Legal

Privacy policy

Effective date: 30 October 2026

Last update: 30 October 2026

This Privacy Policy explains how Ahead Health (“Controller”, “we”, “us”, or “our”) collects, uses, and discloses your personal data as a Controller for the provision of our services and the related features.

Protecting your personal data when using our services is of utmost importance to us. Therefore, we collect and process your data exclusively in accordance with the applicable data protection laws, in particular with the Swiss Federal Act on Data Protection (“FADP”) and, where applicable, the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

All data protection-related terms shall have the meaning as defined in the GDPR.

1. Data controller and EU representative

The data controller responsible for processing your personal data is:

Ahead Health AG
Uraniastrasse 31
8001 Zurich
Switzerland
Email: privacy@aheadhealth.com

Where you receive services from partner clinics and hospitals or test centres, they act as independent controllers for the test they carry out. Please consult their privacy policy for further information on how they process your personal data. Medical healthcare professionals who provide consultations based on the results of your check-up also act as controllers to the extent that they are not employed by us. Please consult their privacy policy for further information on how they process your personal data.

If you reside or are located in the EU, or you are a member of a data protection supervisory authority in the EU, you can contact our EU representative by email or post with any enquiries as follows:

EU representative:
IT.LAW GmbH
Colmanstr. 15
53115 Bonn, Germany
Telephone: +49 228 74 898 0
Fax: +49 228 74 898 66
Email: info@it.law

2. What personal data do we process, for what purposes and on what legal basis?

We normally collect personal data about you directly from you or indirectly from the partner clinic and hospital or test centre you visit for your check-up and medical healthcare professionals, to the extent you have consented to them sharing your information with us. We may also collect personal data about you from publicly available sources.

2.1 Providing our services

Creation of a user account, booking of a check-up and use of our platform

When you sign up for our services (create a user account, sign up as a member, book your check-up via our website and use our platform) we collect the following personal data:

Contact and private information: name, gender, date of birth, address, email address, phone number
Health data: information relating to the check-up selected by you, including, but not limited to, the examination and assessment you select to be performed (such as full-body MRI or blood tests) as well as any additional services chosen as part of your check-ups. This also includes information on the partner clinics and hospitals or test centres and medical healthcare professionals assigned to you and booking details for your check-up, such as the date and time of the appointment; results of your check-up/personalised health assessment (e.g., MRI imaging, blood test results etc.), consultation notes (and recordings of video consultations, if chosen by you), recommendations from the medical healthcare professional (e.g., exercise schedule, medication or supplements prescribed, further check-ups, etc.), progress on your personalised lifestyle and health plan, results from follow-up assessments and other health information you provide to us (e.g., medical history, or data from a device or health app you choose to share, see section 2.7)
Payment data: payment details such as your credit card number or billing address
Communication data: any information, such as messages and documents, that you exchange with us

We process this personal data for the purpose of providing our services, in particular to book your check-up, create your personalised lifestyle and health plan and track your progress, create and manage your personalised user account, and issue invoices for our services as well as for the services provided by the partner clinic and hospital, test centre or medical healthcare professional.

Legal basis: The processing of this personal data is based on art. 6(1)(b) GDPR (performance of the contract). To the extent that health data is processed, the processing is based on your explicit consent pursuant to art. 9(2)(a) GDPR.

Information you provide to us

We process the personal data that you provide to us in connection with our services, for example through questionnaires, forms, our insurance checker, newsletter campaigns, document uploads, communications with us or our medical healthcare professionals, and any other information you choose to share with us either before, during or after your check-up. In particular, we may process the following categories of personal data:

Health data, including: health records, personal medical history, allergies, current medications, family medical history, information about injuries, symptoms, diagnoses, past and current treatments, conditions, laboratory results, imaging reports, data from wearables and fitness trackers, and other health-related information or documents.

We process this personal data for the purpose of providing our services, in particular organising the check-ups and preparing your health report.

Legal basis: The processing of this personal data is based on art. 6(1)(b) GDPR, as it is necessary for the performance of the contract. To the extent that health data is processed, the processing is based on your explicit consent pursuant to art. 9(2)(a) GDPR.

