Privacy policy

  1. Introduction

Welcome to impediavet.org (the «site »), the website of the Institute of Medical Procedures («IMP », «we », «us » or «our »), a Swiss non-profit association with its registered office at Freiburgstrasse 3, in 3010 Berne, Switzerland.

The protection of your personal data is very important to us. In this privacy policy, we explain what data we collect, on what legal basis and for what purpose, as well as with whom we may share this data and what your rights are in this regard. Unless otherwise stated, IMP is the controller of your personal data and is therefore responsible for the processing of your personal data.

This privacy policy is based on the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).

By accessing or using this site or any of our services, whether as a registered user or as an unregistered visitor, you acknowledge that you have read this privacy policy, and consent to the handling of your personal data as described hereinafter. If you do not acknowledge this privacy policy, do not use the site or our services.

If you have any questions regarding how we collect or process personal data, please contact us at the address set out above.

  1. IMP’s vision and intention

In order for you to better understand what data we collect and for what purpose, we would first like to briefly explain our vision and the intended use of our services:

IMP has launched the platform IMPEDIA (the «platform »), that collects user generated content from medical professionals and institutions in all relevant disciplines. The platform is intended to facilitate planning, visualization and documentation of surgical procedures. It can be used in the context of any type of surgical procedure, regardless of the medical indication and patient population. It is aimed at health care professionals, such as surgeons, nurses and other hospital staff, and at institutions of medical education and training («health care professionals »).

The collected content, such as outcome and best practice insights, shall be made available to all IMPEDIA Impedia-connected professionals in templates or even to the public. The aim is to improve the quality and safety as well as the effectiveness and sustainability of medical treatment.

Thus, we collect on one hand personal information about you as a health care professional. We mainly need these to be able to offer our services in accordance with their purpose. This privacy policy shall cover exactly this personal data about you, which we are responsible to protect.

On the other hand, we collect data generated by you («user content»), which you can process and publish via our services. We would like to point out that we are not responsible for the content you process via our services, in particular not for personal data of third parties, such as data of your patients. Such are not covered by this Privacy Policy. We only technically enable you to process third party data through our services in order to facilitate your surgical treatment. However, we have no control over whether and which data you process. This is solely your responsibility. You must ensure that the user content you make publicly available is anonymised or pseudonymised. We also do not possess a data based key to re-identify patient data. Please note that once you have made your content public, it is just that – public.

  1. Collection and use of information

  2. General

Personal data is understood to be all information that relates to an identified or identifiable person. In general, we collect your personal data when you provide it to us directly, automatically when you use our services or from third party sources.

We process your data only for specified purposes and only in legally permissible cases. You will find below the individual data processing operations and their legal basis. The following reasons are possible:

  • Your consent;
  • The execution of a contract or pre-contractual measures;
  • The compliance with legal requirements;
  • Our legitimate interests, provided your interests or fundamental rights are not overridden;
  • To safeguard vital interests of you or another person or to perform a task in the public interest;
  • Other relevant statutory legal grounds.

You will find a reference to the legal bases in the respective processing operations hereinafter.

If you have given us consent to process your personal data for specific purposes, we will process your data within the scope of this consent unless we have another legal basis. You may revoke your consent at any time. Data processing that has already taken place is not affected by this.

  1. Account

To use the services, with the exception of the site itself, you have to create a user-specific account (the «account »). When you register an account, we collect your full name, your e-mail address, job title, Institute and clinic. We mainly use this information to set-up, validate and administer your account. We also use it to associate your user content with a particular medical specialty.

Once a registered user, you may provide additional information in your personal account which describes you, your biography, your academic background, institutional affiliations, credentials, professional experiences and/or your surgical discipline and speciality. Providing additional information to your account is not required and entirely optional, but it may allow you to derive greater benefits from using the services, such as receiving discipline specific content. This additional information can be updated or removed by you at any time, and you may choose whether to make some of this information publicly visible to other users.

  1. Automatically collected information

Log data

When you access the site or use our services, the provider of the services automatically collects and stores information in so-called server log files, which your devices via browser and/or iOS application transmits to us. These are:

  • Server name
  • IP address
  • Operating system
  • Device type
  • Browser name and version
  • Date and time of server request

The log files are stored and used in order to guarantee the functionality of the site and the services and to ensure the security of our information technology systems. This is our legitimate interest and serves as the legal basis.

