In brief

Shopify, TWINT, PostFinance and Swiss Post operate on this website. In this process, data is transferred abroad, particularly to the United States. The legal basis for this is stated below for each service.

If you write to us via the contact form, we receive the information you enter there and use it to respond to you. For a customer account, we store your login and master data. If you place an order, a payment service provider processes the payment and receives the necessary information, while the shipping service receives your delivery address. Both are named below.

You may request access to your data and have it deleted at any time, unless we are legally required to retain it (for example, the ten-year retention period for receipts under Art. 958f of the Swiss Code of Obligations). A message to jkaiser@plusmedica.ch is sufficient.

This is the summary. The complete statement below is legally binding.

This privacy policy informs you which personal data plus medica ag processes in connection with this website, the purposes for which this is done and the rights you have in this regard. It is based on the Swiss Data Protection Act (revDSG) and the associated Data Protection Ordinance (DPO).

1. Controller

The party responsible for processing personal data in connection with this website is:

plus medica ag
3 Oberwilerstrasse
8442 Hettlingen, Switzerland

For questions about data protection, you can contact us at: jkaiser@plusmedica.ch

2. What data we process

In connection with this website, we process the following categories of personal data in particular:

• Information you provide to us via the contact form (name, email address and message content)

• Information generated when creating and using a customer account (name, address, contact details, order history and login credentials)

• Information relating to orders, their payment and shipping (see the sections “Services used” and “Processing activities”)

• Server log files automatically generated when the website is accessed (including the IP address, date and time of access, page accessed and browser used)

3. Scope

This statement describes the processing of personal data in connection with this website and the services offered through it, including inquiries, orders and registrations submitted through the website.

Processing unrelated to the website is not covered, specifically employee data and any video surveillance on business premises.

Internal systems such as accounting, customer management and office software, insofar as they further process the data from these requests, form part of this statement and are described in the following sections.

4. Data recipients

In addition to the services and hosting provider already mentioned in this statement, the following categories of recipients may gain access to personal data:

• Marketing or advertising agency, insofar as it has been commissioned to manage content, campaigns, or the website on our behalf

These recipients generally process the data as data processors on our behalf and may not use it for their own purposes unless this has been separately agreed.

Disclosure to further third parties takes place only to the recipients named here and in the other sections, and insofar as we are legally obliged to do so, for example to authorities or courts.

5. Hosting / Website Operation

This website is operated on the Shopify platform. The contracting party is Shopify International Limited, based in Dublin, Ireland. In this context, Shopify processes all data generated when operating the website, including server log files, and acts as a data processor.

According to the information available to us, data from customers in Switzerland is initially processed by Shopify International Limited in Ireland and then transferred from there to the parent company Shopify Inc., based in Canada.

Accordingly, personal data is disclosed abroad as part of the hosting:

• Ireland is part of the EEA and is therefore a country with an adequate level of data protection in accordance with the Federal Council's list of countries (Annex 1 DPO).

• Canada is also considered a country with an adequate level of protection for processing in the private sector in accordance with the Federal Council's list of countries (Annex 1 DPO).

An additional legal basis under Art. 16 para. 2 or Art. 17 of the revised Swiss Data Protection Act is not required for this transfer, as the list of countries already confirms an adequate level of protection.

6. Purposes of Processing

We process the aforementioned personal data in particular for the following purposes:

• Provision, operation, and security of the website

• Processing inquiries via the contact form

• Maintaining customer accounts and managing orders

• Processing of payments

• Shipping and delivery of orders

• Communication with you within the scope of our business relationship

• Fulfillment of legal obligations, such as in the area of accounting

7. Cookies & Local Storage

This website uses technically necessary cookies and comparable storage mechanisms in the browser that are required to operate the shop, for example to recognize your session, manage your shopping cart, or maintain your login to your customer account.

These are set by the Shopify platform and do not require consent, as they are necessary to provide the service you have requested.

A consent banner is not implemented on this website. Beyond the aforementioned technically necessary storage mechanisms, we do not use any additional cookies or tracking mechanisms apart from the services mentioned in this statement.