Consultations

If you book a consultation with one of our medical healthcare professionals, whether in person, by telephone, by video conference or through any other communication channel, we will share your personal data (including your contact information and health data) with them so that they can provide the requested consultation. If a consultation is conducted via video and is recorded, we store the recordings of the video consultation.

We also store information collected during the consultation, including notes, assessments, recommendations and other records created by the medical healthcare professional. Such information may be incorporated into your personalised health report and personalised lifestyle and health plan.

Health insurance check

On our website you can check if your health insurance covers all or part of the check-up costs. For this purpose, we process information about your health insurance provider, your health insurance information and, where applicable, any supplementary insurance coverage you may have.

Legal basis: The processing of this personal data is based on your consent pursuant to art. 6(1)(a) GDPR. To the extent that health data is processed, the processing is based on your explicit consent pursuant to art. 9(2)(a) GDPR.

Communication with customer support channels and reviews

When you communicate with us by telephone, via live chat on our website, social media platforms, messenger applications/platforms or email, we process the personal data that you provide to us in the course of such communication (e.g., your name, contact details and the content of the communication).

If you leave a review of our services on a publicly available website such as Google, the personal data you share may be publicly available. In these cases, the respective platform provider is the controller of your personal data. For more information on how they process your personal data please consult their privacy notices. We may also display or reference such reviews on our website and in our marketing materials.

Legal basis: The processing of this personal data is based on art. 6(1)(b) GDPR where the communication is necessary for the performance of a contract or in order to take steps prior to entering into a contract. In other cases, the processing is based on our overriding interest in providing our services to you and answering your requests pursuant to art. 6(1)(f) GDPR. To the extent that health data is processed, the processing is based on your explicit consent pursuant to art. 9(2)(a) GDPR.

Educational content

When you use our platform, we may provide you with educational content (such as scientific research articles) that we believe may be relevant or of interest to you. Such content may be suggested based on aggregated information (for example, age or gender) as well as information contained in your health report and personalised lifestyle and health plan and other health-related information you provide through our services.

Legal basis: The processing of this personal data is based on our overriding interest in providing meaningful content to our users pursuant to art. 6(1)(f) GDPR. To the extent that health data is processed in this context, the processing is based on your explicit consent pursuant to art. 9(2)(a) GDPR.

2.2 Statistical analyses and product improvement

We use health data or other personal data for statistical analyses, product development, the training or improvement of AI models and the development of diagnostic algorithms only in a fully anonymised form. Once anonymised, the data can no longer be attributed to you and is no longer considered personal data.

In the cases where anonymisation is not possible or would prevent intended research or development activities from being carried out, we may use health data for these purposes only if you have given your separate explicit consent according to art. 9(2)(a) GDPR. Before obtaining such consent, we will provide you with further information about the personal data concerned, the purposes of the processing, any pseudonymisation or anonymisation, the retention period and your rights.

Where the terms of a connected service restrict these uses, we follow those terms. This applies in particular to data received from Google Health, which is subject to the Limited Use requirements (see section 2.7).

2.3 Use of the website and platform

While accessing our website and our platform we process the following categories of personal data:

Device information, such as IP address, device type, operating system information, browser information;
Usage data, such as referrer URL, user settings, browser type, session ID, authentication data and visitor time, interactions with our website, demographic characteristics and interests;
Location data derived from your IP address.

We collect and process this personal data to ensure the proper functioning of our website and platform, to further develop and improve our website and platform, to provide you with a personalised experience of our website and platform and to ensure a seamless user experience.

Legal basis: The processing of this personal data is based on art. 6(1)(b) GDPR, where it is necessary for the performance of a contract or to take steps prior to entering into a contract, and on art. 6(1)(f) GDPR, where the processing is necessary for our legitimate interest in ensuring the functionality and user-friendliness of our website and platform and to further develop and improve them.

2.4 Newsletter subscription and marketing

If you subscribe to our newsletter or other forms of marketing we will collect and process your email address. We may also send you newsletters if you are already a customer of ours. The purpose is to send you updates and news about our services.