Metadata

Sometimes we automatically receive location data from your device. For example, if you upload a photo to our services to attach to a surgical procedure, we may automatically receive metadata, such as the place and time you took the photo, from your device. Please be aware that the default settings on your devices may include the metadata of your photos or videos. If you do not want metadata to be shared, please change your settings on your device.

Cookies

Our services use cookies. Cookies are text files that are stored on the operating system of your device with the help of the browser. Cookies do not cause any damage to your device and do not contain viruses. A cookie cannot be used to read data off your device, nor can it read cookie files created by other sites. The platform sets a cookie when you sign in, so that you stay signed in and do not have to enter your password again on every page. The site itself does not set cookies. You can choose whether to accept cookies or not by changing the settings of your browser. You can reset your browser to refuse all cookies or allow your browser to show you when a cookie is being set. If you reject the cookies, you will not be able to sign in to the platform. If you choose not to reject the cookies, this will accordingly be deemed to be your consent.

Website

The site does not use analytics or tracking tools and does not set cookies. To display text, the site loads fonts from Google Fonts, a service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA); your browser then connects to Google's servers, which receive your IP address. The contact page shows a map from OpenStreetMap (OpenStreetMap Foundation, United Kingdom), which your browser loads directly from OpenStreetMap's servers.

Google Firebase (app)

The IMPediaVET app uses Firebase, a service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), for usage analytics, crash reports and remote configuration. Section 7 «IMPediaVET app» describes which data the app sends. The data may be processed on Google's servers in the USA (see «Transfer abroad» below). Firebase is not used for advertising. Google describes how it processes data from apps that use its services at https://policies.google.com/technologies/partner-sites.

Crash and error reports

We want to provide our services as error-free as possible and constantly improve them. The platform records errors in its own server logs (see «Log data» above) and does not send them to an external error reporting service. The IMPediaVET app sends crash and error reports to Firebase Crashlytics, a service of Google LLC (see «Google Firebase (app)» above and section 7). These reports contain technical information such as device type, operating system version, app version and error details. They are not used for advertising. They help us find and correct errors in our services, which is our legitimate interest.

  1. Information when you contact us

We also receive information about you when you decide to contact us. For example, if you email us, we may keep your message, email address and contact information. We need this to categorise your enquiry, respond to it and, if applicable, investigate any breach of our terms of use or this privacy policy. This is our legitimate interest and serves as the legal basis.

  1. Information from third parties

We primarily collect your personal data directly from you. We may also receive personal data about you from third parties. This data may namely include the following categories:

  • Information from third party software (e.g. from clinical information systems, picture archiving and communication system);
  • Information from publicly accessible sources (e.g. media, internet);
  • Information from public registers (e.g. commercial register, debt collection register, land register);
  • Information in connection with official or judicial proceedings;
  • Information concerning your professional functions and activities;
  • Information about you from correspondence and meetings with third parties;
  1. The use of your personal information

As already mentioned, we use all of this personal data about you primarily to provide you with our services in accordance with their purpose. We may further use it to:

  • maintain and improve our services;
  • send you technical notices, updates, security alerts and support and administrative messages;
  • respond to your comments, questions and requests and provide customer service;
  • communicate with you about products, services, offers and provide news and information we think will be of interest to you;
  • monitor and analyze trends, usage and activities in connection with our services;
  • detect, investigate and prevent fraudulent transactions and other illegal activities and protect the rights and property of IMP;
  • personalize and improve the services and provide content or features that match user profiles or interests;
  • link or combine with information we get from others to help understand your needs, confirm your identity, and provide you with better service; and
  • carry out any other purpose for which the information was collected.
  1. Sharing of information

In connection with the collection and use described above, we may disclose your personal information to third parties as follows:

Public

Your account is publicly viewable by other registered users if you join a team and/or publish content with visibility set to public.

Service providers

We may share your information with third parties that help us provide our services, including in the areas of website and database hosting and maintenance, telecommunications, information security, fraud detection and prevention, email management, data analytics, marketing, advertising, member support, and identity and professional credential verification.