8. Services Used in Detail

TWINT

We offer TWINT as a payment method for processing payments. The contracting party is TWINT AG, Stauffacherstrasse 41, 8004 Zurich, Switzerland.

The data necessary for payment is transmitted to TWINT. TWINT processes some of the data under its own responsibility, in particular for fraud prevention and compliance with regulatory obligations.

As TWINT is based in Switzerland, no disclosure abroad takes place in this respect.

PostFinance

For payment processing, we also use PostFinance. The contracting party is PostFinance AG, Mingerstrasse 20, 3030 Bern, Switzerland.

The data required for payment is transmitted to PostFinance. PostFinance processes some of the data under its own responsibility, in particular as part of its due diligence obligations as a financial service provider.

As PostFinance is based in Switzerland, no disclosure abroad takes place in this respect.

Swiss Post

For shipping and delivery of orders, we work with Swiss Post.

The contracting party is Die Schweizerische Post AG, Wankdorfallee 4, 3030 Bern, Switzerland.

For this purpose, we transmit the information necessary for delivery, in particular your name and delivery address. Swiss Post processes some of the data under its own responsibility as part of its own delivery and security processes.

As Swiss Post is based in Switzerland, no disclosure abroad takes place in this respect.

9. Processing activities in detail

Contact form

If you contact us via the contact form, we process the data you provide (in particular, your name, email address, and message content) to respond to your inquiry.

The legal basis is the performance of the communication you requested or our legitimate interest in processing your inquiry.

Customer account

If you create a customer account, we process the necessary information (name, address, contact details, order history, login details) to enable you to manage your orders and use the shop again.

This data is stored on the Shopify platform; see the section “Website hosting / operation.”

Payment processing

For payment of your order, we use TWINT and PostFinance; see the corresponding sections under “Services used in detail.”

The data necessary for payment are transmitted directly to the payment service provider you select.

Shipping

To ship your order, we transmit the necessary information to Swiss Post; see the section “Services used in detail.”

10. Rights of data subjects

Under the revFADP, you have the following rights in particular:

• Information (Art. 25 revFADP): You may request information about whether and which data we process about you.

• Rectification (Art. 32 para. 1 revised FADP): You may request the rectification of inaccurate data.

• Deletion or destruction: You may request the deletion of your data unless a statutory retention obligation or another permissible reason prevents this.

• Provision or transfer of data (Art. 28 revised FADP): You may request that we provide your data in a commonly used electronic format or transfer it to a third party designated by you.

• Objection to the processing of your data insofar as it is based on a legitimate interest.

• Objection notice and restriction of disclosure (Art. 32 paras. 2 and 3 revised FADP): You may request that disclosure of your data to third parties be blocked or that an objection notice be recorded.

To exercise these rights, please contact the address specified in the “Contact” section.

You may also contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch, at any time and submit a complaint (Art. 49 revised FADP).

11. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse.

This includes, in particular, encrypted transmission (SSL/TLS), restricting access to persons who require it for their duties, and continuously updating the systems used.

Complete protection against every conceivable risk cannot be guaranteed technically.

12. Retention / storage period

As a general rule, we retain personal data only for as long as required for the relevant purpose or as required by law:

• Server log files: Please add: How long does Shopify or your company retain the server log files?

• Contact enquiries: Please add: How long do you retain the information submitted through the contact form?

• Customer account: Please add: How long are customer accounts and the associated data stored after the last use?

• Orders and accounting documents: We retain invoices and accounting documents for at least ten years (Art. 958f Swiss Code of Obligations).

Unless there is a statutory retention obligation, you may request the deletion of your data; see the section “Data subject rights.”

13. Contact

For questions about this privacy policy or the processing of your personal data, please contact:

plus medica ag
3 Oberwilerstrasse
8442 Hettlingen, Switzerland

Email: jkaiser@plusmedica.ch

14. Version

This privacy policy was last updated on 10 September 2026.