed |
| Infomaniak | E-mail delivery (SMTP) | Recipient address, notification content |
| Resend | E-mail delivery (invitations, transactional messages) | Recipient address, name |
| Amazon SES (AWS) | E-mail delivery for enquiries submitted on the website | Contact details entered in the form |
| Stripe | Payment processing for subscriptions | Billing and payment data |
| Google Analytics | Web analytics — only with consent | Usage data, truncated IP address |
For selected services (e.g. web analytics with consent), data transfers to additional countries may occur. Such transfers are carried out only in line with applicable data protection requirements and appropriate safeguards.
6.Recipients and data disclosure
Personal data is disclosed only to the following recipients where necessary for service provision or required by law:
- Health insurers – for billing care services under KVG/LAMal
- OASI/IV compensation offices – for social insurance registration
- Cantonal health authorities – within their supervisory mandate
- Qualified nursing professionals – for report validation (four-eyes principle)
- Technical processors (e.g. hosting, email, analytics with consent)
No disclosure to third parties takes place for advertising or marketing purposes.
7.Retention periods
| Data category | Period | Legal basis |
|---|---|---|
| Care reports | 10 years | CO Art. 958f (business records) |
| Billing data | 10 years | CO Art. 958f, KVG/LAMal |
| Employment contracts | 10 years | CO Art. 958f |
| Social insurance data | 10 years | AHVG Art. 41 |
| Contact data (account) | Until deletion | Consent / contract |
| Server log data | 90 days | Legitimate interest |
8.Your rights under revFADP
Swiss data protection law grants you the following rights:
Right of access
Art. 25 revFADP
You can request information about your stored data at any time.
Right to rectification
Art. 6 para. 5 revFADP
You can request correction of inaccurate data.
Right to erasure
Art. 6 para. 4 revFADP
You can request deletion of your data, unless retention obligations apply.
Data portability
Art. 28 revFADP
You can request delivery of your data in a common format.
Right to object
Art. 30 para. 2 lit. b revFADP
You can object to data processing at any time.
Right to complain
Art. 49 revFADP
You can file a complaint with the FDPIC.
To exercise your rights, please contact us at: datenschutz@poncura.ch
9.Cookies
This website uses technically necessary cookies. In addition, analytics cookies (Google Analytics) are enabled only if you explicitly consent in the consent banner.
| Cookie | Purpose | Duration |
|---|---|---|
| CognitoIdentityServiceProvider.* | Authentication (AWS Cognito) | 1 hour |
| __next_* | Session management (Next.js) | Session |
| _ga, _ga_* | Web analytics (Google Analytics) only with consent | up to 13 months |
10.Competent supervisory authority
The competent data protection supervisory authority in Switzerland is:
FDPIC – Federal Data Protection and Information Commissioner
Feldeggweg 1, 3003 Bern
Other relevant authorities
- ↗Central Compensation Office (CCO)
Responsible for OASI/IV billing and social insurance coordination
- ↗FOPH – Federal Office of Public Health
Regulation of mandatory health insurance (KVG/LAMal)
11.Changes to this privacy policy
We may update this privacy policy if legal or operational changes require it. The current version is always available on this page. If changes are material, registered users are informed by email.
12.Contact for privacy questions
For questions, access requests, or complaints regarding data protection, please contact:
Poncura GmbH – DatenschutzHerzogstrasse 22
3014 Bern
datenschutz@poncura.ch
Last updated: February 2026