ZoneIn AG – Version of Oct 1, 2026
Last updated: October 1, 2026
This Privacy Policy (the "Privacy Policy") explains how we process and protect your personal data when you use the services offered on our website (www.zonein.ch) or this app (together, the "Platform") (together, "our Services").
The website is operated by ZoneIn AG, Lerchenfeldstrasse 3, 9014 St. Gallen, Switzerland (the "Company", the "Firm", "we", "our" or "us"). The Company is the controller responsible for the data processing described below. The professionals are themselves responsible for the data they receive in order to conduct the sessions (see section 5).
Unless otherwise defined in this Privacy Policy, the definitions used in this Privacy Policy have the same meaning as in the Swiss Federal Act on Data Protection ("FADP") or the EU General Data Protection Regulation ("GDPR").
We have appointed a representative for the EU pursuant to Article 27 GDPR. If you use our Services from the EU, you may contact Renato Rao:
by email at: renato.rao@zonein.ch
by post at: ZoneIn AG, Lerchenfeldstrasse 3, 9014 St. Gallen
You may also contact our data protection officer at any time with any questions concerning data protection. You can reach the data protection officer by email at: info@zonein.ch.
When you register with us as a user, we ask you for the following information:
You are not obliged to provide your personal data. Please note, however, that our Services cannot be provided if you do not provide the data that is strictly necessary for the performance of the contract between you and us.
If you enter information concerning your emotional well-being or other information from which conclusions may be drawn about your mental health or state of health, we process this data exclusively with your express consent.
You grant this express consent (Art. 6(7) FADP) separately when you enter your concerns (e.g. when booking an appointment) or once before you use the chat with an expert, i.e. separately from accepting this Privacy Policy and the Terms of Use. We record the time and version of your consent. You may withdraw your consent at any time with effect for the future by writing to us at info@zonein.ch (see section 9). As matching and counselling require the processing of this data, you cannot use the Platform without this consent or after it has been withdrawn.
This data is processed only to provide the service and, where separately indicated and approved by you, to improve the Platform.
The chat function is intended for organisational communication with your professional. Please do not discuss health-related topics in the chat; discuss them in the video session instead.
If you contact us as a professional with the intention of joining the Platform or obtaining information about joining it, we will ask you for a range of personal data. This data is used to process your enquiry and, where applicable, to list you on our Platform and thereby provide our Services. Please note that this data is publicly accessible. In particular, the data includes:
When you use our Services, we collect data about how you access and use our Services (the "Usage Data"). This Usage Data is sent by your browser each time you visit our website and may include the following information:
This Usage Data is collected to provide, maintain and improve our Platform and your user experience.
We and our partners (e.g. our advertising and analytics partners) use cookies and related tracking technologies to track your use of our Services and collect certain data. Further information is provided in section 10 of this Privacy Policy.
Other users of our Services may provide personal data about you when they contact us. For example, data about you may be shared with us in connection with a support request submitted by another user. We use this data to process the relevant enquiries from other users.
We may receive data about you and your activities on and outside our website from our partners (e.g. our advertising and analytics partners). This enables us to receive information about your interests and activities in connection with our Services. We may use this data to improve and advertise our Services and your user experience.
Employees of business customers (e.g. employers) may use the Platform as part of an offering provided by their employer. In this context, we conduct surveys on your well-being before and after the support (check-ins) in order to measure the effect of the support. As this information may allow conclusions to be drawn about your state of health, we process it in the same way as the other health-related data described in section 1.1.1.
Your employer receives only anonymised or aggregated evaluations. Individual data, the content of conversations and health information about you are not disclosed to your employer.
We collect information about our users when they use our Services, including when they take certain actions on our website.
Directly
Indirectly
Our legal basis for collecting and using the personal data described in this Privacy Policy depends on the personal data we collect and the specific purposes for which we collect it.
Contract: To fulfil our (pre-)contractual obligations or take steps in connection with a contract with you. In particular:
Consent: We may rely on the consent you voluntarily give when providing your personal data. In particular:
Legitimate interests: We may rely on legitimate interests based on our assessment that the processing is fair and appropriate and that your interests or fundamental rights and freedoms do not override them. In particular:
Necessity for compliance with legal obligations: To comply with legal obligations and obligations in the public interest. In particular:
We retain personal data for as long as it is required for the purposes for which it was collected and in accordance with legal and regulatory requirements or contractual agreements. After this period has expired, we delete or fully anonymise your personal data.
We engage third-party companies (the "Service Providers") to facilitate the operation of our Services, assist in analysing the use of the Services or provide necessary services such as payment and IT services. These third parties have access to your personal data only to the extent necessary to perform these tasks.
Types of Service Providers that may access your personal data:
The technical Service Providers we use are listed, together with their registered office and place of processing, in section 10.1.