Legal basis: The processing of this personal data is based on the consent you provide by subscribing to our newsletter (art. 6(1)(a) GDPR). If you are already a customer of ours, we can send you newsletters without obtaining your prior consent (art. 6(1)(f) GDPR). You can revoke your consent or unsubscribe from our newsletters at any time by clicking on the “unsubscribe” button at the bottom of all our newsletters or by contacting us as described below in section 10. In addition, we may process your personal data to send you information about our latest developments (incl. new features, products and services that may interest you), to invite you to events or to ask you to participate in our surveys or competitions.

Legal basis: We process your personal data based on our overriding interest in informing you about our latest developments and events which we believe could be interesting to you pursuant to art. 6(1)(f) GDPR. If you decide to participate in our surveys the processing is based on your consent pursuant to art. 6(1)(a) GDPR. To the extent that health data is processed, the processing is based on your explicit consent pursuant to art. 9(2)(a) GDPR.

2.5 Recruiting

As part of our recruitment process, we collect and process the following personal data:

contact information
CVs
qualifications
references
diplomas
other information voluntarily provided by the applicant

When you submit an application to us via post, email or through our application form, we collect and process this personal data to assess your suitability for current or future employment opportunities and to comply with any related legal and regulatory obligations.

Legal basis: The processing of this personal data is based on the necessity to take steps at your request prior to entering into a contract between you and us (art. 6(1)(b) GDPR) as well as your consent to the processing of the personal data for the above specified purpose, in particular, if you agree for us to keep your information for future opportunities and for any additional information voluntarily provided by you (art. 6(1)(a) GDPR).

2.6 Legal and other purposes

We also process your personal data to fulfil any legal obligations and to assert, defend or enforce claims or if we have any other overriding interest to do so. In such cases, we will inform you about such processing activities, to the extent required by applicable data protection laws.

Legal basis: The processing of this personal data is based on art. 6(1)(c) and (f) GDPR in conjunction with the relevant specific statutory provisions of art. 9(2)(i) and (j) GDPR to the extent that your health data is processed.

2.7 Wearable devices, health apps and fitness data

You can choose to share data from a wearable device or health app with us, by connecting an account or uploading a data export. We only collect this data after you have given your explicit consent. We tell you which devices and apps are supported, and the period of data we read, when you connect a source.

We collect activity, heart, sleep and body measurement readings, and the connection details needed to read them. We do not collect your location.

The doctors reviewing your results use this data together with your check-up results and other information you give us in the context of your check-up, supported by our AI-assisted tools (see section 3). We do not sell wearable data or use it for advertising or for decisions about credit, insurance or employment. We do not use data from Google Health for research or to train AI models.

We share wearable data only with the doctors and clinical staff preparing your report, and with Google Cloud, which hosts and processes it on our behalf (see section 7).

You can disconnect a source at any time in your account settings or with the provider. We then stop reading new data. You can ask us to delete your readings via your account settings or at privacy@aheadhealth.com, and we will do so without undue delay, except where they form part of your medical record (section 9).

The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.

Legal basis: Your explicit consent pursuant to art. 9(2)(a) GDPR. Withdrawal does not affect processing that took place before.

3. Profiling and automated individual decisions

We may use automated processing of your personal data (“profiling”) to personalise the content and recommendations we provide to you. Based on your profile, health report and other health data you provide, as well as your use of our services, we may suggest educational content, relevant health data, health check-ups, treatments, and other services offered by Ahead Health that may be relevant to you.

To the extent that we process personal data other than health data for the above listed purposes, such processing is based on our legitimate interests pursuant to art. 6(1)(f) GDPR, namely to provide you with relevant information about our services and content. To the extent that health data is processed for these purposes, such processing is based on your explicit consent pursuant to art. 9(2)(a) GDPR.

While we process personal data as described above to tailor content and recommendations to your interests and health profile, we do not make decisions about you based solely on automated processing that would have legal or similarly significant effects on you within the meaning of art. 22 GDPR. However, should our processes change in this regard, we will inform you in advance of such processing.

4. Do we use cookies and other tracking tools?

This website uses cookies. In our Cookie Policy, we explain in more detail what cookies are and what they are used for. You can find our Cookie Policy here.

