Privacy Policy
Last updated: 8 October 2026
This Privacy Policy explains what personal data Ortho Analyser collects through ortho-analyser.com, the academy and the waiting list, why, on what legal basis, who we share it with, how long we keep it, and what rights you have.
This policy is information, not a contract. Where we rely on your consent, we ask for it separately, and you can withdraw it at any time.
1. Who we are
Ortho-Analyser, an independent business established in Switzerland, is the controller of the data described here. Contact: contact@ortho-analyser.com.
2. What we collect
2.1 Visiting the website
- Technical data — IP address, browser and device type, pages requested. Used to keep the site running and to block abuse, such as automated scanning or repeated form submissions.
- Measurement and advertising data — only if you accept cookies. See our Cookie Policy.
2.2 Joining the waiting list
- Your email address, the language you were reading in, and the date you joined. Used only to tell you when our clinical software is available.
2.3 Your academy account
- Account — your email address and language. If you set a password, we store it only in hashed form.
- Learning record — the courses you joined, the lessons you marked done, your quiz answers and scores, and on tracing exercises the points you placed, their distance from the reference and your answers. This is what lets you resume a course and see your feedback.
- Contact record — your email address, language, and which courses you joined or bought, kept in our email tool (Brevo) so we can write to you about your courses.
2.4 Buying a course
- The course, the amount paid and the currency, the date, your email address, and the payment references Stripe gives us.
- Your card details are entered on Stripe's page and never reach our servers.
2.5 Writing to us
- What you send us, and our reply.
3. Why we process it, and on what legal basis
- Running your account and courses, and selling courses — performance of a contract (GDPR art. 6(1)(b)).
- Keeping purchase records — legal obligation to keep accounting records (GDPR art. 6(1)(c); Swiss Code of Obligations art. 958f).
- The waiting list — your consent, given when you submit your address (GDPR art. 6(1)(a)). Withdraw it by unsubscribing.
- Emails about the academy — messages about courses you joined or bought: performance of the contract. Announcements of new courses: your consent if you ticked "Tell me about new courses" when joining a free course (GDPR art. 6(1)(a)); if you bought a course, our legitimate interest in telling customers about similar courses (art. 6(1)(f)). Every such email carries an unsubscribe link, and unsubscribing stops them at once.
- Security and preventing abuse — our legitimate interest in keeping the site available and safe (GDPR art. 6(1)(f)).
- Analytics and advertising cookies — your consent, through the cookie banner (GDPR art. 6(1)(a)).
- Improving the courses — our legitimate interest. We look at learning records in aggregate, for example which landmarks are most often misplaced, to improve the teaching.
We do not make decisions about you based solely on automated processing. Exercise scores are computed automatically, but they only give you feedback.
4. Who we share it with
We do not sell your data or share it for anyone else's marketing. We use these providers, each bound by a data processing agreement or equivalent terms:
- Google Cloud — hosting, database and file storage, in the European Union.
- Infomaniak (Switzerland) — sending our emails: sign-in links, course links, purchase confirmations.
- Brevo (France) — our contact lists: the waiting list and academy students, and the emails we send to them.
- Stripe — payments. Stripe is an independent controller for the payment data it collects.
- Google Ireland / Google LLC — Google Analytics and Google Ads, only if you accept cookies.
- Cloudflare — bot protection on some of our forms.
Your learning record — answers, scores, placed points — is not shared with any of them except our hosting provider. Brevo receives only your contact record (section 2.3).
5. International transfers
Your account, learning record and purchase records are stored in the European Union. Stripe, and Google where you accepted cookies, may process data outside Europe. These transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US and Swiss–US Data Privacy Frameworks.
6. How long we keep it
- Account and learning record — while your account is open. When you close it, they are deleted within 30 days.
- Purchase records — 10 years, as Swiss accounting law requires, even after your account is closed. They then hold only what an accounting record needs: the course, the amount, the date, your email address and the payment references.
- Waiting list and student contact record in Brevo — until you unsubscribe, close your account or ask us to delete it.
- Emails you send us — as long as needed to deal with your request, and at most 3 years.
- Your cookie choice and your light or dark display preference — stored only in your own browser.
7. Teaching cases
The radiographs used in our exercises are anonymised before use: nothing in them is meant to identify the person they show. They are used for teaching with that person's consent, or come from datasets licensed for that purpose.
8. Security
We protect your data with encryption in transit and at rest, restricted access, and hashed or passwordless credentials. No system is entirely risk-free. If a breach is likely to put you at risk, we will notify the competent authority within 72 hours and tell you without undue delay.
9. Your rights
Under the GDPR and the Swiss Federal Act on Data Protection, you may ask to access, correct or delete your data, restrict or object to its processing, receive it in a portable format, and withdraw any consent at any time. Write to contact@ortho-analyser.com; we reply within one month. Some data cannot be deleted on request while the law requires us to keep it, such as purchase records.
You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the European Union the authority of your country of residence.
10. Children
The academy is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes to this policy
We may update this policy. The "Last updated" date above will change, and we will tell account holders by email about significant changes.