Research institutions

As part of IMP’s intention to drive quality of medical treatment, we may share your information with research institutions that perform research related to their respective missions. We require these institutions to agree that they will only use and share the data as needed for the approved research purpose. We may publish or allow others to publish insights learned from such research activities.

Educational institutions

We may share your data with educational institutions that use your data as part of their respective educational offerings. We require these institutions to agree to use and share this data only for the approved educational purpose.

Business transferees

We may share your personal information in connection with a business transaction (or potential transaction) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, IMP or our corporate affiliates (including, in connection with a bankruptcy or similar proceedings).

Affiliated companies

We may share personal information with our corporate affiliates for use consistent with this privacy policy.

Legal requests

We may share your information with third parties, as required or permitted by applicable law, if we believe it is reasonably necessary to comply with legal process and law enforcement instructions and orders, such as a search warrant, subpoena, statute, judicial proceeding, or other legal process served on us, which may involve disclosure to law enforcement, courts, or governmental authorities.

Other third parties

We may share your information if we determine it is reasonably necessary or appropriate to investigate, prevent or take action regarding suspected fraudulent, harmful, unethical or illegal activities, or any violation of our terms of use or to protect and defend the legal rights, safety, and property of IMP, our employees, agents and contractors (including to enforce our agreements) or in connection with any safety or security concerns, including the personal safety of our users and the public.

With your consent

We also may share your personal information with a third party in a manner not addressed by this policy with your consent.

Transfer abroad

Under certain circumstances, your personal data may also be transferred to companies abroad within the scope of commissioned processing. These companies are obligated to data protection to the same extent as we are. If the level of data protection in the country to which data is transferred does not correspond to that in Switzerland or the European Union, we contractually ensure that the same level of protection is guaranteed as in Switzerland or the European Union. This can be done through standard data protection clauses of the European Commission or a supervisory authority or approved and authorised codes of conduct together with binding and enforceable obligations of the recipient or authorised certification mechanisms together with binding and enforceable obligations of the recipient.

If data is transferred to a company in the USA, we ensure that this company is certified under the EU-US Data Privacy Framework and, for data from Switzerland, under the Swiss-US Data Privacy Framework. The European Commission (since 10 July 2023) and the Swiss Federal Council (since 15 September 2024) recognise that certified companies ensure an adequate level of data protection. Google LLC is certified under both. In the absence of certification, we obtain the necessary guarantees by contract, for example through standard data protection clauses.

You sharing information with third parties

As mentioned before, we technically enable you to process third party data, such as patient information, through our services. We also enable you technically to inform third parties about such information. You are for example able to send a specific treatment report to another involved health care professional. However, we have no control over whether and which patient date data you may share over our services. You are solely responsible to acquire the necessary consent of the person/patient concerned.

  1. Protection of information

We take data security very seriously and we strive to protect your personal information. We use a variety of industry-standard security technologies and procedures designed to help protect your information from unauthorized access, use, or disclosure (such as access control procedures, network firewalls, and physical security). Unfortunately, there’s no such thing as completely secure data transmission or storage, so we can’t guarantee that our security will not be breached (by technical measures or through violation of our policies and procedures). In the event of a data security breach, we will take all essential actions as required under applicable laws.

The site may contain links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage you to be aware when you leave this site and to read the privacy policies of every site that collects personal information. If you decide to access any of the third-party sites linked to our site, you do this entirely at your own risk. Any links to any partner of the site is the responsibility of that partner.

  1. Duration of storage

IMP will generally only store your personal information for as long as necessary to fulfil the purposes for which we originally collected it. However, depending on the type of personal data to be processed and the purpose of processing, the actual retention periods may vary. In addition, there are laws and local regulations that set minimum periods for the retention of personal data. The actual retention period for your personal data thus depends on whether we process your personal data as part of a contractual relationship with you, based on your explicit consent, whether we process the personal data for our own legitimate interests or whether IMP is legally obliged to retain the personal data for a certain period or to comply with certain legal obligations.

Please remember that when you generate content yourself and make it publicly available through our services, this content and you as the generator are public. Transparency of user content is critical to its effectiveness and trustworthiness.

