Therago

GDPR overview

Compliance is framed under Swiss law first. The privacy policy cites the revised Federal Act on Data Protection (FADP, RS 235.1, in force since 1 September 2023), its ordinance, and Article 321 of the Swiss Criminal Code on professional secrecy. The GDPR is invoked explicitly but conditionally, to the extent that EU residents' data is processed. A data processing agreement compliant with Article 9 FADP is published in full and concluded automatically at sign-up. The rights listed are access, rectification, erasure subject to statutory retention, portability and withdrawal of consent. Patients address their requests to their therapist, the controller. The named supervisory authority is the Swiss Federal Data Protection and Information Commissioner in Bern. Breaches are notified to the regulator promptly and to affected therapists within 24 hours. No Article 27 EU representative is designated.

Who owns the data?

The therapist owns everything they enter. Article 7 of the terms states that the user remains the owner of all data submitted and that the operator acquires no rights over it. Under Swiss data protection law the therapist is the controller and Artt Services Sarl acts only as a processor, working on documented instructions. The publisher goes further and claims it cannot read the records at all: each account holds its own AES-256-GCM master key, so neither the company, its staff nor its host can decrypt patient data. A full export in CSV, JSON or PDF is available at any time, and deletion happens only on the therapist's written request.

Reuse rights

The therapist can reuse their data freely and without asking permission: it is theirs, the publisher claims no licence over it, and a complete export in CSV, JSON or PDF is available at any time from the account. On the publisher's side, use is confined to running the service: encrypted storage of patient records, AI transcription and structuring of dictated notes, invoice generation and delivery, calendar management and reminders, and encrypted backups. Voice recordings are deleted the moment they have been transcribed, and note text is tokenised, with names, dates of birth and identifiers stripped out, before any AI processing. The publisher commits, in its terms, never to train an AI model on customer data, now or later.

Data retention & training

Hosting summary

Everything clinical sits in Switzerland. Patient records, session notes and voice recordings are hosted, processed and transcribed only in Infomaniak's Geneva datacenter, under Swiss law alone, which the publisher states places it outside the reach of the US CLOUD Act. The facility is ISO 27001 certified and runs on renewable energy. Encrypted backups are kept in Switzerland, separately from the main data. Six sub-processors are named: Infomaniak Network SA for hosting and for the AI that structures notes, both in Geneva; MediData SA in Root, Switzerland, for electronic insurer claims; and three in the United States, Resend for email delivery, Stripe for subscription payments and Google for calendar sync. Stripe and Google receive no patient data at all. Resend receives some only when the therapist chooses to email an invoice or reminder, a transfer covered by standard contractual clauses with a section on transfers from Switzerland. Any new sub-processor is notified 30 days before it goes live, with a right to object.