Privacy Policy | NFINITY SWISS

SUMMARY

The following summarises, but does not replace, the content of this statement. We recommend that you read it in full:

Our role. We, Pure Lake Clinic, act as the data controller for your personal data (for our own activities, but not those of third-party providers) (see Section 2);
The data we collect. We collect personal data that you provide to us directly, that is provided by our clients, by people we interact with, or that we obtain lawfully in the course of our activities (see Section 3);
How we use it. We process personal data in accordance with Swiss law, as well as any other data protection laws applicable to us, mainly to provide our services to our clients, to manage and administer our activities, as part of research activities, and to comply with our legal obligations (see Sections 7 and 8);
Hosting and transfers. We host your personal data in Switzerland. We do not share it with third parties or transfer it abroad, unless this is both necessary for the operation of our Services and permitted under applicable law. This may, for example, be the case when we engage service providers or need to interact with third parties to carry out our professional activities (see Sections 9 and 10);
Retention and security. We retain your personal data only for as long as necessary to carry out the activities described in this document. We take appropriate technical and organisational measures to keep this data secure (see Sections 7 and 8); and
Your rights. . You can contact us (contact@purelakeclinic.com) to exercise your rights regarding your personal data (see Sections 9 and 10).

1.0 INTRODUCTION

At Pure Lake Clinic (the Company or we), we recognise the importance of your personal data and of transparency in our processing activities.

This data protection statement is intended to inform you of our policy regarding the collection and processing of personal data relating to:

our clients and patients benefiting from our proactive medicine programmes, prospective clients interested in our services, suppliers and partners (testing laboratories, medical service providers), and individuals connected to them;
people who apply for a position with us; and
visitors to our website.

We may also have separate documents describing how we process personal data in specific circumstances.

2.0 WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

Pure Lake Clinic SA is the controller responsible for processing your personal data. You will find our contact details below in Section 10.
However, some of the processing activities described in this statement may be carried out by other entities within our group, which will then act as the data controller. The exact allocation varies between group entities and over time. On request, we can confirm which processing activities are carried out by which entity.

The content of this statement applies only to processing carried out by us or at our request. Although we may sometimes direct you to third-party providers, we are not responsible for their personal data policies or for how they process your data.

3.0 HOW DO WE COLLECT YOUR PERSONAL DATA?

3.1 The data we collect

We collect the personal data that you provide to us directly. By doing so, you expressly acknowledge that we may process your personal data in accordance with this statement.

In addition, we may obtain your personal data from other individuals or entities we come into contact with in the course of our activities, such as our business partners, third parties involved with them, or the legal entity you work for (for example, if you are the contact person designated by your employer to manage the relationship with us). The data about you that we may collect from third parties or public sources depends on the context, but may include the following categories:

Category	Examples
Identity	Surname, first name, age, date of birth, gender, nationality, identity document, etc.
Contact data	Email address, postal address, phone number, or other contact details
Professional information	Information relating to professional training, degrees, certifications, CV, employment status, qualifications, languages, position, role
Payment information	Bank details, method of payment
Medical or health data	Records transmitted by your treating physician to our services, health test results, data from connected devices (e.g. heart rate measured by a connected watch).

To the extent permitted, we may also obtain the categories of personal data described above from public or private sources, such as public or commercial registers (for example, debt enforcement and bankruptcy registers, land registers, commercial registers), the press, websites, or social media.

Finally, if you visit our website or digital platform, we may automatically collect personal data, including by means of cookies and other active elements, as described further in this statement.

3.2. Some information must be provided; other information is optional

We indicate at the point of collection whether providing the data is mandatory (for example, with an asterisk) and the consequences of refusing to provide the requested data. In general, if mandatory data fields are not completed, we will not be able to provide our services.

3.3. The personal data we process may include sensitive data

To the extent permitted by law, we may collect data classified as sensitive, in particular (depending on the type of services we provide) health data (biological tests, biometric measurements, genetic data, health questionnaires, health profiles), genetic data (DNA analysis for health profiling), biometric data (body measurements, data from monitoring devices), and data relating to sex life (as part of hormonal assessment) (Sensitive Data).

We will process this Sensitive Data in accordance with applicable data protection laws, as set out in this statement.

4.0 HOW DO WE PROCESS YOUR PERSONAL DATA?

We process your personal data in accordance with Swiss data protection law – and, to the extent applicable to us, other data protection legislation, such as the EU General Data Protection Regulation (GDPR) – to achieve the purposes described in our list of processing activities.