  1. IMPediaVET app

The IMPediaVET app (the «app») is the iOS app of the platform. This section describes what the app processes in addition to what is set out in the rest of this privacy policy, which also applies to the app.

Sign-in and account data

You sign in to the app with your account on the platform. The app then works with the same account and user content as the web version of the platform and exchanges this data with the platform. What this privacy policy says about the account and about user content applies in the same way.

Data on your device

The app stores data on your device so that it can work, for example your sign-in details, data of your operations and log files of the app. This data stays on your device until you sign out, delete it or uninstall the app. If you control an operation by voice, the app recognises the voice commands on your device; no audio is recorded or sent to us or to third parties. The app also checks locally whether the device is secure enough to run it; this check does not send any data. To tell you when a newer version of the app is available, the app asks Apple's App Store for the latest version number.

Usage analytics, crash reports and remote configuration

The app uses the following services of Google (see «Google Firebase (app)» and «Transfer abroad» above for the provider and the transfer of data abroad):

  • Firebase Analytics records which screens of the app are shown and a few events: signing in, starting an operation (each with the information whether a Wi-Fi connection is available), showing the emergency view, and whether you changed the page of an operation by voice or by touch. Each event is linked to your numeric user number on the platform and to the language set in your account. The events do not contain names, e-mail addresses or patient data.
  • Firebase Crashlytics sends a report when the app crashes or an error occurs. It contains technical information such as device type, operating system version, app version and error details, together with your numeric user number.
  • Firebase Remote Configuration lets the app retrieve technical settings from Google.

We use this to understand which parts of the app are used, to find and fix errors and to keep the app working. The app has no setting to switch this off. If you do not want this, do not use the app; once you uninstall it, the app no longer sends any data.

No tracking, no advertising

The app does not use the advertising identifier of your device and does not track you across apps or websites of other companies. We do not use data from the app for advertising and we do not sell it.

For your rights, see «Your rights» below. To exercise them or if you have questions about the app, see «Contact us» below.

  1. Your rights

You have the legal right to receive information from us about which personal data is stored about you. You can also request the correction of incorrect data or the deletion of personal data, provided that this does not conflict with any legal obligations to maintain data privacy or any legal permissions that allow processing. Furthermore, you may, under certain circumstances, have the processing of your personal data restricted or object to it. You also have the right to demand that we return the personal data you have provided to us (right to data portability). You have the right to receive the data in a structured, commonly used and machine-readable format. You may revoke your consent to any data processing procedure.

Please note that the exercise of your rights may be subject to legal restrictions. We reserve the right to assert these, e.g. if we are obliged to retain or process certain data, if we have an overriding interest in doing so or if we need the data to assert claims. Please note that the exercise of your rights may, under certain circumstances, conflict with contractual agreements and may have corresponding effects on the performance of the contract (e.g. early termination of the contract or cost consequences).

The exercise of your rights requires that you prove your identity (e.g. by means of a copy of your identity card if your identity cannot be established in any other way).

If you are affected by the processing of personal data, you have the right to enforce your rights in court or to file a complaint with the competent supervisory authority. The competent supervisory authority in Switzerland is the Swiss Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

Please note that these rights only relate on your personal data but not on the content you generate and make publicly available through our services. As set out in our terms of use, once you publish your content trough our services we are free to use it and you grant us and our affiliates a non-exclusive, irrevocable, royalty-free, worldwide, perpetual, unlimited and fully sublicensable right to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, perform, display, improve, remove, retain, add, process, analyse, in-dex, tag and commercialize such user content throughout the world in any media on or in connection with the services.

  1. Change of this privacy policy

We reserve the right to modify this privacy policy at any time and in our sole discretion. When we make a change, we will post the updated policy on or through our services. We may, and if required by law will, also provide notification of changes in another way that we believe is reasonably likely to reach you, such as by e-mail (if you have an account where we have your contact information) or another manner through the services. Any modifications to this privacy policy will be effective upon posting or as otherwise indicated at the time of posting. In all cases, by continuing to use the services after posting of the updated policy, you are consenting to the changes.

  1. Contact us

If you have any questions or suggestions about this privacy policy or our privacy practices, you may reach us at info@impedia.org.