Professionals: When you book a session with a professional, the professional receives the data required to conduct the session. The professionals work independently and are independently responsible (as controllers) for processing this data. We provide the Platform as a technical intermediary.
We and/or our Service Providers may transfer your personal data to and process it in the following locations:
We may use Service Providers that are located in or process personal data in so-called third countries (outside the European Union or the European Economic Area or Switzerland), i.e. in countries whose level of data protection does not correspond to that of the EU or Switzerland.
We protect your personal data in accordance with our contractual obligations and applicable data protection laws when we transfer data abroad.
Such safeguards may include:
If a transfer to a third country takes place and there is no adequacy decision or suitable safeguards, it is possible and there is a risk that authorities in the third country (e.g. intelligence services) may gain access to the transferred data and that the rights of data subjects may not be enforceable.
We may disclose your personal data where we believe in good faith that such action is necessary:
We use appropriate technical and organisational security measures to protect your stored data against manipulation, loss or unauthorised access by third parties. Our security measures are continuously adapted in line with technological developments.
We also take internal data protection very seriously. Our employees and the Service Providers we engage are obliged to maintain confidentiality and comply with applicable data protection laws. In addition, they are granted access to personal data only to the extent necessary to perform their respective duties or engagement.
The security of your personal data is important to us, but please remember that no method of transmission over the internet or electronic storage is 100 % secure. Although we endeavour to protect your personal data using commercially reasonable means, we cannot guarantee absolute security. We recommend using antivirus software, a firewall and other similar software to protect your system.
You have the following data protection rights. To exercise these rights, you may contact us at the address above or send an email to: info@zonein.ch. We respond to such requests within 30 days. Please note that we may ask you to verify your identity before responding substantively to such requests.
Our Services use cookies and similar technologies (collectively, the "Tools"), which are provided either by us or by third parties.
A cookie is a small text file stored on your device. Comparable technologies include web storage (local / session storage), fingerprinting, tags or pixels. Most browsers are configured by default to accept cookies and similar technologies. However, you can generally configure your browser to reject cookies or similar technologies or to store them only with your prior consent. If you reject cookies or similar technologies, you may not be able to use all our Services without difficulty.
The Tools we use are listed below by category, with information in particular about the providers of the Tools, the retention period and their purpose. Where personal data is transferred to third countries, we refer to section 6 of our Privacy Policy, including with regard to the risks that may be associated with such transfers.
We use Tools that are necessary for operating the website on the basis of our legitimate interest in enabling you to use our Services more conveniently and individually and in making them as time-efficient as possible. In certain cases, these Tools may also be necessary for the performance of a contract or to take pre-contractual steps. In such cases, access to and storage of information on the terminal device is strictly necessary and is based on the legislation implementing the ePrivacy Directive in the EU Member States.
We use all other Tools, in particular those used for marketing purposes, on the basis of your consent. In these cases, access to and storage of information on the terminal device is subject to consent and is based on the legislation implementing the ePrivacy Directive in the EU Member States. If you have consented to the use of certain Tools, we will transfer the data processed when using the Tools to third countries (also) on the basis of this consent.
On our website www.zonein.ch you may withdraw your consent to analytics and marketing Tools at any time via the cookie banner or the cookie settings. In the app (get.zonein.ch) we do not set any analytics or marketing cookies ourselves. Alternatively, you may also exercise your withdrawal with respect to certain Tools directly with the provider.
We use Nylas for appointment scheduling and booking. Processing takes place on servers within the European Union. As the provider, Nylas, Inc., is based in the USA, access from the USA is possible; in this regard we refer to section 6.
We use the LiveKit software, which we operate ourselves on servers in Switzerland, for our video sessions. Audio and video are transmitted in encrypted form and are additionally encrypted between the participants (end-to-end encryption). The keys used for this are generated and managed by our system. Video sessions are not recorded.
Our application integrates GetStream, provided by Stream.io, Inc., a company based in the USA. Data is processed through European data centres within the EU; access from the USA is possible (see section 6). The chat function is intended for organisational communication (see section 1.1.1).
We use Supabase for authentication, the database and file storage. The data is hosted in the AWS region Zürich (eu-central-2), Switzerland. With regard to possible access from abroad, we refer to section 6.
Our application logic (backend) is operated on Google Cloud Platform, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, in the Zürich region (europe-west6). Logging, the management of access keys and the storage of uploaded files and daily backups of chat messages (Cloud Storage) also take place there.
We use Resend, provided by Plus Five Five, Inc., a company based in the USA, to send emails. Emails are sent through servers within the European Union (Ireland). As the provider and its sub-processors are based in the USA, access from the USA is possible; in this regard we refer to section 6.
