Last updated: 21 April 2026
In short
This policy explains which data we process when you visit maia-labs.ch, request a demo or use Maia Labs, for what purposes, with whom we share it and what your rights are. Your patients' health data, when you use Maia Labs as a physician, is covered by a separate data processing agreement.
The data controller within the meaning of the Swiss Federal Act on Data Protection (FADP) is Maia Labs, Geneva, Switzerland.
For any question regarding this policy or the exercise of your rights, write to us at contact@maia-labs.ch.
This policy applies when we process your personal data as data controller, in particular:
What is not covered
When you use Maia Labs as a physician to process your patients' data, you are the controller of that data and Maia Labs acts as processor. That processing is governed by a separate data processing agreement (within the meaning of Art. 9 FADP) concluded with you.
When you visit the public pages of maia-labs.ch (presentation, privacy, terms), we automatically collect your IP address, the type and version of your browser, your operating system, the pages viewed and the duration of your visit. This data is used to measure the audience of the marketing website, to improve it and to ensure its security. No audience measurement is carried out inside the application (physician area).
The form collects only your email address, which is used to contact you about your request. We do not send any marketing email without explicit consent.
Appointments are managed via Calendly. When you book, Calendly collects and transmits to us your name, your email address, the selected time slot and any information you provide voluntarily. This data is used to organise the demonstration and to follow up.
Authentication is managed by Clerk. We collect your email address, a technical identifier, session data and your configuration settings. This data is used to provide the service, manage your account and ensure security.
Patient data. The documents and information you upload to generate reports are processed under a “zero retention” model: in-memory transit, immediate purge. No patient data is persisted. All processing takes place on infrastructure hosted in Switzerland; patient data never leaves Swiss territory.
When you write to us, we process the information provided (address, message, attachments) in order to respond to your request.
We use two categories of cookies, strictly limited to the public pages of the website and to account management:
| Category | Purpose | Duration |
|---|---|---|
| Strictly necessary | Operation of the website and the application, authentication, session security. Disabling them renders the service unusable. | Session |
| Audience measurement (marketing website only) | Understanding the use of the public pages of the website (presentation, privacy, terms). No tracker is loaded in the physician area. | Up to 13 months |
Managing your preferences. You may accept or refuse non-essential cookies via the consent banner or your browser settings. Refusal does not affect your access to the website.
We never sell your data. The processing of patient data takes place exclusively on cloud infrastructure hosted in Switzerland: this data is not accessible to any processor established abroad. For the operation of the marketing website, account management and the sending of emails, we use the following providers:
| Provider | Purpose | Location |
|---|---|---|
| Infomaniak | Hosting of the application and the marketing website, encrypted storage and execution of artificial intelligence models on cloud infrastructure located in Switzerland. The only environment that processes patient data. | Switzerland |
| Clerk | Authentication of the physician account (email, identifier, session). Does not process any patient data. | United States |
| Resend | Sending of service emails (account, notifications, newsletter). Does not process any patient data. | United States |
| Calendly | Scheduling of demonstrations (before account creation) | United States |
| Google Analytics | Audience measurement of the public pages of the marketing website. Does not process any patient data. | United States |
Patient data: no transfer abroad. All processing (receipt, analysis, report generation) takes place on infrastructure hosted in Switzerland. Patient data never leaves Swiss territory.
The providers involved in the marketing website, account management, the sending of emails or the scheduling of demonstrations (see Section 6) may be established abroad. The related transfers rely on the Swiss-US Data Privacy Framework or on standard contractual clauses recognised by the FDPIC, and never concern patient data.
| Data | Duration |
|---|---|
| Browsing (logs, cookies) | Up to 13 months (Google Analytics); limited server logs |
| Access request | 12 months after the last exchange |
| Calendly appointment | 12 months after the appointment |
| Account and configuration | Duration of the contract, then deletion within 7 days |
| Email correspondence | Up to 24 months |
We apply appropriate technical and organisational measures: TLS 1.3 encryption in transit, AES-256 at rest, full hosting in Switzerland for patient data, strict access control, logging of sensitive access.
In accordance with the FADP, you have the following rights:
To exercise these rights, write to us at contact@maia-labs.ch. We respond as soon as possible and at the latest within 30 days. We may request proof of identity.
Maia Labs does not make automated individual decisions within the meaning of Art. 21 FADP. The artificial intelligence features generate draft documents which are systematically reviewed and validated by the physician before any use.
We may amend this policy to reflect legal or technical developments or changes to our service. The version in force is the one published on maia-labs.ch. In the event of a substantial change, we will inform you (banner on the website, email to account holders).
Maia Labs, Geneva, Switzerland
contact@maia-labs.ch
This policy is drafted in French. In the event of any discrepancy between a translated version and the French version, the French version shall prevail.