We will only process your personal data if we have a valid legal basis for doing so. Depending on the processing activity concerned, we will therefore only process your personal data on one of the following grounds:

Contractual necessity	Processing is necessary to fulfil our contractual obligations to you or to take pre-contractual steps at your request. Where the GDPR applies, contractual necessity is based on Article 6(1)(b) GDPR.
Legitimate interest	Processing is necessary for the purposes of our legitimate interests, and only to the extent that your interests or fundamental rights and freedoms do not require us to refrain from processing. Where the GDPR applies, legitimate interest is based on Article 6(1)(f) GDPR.
Consent	We have obtained your prior consent in a clear and unambiguous manner. Where the GDPR applies, consent is based on Article 6(1)(a) GDPR.
Legal obligation	Processing is necessary to comply with our legal or regulatory obligations. Where the GDPR applies, legal obligation is based on Article 6(1)(c) GDPR.

We do not make decisions based solely on automated processing that produce legal effects concerning the data subject or that significantly affect them (automated individual decision-making). We may, however, process your data to build a profile of you in order to provide you with more relevant information and services (profiling). Our service, for example, allows us to personalise your treatment plan based on your specific needs and characteristics. You may have the right to object to these activities to the extent provided by law (see Section 9 below for more information about your rights).

We may combine your personal data with other information (aggregation) or remove any information that identifies you (anonymisation), such that it is no longer considered personal data under applicable data protection law, in which case this statement will no longer apply and we may use this data for purposes not covered by this statement (for example, for benchmarking, internal research and/or development, analysis, or to develop and market new services). You may object to the anonymisation or aggregation of your personal data for this purpose at any time (see Section 9 below for further information about your rights).

5.0 WHO HAS ACCESS TO YOUR PERSONAL DATA, AND WITH WHOM IS IT SHARED?

We only disclose your personal data to third parties if you expressly consent, if there is a legal obligation or authorisation to do so, to assert, exercise or defend legal claims, or if disclosure is directly related to the conclusion or performance of a contract with you or in your interest. We mainly share your data with the following categories of recipients:

Within our group entities

Nous pouvons transférer des données personnelles aux membres de notre personnel et à d'autres entités du groupe. Ces autres entités du groupe agiront soit en tant que responsable du traitement indépendant, soit traiteront vos données personnelles pour notre compte (agissant ainsi en tant que sous-traitant).

Dans tous les cas, les données personnelles seront traitées uniquement aux fins énoncées dans notre liste des activités de traitement.

To our service providers and partners

We may transfer personal data to selected service providers in connection with the activities listed in our list of processing activities, only to the extent necessary for the provision of their services or to carry out the instructions we have given them, or under an agreement concluded with them. This may include, in particular, the healthcare staff supporting you throughout your journey with us, independent laboratories, our IT providers, or tax and accounting service providers.

To third parties where we have a legal obligation or a legitimate interest in doing so

We may also disclose your personal data where we have a legitimate interest in doing so, for example:

to respond to a request from a judicial authority or in accordance with a legal obligation;
to bring or defend a legal claim;
or as part of a restructuring, in particular if we transfer our assets to another company.

6.0 INTERNATIONAL TRANSFERS

We host your personal data on servers located in Switzerland.

As a rule, we do not transfer or make your personal data accessible to other countries. However, in certain circumstances, your personal data may be made available to recipients located abroad, including our processors, other business partners, or authorities or courts. In particular, we use the services of providers headquartered in the European Union (notably the Netherlands and Finland) or in the United States, meaning some of your data may be available from those locations.

DIn such cases, we ensure that appropriate safeguards are in place, in accordance with applicable data protection law, for example by relying on standard contractual clauses adopted by the European Commission, or on a legal exception such as consent, the performance of a contract, the establishment, exercise or defence of legal claims, an overriding public interest, or the protection of life or physical integrity.

If you provide us with data, you are deemed to consent to these data transfers. You may request further information in this regard and obtain a copy of the relevant safeguards on request, by sending a request to the contact address given in Section 10.

7.0 HOW LONG DO WE KEEP YOUR DATA?

We destroy or anonymise personal data as soon as it is no longer needed to achieve the purposes set out in our list of processing activities. This period varies depending on the type of data concerned and applicable legal requirements. You will find further information on each type of processing in our list of processing activities.