Our website uses Stripe for payment processing. The controller for the European Economic Area is Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. We transmit your email address, internal identifiers (of your account, the booking and the professional) and the amount and time of the booked session to Stripe, but no counselling content and no information about your health. You enter your payment details directly into Stripe's payment form. Stripe may transfer data to the USA; this takes place on the basis of Stripe's data processing agreement, including standard contractual clauses (see section 6).
We embed the Gleap widget for feedback and support requests. It is loaded for all visitors to the Platform. The data is stored within the European Union. For AI-assisted support replies and summaries, Gleap uses AI providers, including OpenAI and xAI (USA); content from your support request may be transferred to the USA in the process. Gleap uses the Postmark service of ActiveCampaign, LLC, a company based in the USA, to send emails. With regard to these transfers, we refer to section 6.
Our web interface is currently delivered via Vercel, a service of Vercel Inc., a company based in the USA. Delivery takes place via servers in the EU. With regard to possible access from the USA, we refer to section 6. A migration to Google Cloud Platform in the Zürich region is planned.
Professionals can enter the address of their practice in the settings using the Google Maps address search, a service of Google LLC, USA. The search terms entered and the IP address are transmitted to Google (see section 6).
On our website www.zonein.ch we use Google Analytics 4 and Google Ads, services of Google Ireland Limited and Google LLC, USA, to analyse use of the website and to measure the effectiveness of our advertising. The cookies required for this are only set if you have consented in the cookie banner; without consent they remain deactivated.
If you have chosen “Accept all” in the cookie banner on www.zonein.ch and then sign in to the app, we link the pseudonymous Google Analytics identifier of your browser to your account. Our system then reports the events “initial consultation booked” and “first session paid” to Google Analytics, each only with this identifier and the time; they are imported into Google Ads as conversions so that we can measure which ads lead to bookings. We do not transmit your name, your email address or the amount, nor the chosen professional, your concerns or any other health information, and we do not allow Google to use these events for personalised advertising. Google does, however, learn that an appointment with ZoneIn was booked from this browser. The legal basis is your explicit consent in the cookie banner, which names this booking measurement. We keep the link for no more than 90 days. Google may transfer data to the USA (see section 6). You may withdraw your consent at any time via the “Cookie settings” link in the footer of www.zonein.ch; the Google cookies in your browser are then deleted and no further bookings are reported.
We run advertisements on Facebook and Instagram, services of Meta Platforms Ireland Limited. If you fill in a contact form there, Meta transmits the information entered to us so that we can contact you. We and Meta are jointly responsible for the collection via the form; the further processing at Meta is governed by Meta's privacy policy. Meta may transfer data to the USA (see section 6).
Our Services contain links to websites or apps that we do not operate. If you click a third-party link, you will be directed to that third party's website or app. We have no control over the content, privacy policies or practices of third-party websites or services.
We maintain online presences on social networks in order, among other things, to communicate with customers and interested parties and provide information about our products and Services. If you have an account with the same network, we may be able to see information and media you have made available there, for example when we access your profile. In addition, the social network may enable us to contact you. As soon as we transfer personal data to our own systems, we are independently responsible for it. This is then done to take pre-contractual steps and perform a contract. Please refer to the social networks' privacy policies for the legal bases of the data processing they carry out under their own responsibility. Below is a list of social networks on which we maintain an online presence:
We send newsletters and other notifications by email and through other communication channels and may also deliver them with the assistance of third parties.
In principle, you must expressly consent to receiving newsletters and other notifications from us, unless this is permitted on other legal grounds. For emails, we use the "Double-Opt-In" procedure for consent, i.e. you receive an email containing a web link which you must click to confirm, thereby preventing misuse by unauthorised third parties. We may record such consents, including the Internet Protocol (IP) address, date and time.
Newsletters and other notifications may contain web links or tracking pixels that record whether an individual newsletter or notification was opened and which web links were clicked (performance measurement). Such web links and tracking pixels record the use of newsletters and other notifications. We use these statistical usage records, including measurements of success and reach, to provide newsletters and other notifications effectively and in a user-friendly manner, and on an ongoing, secure and reliable basis informed by recipients' reading habits.
You may unsubscribe from newsletters and other notifications at any time and thereby object in particular to the usage measurement described above. You may do so by contacting us directly or by following the link in the footer of each newsletter we send you.
We may update our Privacy Policy from time to time. We therefore recommend that you regularly review this Privacy Policy for amendments.
Amendments to this Privacy Policy take effect when they are published on this page.
If you have any questions about this Privacy Policy, please do not hesitate to contact us:
Carmel Imhof
Renato Rao
Lerchenfeldstrasse 3, 9014 St. Gallen, Switzerland
Use of the Platform is also subject to our Terms of Use.