Data processing agreement

Version of 2 October 2026.

This agreement supplements the terms of use. It applies as soon as you use nursee’s patient management and must be accepted in your dashboard before you can access it.

1. Parties and roles

This agreement is made between you, the care professional or practice holding the account (“the Controller”), and ESAHO Sàrl, Chemin des Sources 9, 1752 Villars-sur-Glâne, Suisse, UID CHE-493.361.315, which operates nursee (“nursee” or “the Processor”).

For your patients’ data you are the controller within the meaning of the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR: you decide which data is recorded and for what purpose. nursee processes this data solely on your behalf, as a processor (art. 9 FADP, art. 28 GDPR).

2. Subject matter, nature and purpose of the processing

nursee provides you with online software to keep your patients’ records, manage their appointments and your communication with them. The processing covers hosting, storing, viewing, editing, exporting and deleting this data, for the sole purpose of providing this service.

3. Data and data subjects

Data subjects: your patients and their relatives, and people who write to you or book an appointment through your website.

Categories of data: identity and contact data, appointments, messages, notes and care-related information you enter (for example allergies or care context). Health data is sensitive personal data within the meaning of art. 5 FADP and art. 9 GDPR; it benefits from the reinforced protection measures described in section 7.

4. Duration

This agreement applies for as long as you use patient management and ends when your subscription no longer includes it. Confidentiality obligations survive its termination.

5. Processing on instructions only

nursee processes your patients’ data only on your instructions, which result from your use of the service and from this agreement, and never for its own purposes (no advertising, no resale, no training of AI models). If an instruction appears to us to infringe applicable law, we will inform you.

6. Confidentiality and professional secrecy

You are bound by professional secrecy (art. 321 of the Swiss Criminal Code). nursee acts as an auxiliary within the meaning of that provision and is bound by the same discretion. Only the operator of nursee has access to the infrastructure (servers and database). Our support team does not look at your patients’ records: the application gives it no access to them.

7. Security measures

nursee implements technical and organisational measures appropriate to the risks, in particular:

• encryption of stored patient data (names, contact details, notes) and of connections (HTTPS);
• access to patient data restricted to the account holder, with mandatory two-factor authentication;
• a log of access to records (viewing, editing, export, deletion), kept for two years and provided on request;
• strict separation of data between practices;
• database hosted in Switzerland;
• security updates and control of access to the infrastructure.

We may develop these measures further, provided that at least the same level of protection is maintained.

8. Sub-processors

You authorise nursee to engage the following sub-processors to provide the service:

• Infomaniak Network SA (Switzerland) — database hosting and email delivery;
• Vercel Inc. (United States / European Union) — running the application and the website;
• Hetzner Online GmbH (Germany, EU) — storage of uploaded files (images and videos).

We inform you of any addition or replacement at least 30 days in advance; you may object on data protection grounds and, failing agreement, terminate your subscription before the change takes effect.

9. Transfers abroad

Where a sub-processor processes data outside Switzerland or the European Economic Area, nursee ensures an adequate level of protection (adequacy decision, standard contractual clauses recognised by the FDPIC, or equivalent safeguards).

10. Assistance with patients’ rights

The service lets you answer your patients’ requests yourself: access, rectification, export (a patient’s data export) and deletion. A care record can only be deleted once the legal retention period has passed (10 years after the last contact); until then, you can archive it.

11. Data security breaches

nursee informs you as soon as possible, in principle within 48 hours of becoming aware of it, of any data security breach affecting your patients’ data, with the information you need to report it, where required, to the Federal Data Protection and Information Commissioner (FDPIC) and to inform the data subjects.

12. End of the agreement: return and deletion

As long as your subscription includes patient management, you can export each patient’s record from your dashboard; after that, access to the records is closed. The legal retention obligations for care records are yours: export them before the end. 90 days after access ends, nursee permanently deletes the patient records (patient files, notes and saved emails); you receive an email reminder at least 30 days before the deletion, which is postponed for as long as the reminder could not be sent, and the date is shown in your dashboard. If you take out a subscription that includes patient management again before that date, the deletion is cancelled. Deleting your site deletes these records immediately, together with your appointments and messages.

13. Information and audits

nursee makes available to you the information needed to demonstrate compliance with this agreement and answers your written questions about the security measures. On-site audits, if necessary, are agreed in advance, at your expense, and respect the confidentiality of other customers.

14. Liability, applicable law and jurisdiction

Liability is governed by the terms of use. This agreement is governed by Swiss law. The exclusive place of jurisdiction is Fribourg (Switzerland), subject to any mandatory place of jurisdiction provided by law.

15. Acceptance and changes

You accept this agreement electronically in your dashboard; the date and the version accepted are recorded on your account. In the event of a material change, a new version is presented to you and must be accepted before you continue to use patient management. For any question: info@nursee.ch.