1. Controller

The controller for the processing of personal data on this website and in the practice is: MEMAZU GmbH, Leo Bornschlegel, Asylstrasse 77, 8032 Zurich, Switzerland Phone: +41 44 203 33 33 · Email: info@memazu.ch This policy is based on the Swiss Federal Act on Data Protection (FADP). It explains which personal data we process, for what purpose, who receives it and what rights you have.

2. Visiting the website: access data and hosting

Our website is hosted by Hostinger. The contracting party is Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The website data and the database are stored on servers in Frankfurt am Main (Germany). When you visit the website, Hostinger processes technical access data on our behalf, in particular your IP address, the date and time of access and the pages requested, in server log files. This serves to provide the website securely and reliably. We have a data processing agreement (Data Processing Addendum) with Hostinger, which forms part of its terms of service. Hostinger may use sub-processors, which are listed in the agreement. Germany and Cyprus are among the countries for which the Swiss Federal Council has determined that data protection is adequate.

Information: https://www.hostinger.com/legal/privacy-policy

To protect the website we use a security plugin (Wordfence). It may log IP addresses on our own server in order to detect and block attacks.

3. Cookies and consent

When you first visit the website, a cookie banner (Complianz) asks for your consent. We set technically necessary storage (for example your cookie choice, a session identifier and the selected language) without consent. All other services, namely Google Analytics and the Google Maps map, are loaded only after you have given your consent. You can change or withdraw your choice at any time via the cookie settings on the website.

4. Google Analytics

With your consent, we use Google Analytics to understand how the website is used and to improve it. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Cookies (_ga, _ga_*) are set and usage data, for example pages viewed, approximate location and device data, are transmitted. The data may reach Google LLC in the USA. Google LLC is certified under the Swiss-U.S. Data Privacy Framework. You can withdraw your consent at any time via the cookie settings.

Information: https://policies.google.com/privacy?hl=en

5. Google Maps

Our site shows a map from Google Maps. It is loaded only after you have given your consent. Among other things, your IP address and device information are transmitted to Google Ireland Limited and may reach Google LLC in the USA (Swiss-U.S. Data Privacy Framework). Without consent, the site shows a placeholder with the address. You can withdraw your consent at any time via the cookie settings.

6. Appointment booking via Acuity Scheduling

You book appointments online through Acuity Scheduling. The provider is Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland. It belongs to the Squarespace group, which includes Squarespace, Inc., 225 Varick Street, 12th Floor, New York, NY 10014, USA. When you book, we collect your first and last name, phone number, email address and the chosen appointment. We use this information to manage and confirm the appointment and to remind you by email and SMS. We do not ask for any health information when you book. For SMS reminders we need your consent, given by ticking a box in the booking form. If you do not want this, please book your appointment by phone or email. You can stop SMS messages at any time by replying STOP. Ireland is among the countries for which the Swiss Federal Council has determined that data protection is adequate. Data may be disclosed to Squarespace, Inc. in the USA. Squarespace, Inc. is certified under the Swiss-U.S. Data Privacy Framework (https://www.dataprivacyframework.gov/list), on which the disclosure is based. Should the certification lapse, the disclosure is based on standard data protection clauses under Art. 16 para. 2 let. d FADP. We have a data processing agreement (Data Processing Addendum) with Squarespace. Booked appointments are synchronised with our Google calendar (Google LLC, Swiss-U.S. Data Privacy Framework).

Information: https://www.squarespace.com/privacy

7. Contact by phone and email

If you call or write to us, we process your details in order to answer your request. There is no contact form on the website. Our email addresses are hosted by one.com (One.com Group AB, Malmö, Sweden; postal address Kalvebod Brygge 24, DK-1560 Copenhagen). Sweden and Denmark are among the countries for which the Swiss Federal Council has determined that data protection is adequate. Emails may be transmitted unencrypted over the internet; please do not send us sensitive health information by email.

8. Treatment, patient data and billing

If you are treated by us, we keep treatment records. They contain information about your complaints and the treatment and therefore include health data, which is particularly sensitive. We keep these records locally and offline in the practice. For invoicing and sending reimbursement receipts, we enter the necessary details (name, address, date of birth, date and duration of treatment, invoice amount) into an online billing programme of the ASCA Foundation, which is based in Switzerland. The ASCA Foundation processes this data on our behalf. No health information is requested through Acuity Scheduling. Your data is subject to our professional duty of confidentiality. We disclose it only if you have consented, if the law requires it, or if you wish it to be disclosed to claim reimbursement from your supplementary insurance.

9. Other technical services

We operate the website with WordPress and the extensions Elementor, Yoast SEO, Complianz, WP Fastest Cache, Wordfence and GPT Translate. They serve design, security, search engine optimisation, loading speed and translation of content. Depending on function and configuration, technical data may be processed. Security logs may contain IP addresses, for example. The website uses locally stored Google Fonts. Loading these fonts does not establish a connection to Google servers.

10. Retention

We keep treatment records for ten years after the last treatment (§ 13 para. 3 of the Health Act of the Canton of Zurich) and delete them afterwards. We keep accounting records such as invoices for ten years (Art. 958f of the Swiss Code of Obligations). We delete appointment details in Acuity once we no longer need them, at the latest after these periods have expired. Hostinger deletes server log files after its usual retention period. Cookies remain only for the period stated in the cookie settings.

11. Disclosure abroad

We disclose personal data only to the service providers named above. They are located or process data in Switzerland (ASCA), in the EU (Hostinger in Germany and Cyprus, Squarespace and Google in Ireland, one.com in Sweden) and partly in the USA (Google LLC, Squarespace, Inc.). For the USA we rely on the Swiss-U.S. Data Privacy Framework, and otherwise on standard data protection clauses.

12. Data security

We take appropriate technical and organisational measures, for example encrypted transmission (HTTPS), access protection, a security plugin and regular updates. Nobody can guarantee absolute security on the internet.

13. Your rights

You may request information about your personal data (Art. 25 FADP), its release in a common format (Art. 28 FADP), correction of inaccurate data, and deletion or restriction of processing (Art. 32 FADP). You may withdraw any consent at any time with effect for the future. Please write to us at info@memazu.ch; we may ask for proof of identity. Statutory retention obligations remain reserved. You may also contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (www.edoeb.admin.ch).

14. Changes

We may amend this policy at any time. The version published on the website applies. As of: 29 October 2026.