Privacy Policy

Who is responsible

Whisperme is operated by Martin Kutter, Hanfgartenstrasse 36, 8626 Ottikon, Switzerland. For questions about this policy, write to hello@whisperme.ch.

We hold two different roles. For the account details of the people who work in a practice, we are the controller. For the patient data a practice enters, the practice is the controller and we only act on its instructions.

What we store

We store what the service needs to run, and nothing else:

• Your account: first and last name, title, job description, email address and, if you upload one, a photo.
• Your practice: name, address, phone number, email address, website, working hours, time off and, if you upload one, a logo.
• Patients, entered by the practice: name, email address, mobile number, date of birth, insurer and insurance number, preferred language, internal notes, appointments with their status, and a record of the consent the practice attested.
• Server logs with the IP address and the time of a request, kept briefly so we can find faults and abuse.
• A log of every email we send. For emails to people who work in a practice, it holds the recipient's address, the subject, the time and whether the email was delivered, and the full content only of emails without a sign-in or download link, such as messages about the service. For emails to patients, it holds only the practice, the type of email, the time and whether it was delivered: never the address, the subject or the content.
• Messages about the service that we send you, with a record of when each one was delivered and whether you read it.

Why we use it

To provide the service the practice signed up for: showing the calendar, keeping patient records for scheduling, and sending appointment confirmations and reminders.

The legal basis is the contract with the practice, our legitimate interest in running a secure service, and, for messages to patients, the consent the practice records before it adds them.

Signing in

There are no passwords. When you sign in we email a one-time link to your address, and a session cookie keeps you signed in afterwards. If you change the address you sign in with, the change only takes effect once you open a confirmation link sent to the new address.

Support access

The people who run Whisperme for us can open an admin area to help practices. They sign in with a one-time email link plus a code from an authenticator app.

There they see the account details of the people who work in a practice (name, email address, role, practice and roughly when they last signed in) and the details of the practice. Of patients and appointments they see only how many there are: never names, contact details, notes or appointments, and never the content of emails to patients. They cannot sign in as you or see the app as you see it.

Every action in the admin area is written to an audit log, which we keep for as long as the service runs.

Cookies and local storage

We only set the cookies and browser storage the service needs to work and, if you agree, a few that remember your preferences. We ask for that consent in a banner on your first visit.

Necessary cookies are always on: they keep you signed in and protect the service. Preferences are only kept beyond your visit with your consent; without it the language cookie ends when you close the browser, and your theme and sidebar are remembered only in the open tab.

You can change or withdraw your consent at any time with “Cookie settings” at the bottom of every page. Withdrawing it removes the stored preferences from your browser.

There is no advertising, no analytics, no tracking and no third-party script anywhere in the service.

• authjs.session-token (necessary, 30 days): keeps you signed in. Over a secure connection it is called __Secure-authjs.session-token.
• authjs.csrf-token (necessary, until you close the browser): protects the sign-in form against forged requests. Over a secure connection it is called __Host-authjs.csrf-token.
• authjs.callback-url (necessary, until you close the browser): remembers where to take you after signing in. Over a secure connection it is called __Secure-authjs.callback-url.
• wm_consent (necessary, 1 year): remembers your cookie choice.
• NEXT_LOCALE (preference, 1 year with your consent, otherwise until you close the browser): remembers the language you picked.
• theme (preference, only with your consent, kept in your browser’s local storage until you withdraw it; not a cookie): remembers whether you chose the light or dark theme.
• sidebar (preference, only with your consent, kept in your browser’s local storage until you withdraw it; not a cookie): remembers whether the sidebar is collapsed.

Push notifications

If you turn on notifications on a device, your browser gives us an address at its push service (Google, Apple, Mozilla or Microsoft, depending on the browser). Messages to that address are end-to-end encrypted: the push service relays them but cannot read them. Notifications to patients never name the practice or the reason for the appointment.

You can turn notifications off at any time on the page where you enabled them, in your browser settings, or by asking your practice to remove your devices. Addresses that stop working are deleted automatically.

Messages from Whisperme

We may send the people who work in a practice messages about the service, in the app's inbox, by email, or both.

You can switch off general news emails in your notification settings with “Email me news about Whisperme”. Messages written to you personally or to your practice still arrive. In the inbox you can mark messages as read or unread and delete them; we keep a record that a message was delivered and whether it was read.

Who else processes data

We keep the circle as small as we can:

• Hosting: Infomaniak Network SA, Geneva, Switzerland. The database and any uploaded images are stored in Switzerland.
• Email delivery: Resend, which sends sign-in links, appointment confirmations and reminders on our behalf.
• Text messages: only when a practice switches them on for a patient, through the messaging provider we use for that.
• Translation: DeepL SE, Cologne, Germany, which may machine-translate the text of our own messages about the service. It never receives patient data or account data.
• We do not sell data, and we pass it to nobody else unless the law obliges us to.

How long we keep it

Account and practice data stay while the account exists. Patient data stays as long as the practice keeps it.

A practice can archive a patient and then erase them. Erasing permanently removes the name, contact details, date of birth, insurance details and notes, drops any queued messages and redacts the audit trail. What remains is appointment history without personal data, which the practice needs for its own records.

A practice owner can download all of the practice's data (the practice, its team, patients, appointments, availability and notification history) as an encrypted ZIP file of spreadsheets. We store that file encrypted on our server and delete it after 7 days.

When a practice is deleted, it first stays read-only for 30 days. Then we permanently delete the practice, its patients and appointments, and the accounts of its team members who belong to no other practice. If we remove a practice immediately, its owners get a download link to its data that works for 30 days. Afterwards we keep only an audit entry with the practice's name and the numbers of what was deleted, no patient data.

Server logs are kept briefly and then discarded. Entries in the email log are deleted after 90 days. The audit log of the admin area is kept for as long as the service runs.

Your rights

Under Swiss data protection law you may ask what we hold about you, have it corrected or erased, object to its processing, and receive a copy in a common format.

If you are a patient of a practice, ask the practice: your record belongs to them and we act on their instructions. We will help them answer you.

Write to hello@whisperme.ch. If you are not satisfied, you can complain to the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern.

Security

Traffic runs over encrypted connections. Each practice sees only its own data, every change to a patient record is written to an audit log, and access to the servers is limited to the people who operate the service. Our support staff sign in with a second factor, and data exports are stored encrypted.

Changes to this policy

When the service changes, this page changes with it. The date at the top tells you which version you are reading.