Given the legal obligations imposed on us, certain information, in particular relating to the contractual relationship, must be retained for at least 10 years.

8.0 SECURITY

We work to keep your personal data secure and have put in place physical, technical and organisational measures designed to protect your personal data and prevent unauthorised access to it.

We limit access to your personal data to those who need it for the purposes described in this statement

Although we take appropriate measures to protect your personal data, no IT infrastructure is completely secure. We therefore cannot guarantee that the data you provide to us is protected against unauthorised access by third parties or against theft.

When you send us information electronically, this data may be transferred internationally over the internet. The internet is not a secure environment, and this statement applies to our use of your personal data only once it is under our control. Given the nature of the internet, any transmission of data over the internet is at your own risk.

If we have reasonable grounds to believe that your personal data has been acquired by an unauthorised person and applicable law requires notification, we will promptly inform you of the breach through any appropriate communication channel (including by email or by publishing a notice on our website).

9.0 YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA

DTo the extent provided by law, you have the following rights:

to request information about processing concerning you and to access your data;
to request that it be corrected or updated;
to request the erasure of your personal data;
to ask us to stop any specific processing of personal data that may have been obtained or processed in breach of applicable law;
to object to any processing of personal data on legitimate grounds; and
to withdraw your consent where we carry out an activity on that basis (without such withdrawal affecting the lawfulness of processing carried out before the withdrawal).

You will find further details on your rights in Sections 6 and 7 of this statement in relation to each processing activity we carry out.

The above does not limit any other rights you may have under applicable data protection law in certain circumstances. In particular, if the GDPR applies to the processing of your personal data, the GDPR grants you certain rights as a data subject where the applicable conditions are met.

If you wish to exercise your rights, please contact us using the details provided below (see Section 10).

In addition to the rights described above, you may also have the right to lodge a complaint with the competent data protection supervisory authority (in particular, in the member state of your habitual residence, place of work, or place of the alleged infringement) if you are not satisfied with how we process your personal data. Although not mandatory, we recommend that you contact us first (see Section 10) as we may be able to respond to your request directly.

10.0 CONTACT US

If you believe that your personal data has been used in a manner that is not consistent with this statement, or if you have questions about the collection or processing of your personal data, you can contact our DPO by post or email:

Pure Lake Clinic SA
Data Protection Officer
Grand-Rue 73
1296 Coppet

contact@nfinityswiss.com

NOUR PERSONAL DATA PROCESSING ACTIVITIES

Cette page décrit les finalités pour lesquelles nous traitons les données personnelles, les données personnelles que nous traitons en relation avec chaque finalité, et la durée de conservation des données personnelles.

