Privacy Policy

I. Scope and Controller

This Privacy Policy describes how Topmed AG, Steinenberg 23, 4051 Basel, Switzerland, operating under the brand name enmedify (hereinafter “enmedify”, “we”, “us”), processes personal data in connection with the use of the enmedify platform.

The platform includes the website www.enmedify.ch, any mobile web applications, native apps, and other digital access and communication channels provided by enmedify (collectively, the "Platform").

This Privacy Policy explains the nature, scope, purposes, and framework of the processing of personal data, as well as the rights of data subjects.

The Platform is intended for adult natural persons residing in Switzerland. Unless explicitly stated otherwise, the services offered are limited to Switzerland.

This Privacy Policy forms an integral part of the General Terms and Conditions ("Terms & Conditions").
The controller under Swiss data protection law is:

Topmed AG

Steinenberg 23
4051 Basel
Schweiz

Email: support@enmedify.ch

Website: www.enmedify.ch

Last updated: May 2026

II. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

Personal Data means any information relating to an identified or identifiable natural person.

Sensitive Personal Data includes, in particular, health-related data.

Processing means any handling of personal data, including collection, storage, use, modification, disclosure, archiving, deletion, destruction, or any other operation relating to personal data.

Platform refers to the digital services provided by enmedify, including in particular the website, user account, mobile applications, communication functions, and technical infrastructure for appointment booking, telemedicine, prescription processes, and administrative support.

Service Providers means external companies or individuals providing services for enmedify, such as hosting, software, payment, communication, or support providers.

Partner Pharmacies means external pharmaceutical service providers with whom enmedify cooperates for prescription review, medication dispensing, and, where applicable, shipping.

III. Which Personal Data We Process

We process personal data that you provide directly to us, that arises from your use of the Platform, or that we receive from integrated healthcare providers or service providers to the extent permitted and necessary.

1. Basic Data

When registering for or using the Platform, we may process the following data in particular:

• First and last name
  
• Address
  
• Date of birth
  
• Email address
  
• Telephone number
  
• Account data and login information
  
• Communication preferences

2. Health and Treatment Data

In connection with medical services and cooperation with partner pharmacies, we may process the following sensitive personal data in particular:

• Information from medical questionnaires
  
• Information regarding symptoms, complaints, and diagnoses
  
• Information regarding pre-existing conditions
• Information regarding allergies and intolerances
  
• Information regarding accompanying medication
  
• Information from medical consultations and assessments
  
• Information regarding prescriptions, dosages, quantities, and prescription data
• Information required for safe prescription review, dispensing, or shipping of medication

3. Payment and Transaction Data

Where paid services are processed via enmedify, we may process the following data in particular:

• Billing information
• Payment status
  
• Transaction references
  
• Information regarding the payment method used
  
• Information relating to outstanding claims

4. Communication Data

When you communicate with us or use communication functions of the Platform, we may process the following data in particular:

• Content of support requests
  
• Appointment-related communication
  
• Email correspondence
  
• Opt-ins and opt-outs for newsletters, marketing, or push notifications
  
• Contact and delivery information for SMS, push notifications, or WhatsApp, where permitted

5. Technical and Usage Data

When using the Platform, technical data may be processed automatically, including in particular:

• IP address
  
• Device information
  
• Operating system
  
• Browser type
  
• App version
• Time of access
• Log data
• Error and diagnostic data
• Information regarding the use of individual functions

6. Data from Third Parties

Where permitted and necessary, we may also receive data from:

• Doctors working for enmedify
  
• Partner pharmacies
  
• Payment service providers
  
• IT and communication service providers
  
• Documents uploaded by you or information provided by third partiesdesignated by you

If you provide us with data relating to third parties, you must ensure that you are authorized to do so.

IV. Purposes of Data Processing

We process personal data for the following purposes in particular:

V. Legal Bases and Consent

We process personal data where this is necessary for the provision of the Platform, the implementation of pre-contractual and contractual measures, compliance with legal obligations, or the protection of legitimate interests.

Where required, we obtain additional consent, in particular for:

• The processing of sensitive personal data;
  
• The transfer of health-related data to partner pharmacies for prescription review, dispensing, and shipping;
  
• The use of WhatsApp or comparable communication services;
  
• Marketing and newsletter communication;
  
• Push notifications where consent is required.

Any consent granted may be withdrawn at any time with effect for the future. However, withdrawal may result in certain services no longer being
available or only partially available.

