Skip to content

Swiss nDSG Addendum

Version: 2026-10-28 · Supplement to the RehabPilot DPA

This Addendum forms part of the RehabPilot Data Processing Agreement (German: AVV) for Clinics established in Switzerland.

1. Interpretation

Where Swiss law applies, references to the GDPR in the DPA are read mutatis mutandis under the Swiss Federal Act on Data Protection (nDSG) and ordinance. The Clinic remains the controller (Verantwortlicher); RehabPilot is the processor (Auftragsbearbeiter).

2. Processor obligations

Processing is limited to the purposes and categories in DPA Annex A, on the Clinic’s instructions, with TOMs in Annex B and sub-processors in Annex C.

3. Cross-border disclosure

Cross-border disclosure follows the DPA transfer section and applicable Swiss rules on disclosure abroad, using appropriate safeguards where required.

4. Key DPA commitments that apply

The following commitments of the DPA (version 2026-10-28) apply in full to Swiss Clinics, read mutatis mutandis under the nDSG; the duty of professional secrecy under Art. 321 Swiss Criminal Code is treated in the same way as Section 203 German Criminal Code (StGB) under DPA Section 4 (not to be confused with the Swiss Criminal Code):

  • Access only on instruction: RehabPilot accesses content data only on the express, documented request of an authorised Clinic administrator in the individual case, or in an acute security emergency with notice to the Clinic afterwards, and never uses or discloses Clinic or patient data for its own purposes (DPA § 3a).
  • Confidentiality: all persons involved are bound to secrecy in writing and informed of the criminal consequences of a breach; this obligation is passed on to sub-processors (DPA § 4).
  • Infrastructure: application hosting (including the web app), databases, key management and email delivery at Amazon Web Services (Frankfurt), media storage and network protection at Cloudflare, each holding a BSI C5 attestation; hosting in Germany/EU. The website rehabpilot.org is hosted by Hetzner Online GmbH in Germany, which does not process and has no access to practice or patient data of the app; the attestations apply to these providers, not to RehabPilot itself (DPA § 5). Media is always encrypted before upload; this cannot be switched off.
  • Sub-processors: each sub-processor is contractually bound to obligations equivalent to the DPA; RehabPilot remains responsible for them; changes are announced at least 14 days in advance with a right to object (DPA § 6).
  • Breach notification: without undue delay and at the latest within 48 hours of becoming aware, with the information available at that time and follow-up without undue delay; emergency suspension of access on reasonable suspicion of an acute security threat, with notice to the Clinic (DPA § 8).
  • Retention: automatic deletion of patient and therapy data 10 years after the patient’s last activity (a different period or exclusion of individual patients on the Clinic’s instructions), of in-app messages after 30 days and of completion records and workout ratings after 180 days; otherwise deletion on the Clinic’s instructions; no automatic deletion at the end of the contract (DPA Annex A, § 8).
  • Audits: information, audits and inspections as set out in DPA § 9.

5. Precedence

For Swiss Clinics, this Addendum prevails over the DPA on nDSG-specific points. The United States is not currently served.

Contact: [email protected]