Privacy notice for participants

1. Controller and contact

The Swiss Ophthalmological Society (SOG), represented by its Board, is the controller. The project contact is Prof. Dr. med. Matthias Becker, President of the SOG Tariff Commission and Chair of the AL Upper Limit Taskforce.

Contact: SOG-Office c/o IMK, Munsterberg 1, 4001 Basel; sog@imk.ch; +41 61 561 53 66. Strategic Data Insights GmbH, Cham, operates the intake service as SOG's processor.

2. Purpose and provisional legal basis

Data is collected only to quantify the effect in ophthalmology of the proposed upper limit on AL tariff points billable per working day and to support the approval procedure.

SOG's draft identifies your consent and the professional association's overriding interest in its statutory tariff role under Article 31 FADP. Final legal assessment is pending. Use to assess, compare or take action against an individual member is excluded.

3. Data processed

Only information needed for registration, secure transfer and analysis is processed.

• Contact email, K1 or K2 class, and software identifier or participation token.
• Structure, tariff, monthly, working-day and case-count data entered in the questionnaire and workbook.
• Receipt numbers, timestamps, status, cryptographic checksums and security/audit evidence.
• Necessary web/WAF logs may include IP address, time, path, status code and technical network metadata.
• One strictly necessary secure session cookie supports language and CSRF protection; there is no advertising or user tracking.

4. Data that must not be submitted

Patient data and direct identifiers are outside this survey.

• No diagnoses, patient names, birth dates, social-security or insurance numbers, or patient free text.
• No names or addresses of practices or doctors, and no GLN or ZSR numbers.
• No revenue, income, costs or profits.

5. Pseudonymisation and analysis

The survey is pseudonymous, not anonymous. K1 is a software provider identifier that may be matched in the analysis zone to export rows from the same provider. The lookup table remains with the provider and never reaches SOG.

K2 is issued by the intake service. It is not linked to exports and is analysed only by strata. K1 and K2 are reported separately. Pseudonymised data remains personal data while a key exists anywhere.

6. Recipients and access

The intake service sees the submission and contact detail, then separates the contact before the analysis zone. The analysis zone receives answers with an identifier or token but no contact data. SOG bodies receive aggregates only.

No individual data is disclosed to authorities, insurers, tariff partners, media or other data partners. Output requires at least five providers and three partners, with no partner contributing more than half of the displayed value.

7. Technology, providers and location

The application and storage are designed for Microsoft Azure Switzerland North; geo-redundant core storage uses the Swiss region pair with Switzerland West. Transfer and storage are encrypted. Files are isolated, malware- and structure-checked, then signed before onward transfer. PDFs are rebuilt as images and transcribed by two distinct reviewers.

Public access currently uses Azure Front Door. Microsoft describes Front Door as a global service that terminates TLS at the edge, decrypts the request for WAF/routing and re-encrypts it to the Swiss origin. Formal SOG/privacy approval of this edge path and its contractual safeguards is still pending.

No raw row or individual record is sent to an external AI tool. The portal embeds no advertising, analytics, maps, video or social media service.

8. Automated checks

Uploads are checked automatically for malware, file type, structure and defined content rules. An adverse or unclear result blocks processing or triggers manual review; it is not a decision about you or your membership.

9. Retention and deletion

The supplied SOG draft specifies the periods below. Automatic deletion is not active in the documented production configuration. Until it is automated, the same deadlines must be operated manually and evidenced.

• Registration contacts: no later than 90 days after confirmed transfer of the related return.
• Intake copy: normally five working days, no later than 90 days after confirmed transfer to the analysis zone.
• Unaggregated raw rows: delete by 30 June 2027 with evidence.
• Aggregates, results volume, codebook, check records, delivery register, audit trail and contracts: ten years after completion.
• Every material deletion should be countersigned under the four-eyes principle and recorded in the deletion register.

10. Your rights

Participation is voluntary. The draft provides for access, correction, data delivery/portability and withdrawal until the results volume is released. Published aggregates are not changed retrospectively. Quote your identifier or token and, if available, your receipt number. Do not email survey files or patient data.

11. Version and changes

Only the version approved by SOG and supplied with the questionnaire is intended to control. Changes affecting rights must be versioned and communicated. At consent, this portal records the version, language and SHA-256 digest of the text.

Official sources / Offizielle Quellen

• Swiss Federal Act on Data Protection / Bundesgesetz über den Datenschutz
• FDPIC/EDÖB information duty guidance
• Microsoft: Azure Front Door end-to-end TLS