Privacy Policy

Last Updated: 21.08.2026

Protecting your personal data is a top priority for Ortho Analyser. This Privacy Policy explains what we collect, why, on what legal basis, who we share it with, and what rights you have. It applies to our website, to guest analyses, and to the Ortho Analyser platform.

This policy is information, not a contract — reading it is not consent. Where we rely on your consent, we ask for it separately and you can withdraw it at any time.

1. Who We Are

Ortho Analyser is an independent business established in Switzerland, operating the website ortho-analyser.com.

Ortho Analyser is the data controller as described in section 2. For any question about your personal data, or to receive our full business details, contact contact@ortho-analyser.com.

2. Two Different Roles

This distinction matters, because it determines who decides what happens to the data and who you should contact about it.

• We are the controller for data about you — your account, your billing, your use of the website, and any marketing you receive from us. We decide why and how that data is processed.
• We are a processor for patient data uploaded through a professional account. The healthcare professional who uploads it is the controller: it is their patient, their clinical relationship, and their legal responsibility. We process it only on their instructions, to deliver the analysis they requested, and for no purpose of our own.
• For guest analyses, where no account and no clinical relationship exists, we act as the controller. You upload the image voluntarily and must be entitled to do so; we ask that you remove patient-identifying detail where you can. You can ask us to delete it at any time at contact@ortho-analyser.com.

Healthcare professionals acting as controllers can request a Data Processing Agreement (GDPR Article 28) from us at contact@ortho-analyser.com.

3. What We Collect

3.1 Visitors to our website

• Technical data: IP address, browser and device type, pages viewed. Used to keep the site available and to defend against abuse.
• Measurement and advertising data: only if you accept cookies. See our Cookie Policy.

3.2 Guest analyses (no account required)

You can run an analysis without creating an account. In that case we collect:

• The email address you provide, to send you the secure link and your result.
• The image you upload (radiograph, photograph or 3D model) and the analysis produced from it.

3.3 Account holders

• Professional information: first name, last name, professional email address.
• Access information: credentials, stored in hashed form.
• Usage history: analyses performed on the platform.
• Billing information: your purchases and subscription status. Card details are handled entirely by Stripe and never reach our servers.

3.4 Patient data (processed on the clinician's behalf)

• Patient first name and surname.
• Gender.
• Date of birth.
• Imaging data: radiographs, intraoral and facial photographs, 3D models.

4. Why We Process It, and on What Legal Basis

• Providing the service (analyses, accounts, secure access, support) — performance of a contract, GDPR Art. 6(1)(b).
• Processing patient data from professional accounts — on the documented instructions of the healthcare professional who is the controller, GDPR Art. 28.
• Payments and invoicing — contract, and legal obligation for retaining accounting records, GDPR Art. 6(1)(c).
• Security, anti-abuse and rate limiting — legitimate interests in keeping the service available and protecting medical data, GDPR Art. 6(1)(f).
• Analytics and advertising cookies — your consent, GDPR Art. 6(1)(a), given through the cookie banner and withdrawable at any time.
• Marketing emails — your consent where given at the point of submission, or our legitimate interest in telling existing customers about similar services. Every message contains an unsubscribe link.
• Improving the platform — legitimate interests. We use aggregated usage data for this. We do not use patient images to train machine-learning models.

5. Health Data

Radiographs, clinical photographs, 3D models and patient dates of birth are special-category health data under GDPR Article 9, and are treated accordingly.

Where the data is uploaded through a professional account, we process it solely as a processor, on the instructions of the healthcare professional. That professional is responsible for establishing the Article 9 condition that permits the processing — typically the provision of healthcare under Art. 9(2)(h), or the patient's explicit consent under Art. 9(2)(a) — and for informing their patients.

6. Who We Share Data With

We do not sell your data, and we do not share it for anyone else's marketing. We work with the following service providers, each bound by a data processing agreement or equivalent terms:

• Cloud hosting and storage — servers located in the European Union.
• Stripe — payment processing. Stripe is an independent controller for payment data.
• Brevo — transactional and marketing email (France).
• Google Ireland / Google LLC — Google Analytics and Google Ads, only where you have accepted cookies.
• Cloudflare — bot protection on our forms.

Patient data and uploaded images are never shared with our advertising or email providers. They stay within our hosting and storage infrastructure.

7. Where Data Is Stored, and International Transfers

Patient data, account data and uploaded images are stored on servers in the European Union.

Some of our providers are established outside Europe, or may access data from outside Europe for support purposes. This applies to Stripe and, where you have accepted cookies, to Google Analytics and Google Ads. These transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

8. How Long We Keep It

• Guest analyses and uploaded images: kept so that you can return to your result and so that we can provide support. Deleted at your request — email contact@ortho-analyser.com.
• Account and patient data: for as long as the account is active. After closure you have 90 days to export your data, after which it is permanently deleted.
• Invoices and accounting records: 10 years, as required by Swiss law (Art. 958f Code of Obligations).
• Marketing contacts: until you unsubscribe.
• Your cookie choice: one year, stored only in your browser.

9. Security

We implement appropriate technical and organisational measures to protect your data and patient data against unauthorised access, alteration, disclosure or destruction: encryption in transit and at rest, access controls, and passwordless or hashed credentials.

No system is entirely risk-free. If a breach occurs that is likely to result in a risk to affected individuals, we will notify the competent supervisory authority within 72 hours and inform affected users without undue delay.

10. Your Rights

Under the GDPR and the Swiss Federal Act on Data Protection, you have the right to:

• Access the data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests, including direct marketing — which we will always stop on request.
• Data portability in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out.

Contact contact@ortho-analyser.com to exercise any of these. We respond within one month.

If you are a patient whose data was uploaded by a clinician through a professional account, please contact that clinician: they are the controller and we cannot identify or act on your data without their instruction.

You also have the right to lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or in the EU the authority for your country of residence.

11. Cookies

Our use of cookies, including what happens if you decline, is described in full in our Cookie Policy. You can change your choice at any time via the Cookie Settings link at the bottom of any page.

12. Changes to This Policy

We may update this Privacy Policy. Significant changes will be announced by email or by notice on the platform, and the "Last Updated" date above will change.

13. Contact

For any question or request regarding this policy:

Email: contact@ortho-analyser.com