VI. Access to Information and Confidentiality Obligations

Doctors, pharmacists, and their assistants are subject to statutory confidentiality and due diligence obligations. Patient data may generally only be disclosed with explicit consent unless another legal basis applies.

To the extent necessary for services offered or administratively supported via the Platform, the user consents, by accepting the Terms & Conditions and this Privacy Policy, that:

• Doctors working for enmedify,
  
• Partner pharmacies, and
  
• Their assistants
  

may provide enmedify with access to information to the extent necessary for:

• Appointment organization,
  
• Technical implementation of telemedicine,
  
• Treatment and documentation,
  
• Administrative support,
  
• Payment processing,
  
• Prescription processing,
  
• Safe dispensing of medication,
  
• And, where applicable, shipping of medication by partner pharmacies.
  

This consent is limited to the extent necessary in each individual case and includes, where required, a corresponding release from medical confidentiality obligations.

VII. Recipients and Categories of Recipients

We may disclose personal data to the following categories of recipients where necessary:

• Doctors and medical personnel working for enmedify
  
• Partner pharmacies
  
• IT and hosting providers
  
• Software and communication providers
  
• Video consultation and appointment booking systems
  
• Payment service providers
  
• Support and shipping service providers
  
• Authorities, courts, or other entities where there is a legal obligation or where necessary to protect rights
  

We do not sell personal data.

VIII. WhatsApp, Messaging Services, and Push Notifications

If you communicate with us via WhatsApp or comparable messaging services, or consent to such communication, we process the contact and communication data necessary for this purpose.

Please note that when using such services, data may also be processed by the respective providers. This may result in additional data protection and confidentiality risks, particularly regarding metadata and communication content.

We do not use WhatsApp or comparable messaging services for medical advice provided by enmedify.

Where an app is provided, we may send push notifications for service- related, technical, or organizational purposes. Marketing-related push notifications are only sent in accordance with your consent or applicable legal requirements.

IX. Storage and Retention

As a rule, we store personal data on servers located in Switzerland. Where necessary, data may also be processed within the EU or EEA.

We retain personal data only for as long as necessary for the respective purposes or where statutory retention, documentation, or evidentiary obligations apply.

Health-related data, billing-relevant data, and other information subject to documentation obligations may be retained for longer periods where required by law or necessary to protect legitimate interests.

X. International Data Transfers

Personal data may generally only be transferred abroad where an adequate level of data protection exists or where other legally recognized safeguards are in place.

As a rule, we process personal data in Switzerland. Where we use service providers within the EU or EEA, processing may also take place there.

Transfers to other countries only take place where the legal requirements are fulfilled and adequate protection is ensured, in particular through contractual guarantees or other suitable safeguards.

XI. Data Security

We implement appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, misuse, alteration, or unlawful disclosure.

These measures include in particular:

• Access restrictions
  
• Password protection
  
• Role and authorization concepts
  
• Encryption where appropriate
  
• Security and control processes
  
• Training and internal instructions
  
• Regular review of our security measures
  

Despite appropriate security measures, absolute security cannot be guaranteed, as internet transmissions and electronic storage inherently involve certain risks.

XII. Rights of Users

Under Swiss data protection law, data subjects are entitled in particular to information and access regarding processed personal data; depending on the case, correction, deletion, or transfer of data may also apply.

Under applicable data protection law, you have the following rights in particular:

• Access to processed personal data
  
• Correction of inaccurate data
  
• Provision or transfer of certain data
  
• Withdrawal of consent with effect for the future
  
• Objection to certain processing activities
  
• Deletion of data where no statutory retention obligation applies
  

In order to exercise your rights, we may require appropriate proof of identity.

If you believe that the processing of your personal data violates applicable law, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).

XIII. Cookies and Similar Technologies

We use cookies and comparable technologies in order to enable use of the Platform, improve user experience, measure reach, and optimize content or communication.

Where required, we obtain your consent for such technologies. You may adjust your preferences at any time through the relevant cookie or privacy settings.

XIV. Changes to this Privacy Policy

We may amend this Privacy Policy at any time. The current (German) version published on the Platform shall apply.

Material changes will be communicated in an appropriate manner. Continued use of the Platform after such changes enter into force may be deemed acceptance where legally permissible.

XV. Contact

If you have any questions regarding this Privacy Policy or the processing of your personal data, you may contact us at:

Topmed AG

Steinenberg 23
4051 Basel
Schweiz

Email: support@enmedify.ch

Website: www.enmedify.ch

Last updated: May 2026