Ref	Purpose	Data processed	Legal basis	Retention period
1.	To provide our services to our clients NWe process the personal data necessary to provide our proactive medicine programmes, including assessing your risk factors, creating your personalised health profile (Star Profile), establishing your Personalised Proactive Plan (PPP), calculating your health performance indicators (hKPIs), and monitoring your progress. This also includes coordination with staff, personalised follow-up and coaching, and our remote clinical support service (RCS).	All the data you provide to us Biometric and physiological data collected via measurement equipment Results of analyses carried out by our partner laboratories Data provided by your doctor or other providers; to carry out the transactions in which we are involved, and to procure products and services from our suppliers and subcontractors; to monitor our activities (measuring sales, our working time, etc.) and those of our suppliers to manage our archives and files ; and for billing purposes Basic information (name, surname, etc.) Professional data (activity, employer, etc.) Billing and payment information Identity data Contact details Interactions with us ; Logs (such as access logs to our physical building) CCTV images Identity data (name) Contact details (email) Time of registration and proof of consent Identity data (name) Contact details History of the business relationship Anonymised or pseudonymised health data platform usage data performance data from care programs, data statistics on the effectiveness of treatments	Contractual necessity to provide the requested services Consent	Active phase: [3 years] after the last processing activity Possible further retention: legal archiving for up to 20 years; in anonymised or pseudonymised form for research purposes (see Purpose 6)
2.	To manage our clients and suppliers If we have a business relationship with your employer or with you directly, or if we are in discussions to establish one, we process the personal data necessary to manage our clients or suppliers, as well as the following related purposes, in particular:	The personal data we process in this context includes:	Contractual necessity (if you are our client). Legitimate interest in providing our services to our clients (if you are not our client).	Same as for the processing activity referenced under No. 1 above.
3.	To ensure the security of our infrastructure and staff, and for the general management of our organisation We process your personal data when necessary to manage and ensure the security of our infrastructure and staff, including maintaining our IT infrastructure, preventing fraud or criminal activity, and ensuring business continuity.		Legitimate interests Contractual necessity	Information collected for this purpose is regularly deleted or anonymised once it is no longer needed, in accordance with applicable legal requirements.
4.	To send you our newsletter, if you have subscribed You may unsubscribe from the newsletter service at any time, in which case your details will be removed from our lists.		Consentement Obligation légale (pour la preuve du consentement)	Until you unsubscribe
5.	To send you other promotional information Regardless of your newsletter subscription, we may also contact you by email to inform you about our activities if you have previously signed up to use our Services, and if you have not objected to the corresponding use of your email address. You may object to the use of your email address for this purpose at any time by contacting us.		Our legitimate interest in advertising certain commercial offers and activities related to our previous interactions with you.	Same as for the processing activity referenced under No. 1 above.
6.	For research, internal analysis and statistical purposes, to improve our services and products We may retain and reuse your data that has been anonymised or pseudonymised for purposes unrelated to you, to improve our technology, improve the PPP and personalised coaching, and for statistical analyses, studies and research activities, whether medical or not, in particular to demonstrate the impact of proactive medicine. We do not use this information to identify you or attempt to link it back to you. You may object to these processing activities at any time (see the data protection statement for further information on your rights).	* Anonymised or pseudonymised health data, platform usage data, care programme performance data, statistical data on treatment effectiveness	Legitimate interest Consent (whenever legally required)	Data is anonymised as soon as this is made possible by the processing.
7.	For medical research purposes If you give us your consent, we may retain and use your personal health data as part of medical research projects governed by the Human Research Act (HRA). Exceptionally, the law provides that your data may also be used if the competent ethics committee grants special authorisation, unless you have objected.	* Anonymised or pseudonymised health data [entry appears cut off in source — see translator's note above]	Consent (exceptionally: subject to ethics committee authorisation)	Until consent is withdrawn
8.	If you apply for a position with us, to process your application If you apply for a position with us, we will process your personal data exclusively to assess your application with a view to a possible employment relationship, including assessing your skills and qualifications and carrying out reference checks, to the extent permitted by Swiss law.	We process the personal data you provide to us (for example, your contact details, CV, cover letter, and information about your previous professional experience). In addition, if you provide us with links to your profile on social media platforms (such as LinkedIn) or the contact details of references, we will assume that we may collect information from these sources. All information you provide to us must be accurate, complete and not misleading. Providing inaccurate, incomplete or misleading data may, to the extent permitted by law, result in your application being rejected or in disciplinary action, including immediate dismissal if you have been hired.	Contractual necessity	The personal data of candidates who are not hired is deleted at the end of the recruitment process. If an employment relationship is established following your application, your personal data will be added to your HR file and subsequently processed in accordance with our HR data processing policy.
9.	To operate our digital solutions To operate our digital solutions If you visit our digital solutions (in particular our website and app), we process your data to provide the requested functionality and to establish a connection with your device over the internet, to identify you when you use our websites, to manage their stability and security, and for analysis and statistical purposes, on the basis of our legitimate interests in doing so.	In addition to the personal data you provide directly, we automatically collect certain technical information about your interactions with our digital solutions (such as your IP address, the content you accessed, the date and time of access, information about your web browser, your preferences, or other information related to your interaction with our digital solutions, including details of your browsing activity on our websites).	Contractual necessity (to operate our website and provide the required functionality) Legitimate interest (analysis and statistics)	If you access a service, the retention period corresponds to that applicable to the services we provide.
10.	To comply with our other legal obligations We may further process your personal data if we have a legal obligation to do so or for other legitimate interests. This will, for example, be the case if we must disclose certain information to public authorities or retain such information for tax or accounting purposes, or for the establishment, exercise or defence of legal claims.	The personal data we process for this purpose is data we have collected for one of the other purposes set out elsewhere in this list.	Legal obligation	We retain personal data for the duration of the legal obligation imposed on us.

In addition to the above, we may process your personal data if we have obtained your prior consent. Consent given may be withdrawn at any time, but this does not affect data processed before the withdrawal.

Data Protection Statement