5. Do we use social media plugins?

Our website and platform contain social media plugins (such as Facebook, Instagram, LinkedIn) that allow you to connect with your social media accounts. These plugins may collect information about your browsing behaviour and send it to the social media provider. When you interact with these plugins:

The social media provider may receive information that you’ve visited our website.
If you’re logged into your social media account while browsing our site, the provider may link this information to your profile.

When this is done, the respective social media platform provider is the controller of the personal data shared with them. We encourage you to review the privacy notices of these social media platforms for more information about how they process your data.

6. Do we share your personal data with third parties?

In certain circumstances, we share your personal data with third parties, e.g. in connection with the provision of our services or if we have a legal obligation to do so, if you have consented to this or if this is in our legitimate interest. These third parties may be located in Switzerland or abroad.

The medical healthcare professionals conducting your consultations and our staff are bound by medical healthcare professional secrecy.

Partner clinics and hospitals or test centres and medical healthcare professionals: We disclose your health data to partner clinics and hospitals or test centres as well as medical healthcare professionals that provide the medical services booked by you (full-body MRI or blood tests, recommendations, or creating and tracking your personalised lifestyle and health plan) only to the extent necessary for the service requested by you and on the basis of your explicit consent. Wearable data is shared only as described in section 2.7.
Third-party service providers: We disclose your personal data to payment service providers, IT/software service providers, including hosting, storage, support, maintenance and security providers, CRM and PIS (customer and patient management) providers, online booking calendar and appointment management providers (incl. for video consultations), providers for the online questionnaire, email and support service providers, providers of application and recruitment management tools, as well as providers for the medical image analysis and AI-based evaluation.
Accountants and advisors: We share your personal data with our accountants and advisors, for example, strategic consultants, lawyers and tax advisors, to the extent that they require such information to provide their services to us.
Competent authorities and courts: We disclose personal data for law enforcement purposes if required by law, if necessary to establish, exercise or enforce legal rights before a court or competent authority, or if we are otherwise required to do so by law.
Third-party organisations / third-party companies: In the context of reorganisations, restructurings or transactions, such as a merger, consolidation, sale of assets or in the unlikely event of insolvency or bankruptcy, we may share your data with other organisations, companies or even authorities.
Other: Additionally, we may share your personal data if we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, emergencies involving potential threats to the physical safety of any person, violations of Ahead Health’s terms of use, or if it is otherwise required by law.

We do our best to always keep your personal data confidential, e.g., by confidentiality agreements or other data protection undertakings entered with the persons who have access to your personal data. To the extent that these third parties process personal data on behalf of Ahead Health as processors, we ensure that appropriate contractual arrangements, including data processing agreements where required under applicable data protection laws, are put in place.

7. Do we transfer your personal data abroad?

Ahead Health is headquartered in Switzerland. Accordingly, your personal data, in particular your health data, is primarily processed within Switzerland and the European Economic Area (“EEA”).

Ahead Health may transfer your personal data to third parties located abroad in connection with the purposes described in this Privacy Policy, such as the EEA, the UK and/or the US.

If these third parties are located in a country with a lower level of data protection than Switzerland, the EEA or the UK, as is the case with the US, we ensure that appropriate safeguards are in place. We rely on the Swiss-U.S. or EU-U.S. Data Privacy Framework, respectively, where applicable and/or implement appropriate safeguards, in particular contractual agreements, specifically the EU Standard Contractual Clauses (SCCs) including a Swiss or other addendum as required under the FADP or other legal agreements.

You have the right to request a copy of these safeguards by contacting us at privacy@aheadhealth.com.

8. How is your personal data protected?

We implement appropriate technical and organisational measures to protect your personal data against, among other things, loss, unauthorised access, misuse, alteration, or unlawful processing. These measures include, as appropriate (e.g. required by law):

a secure infrastructure for the storage and processing of personal data;
encryption of health data in transit and at rest;
regular security assessments, vulnerability testing, and system updates;
access controls ensuring that only authorised personnel have access to personal data on a need-to-know basis, supported by multi-factor authentication (MFA);
redundant and geographically distributed backup systems;
employee training on data protection and security protocols;
audit trails, including the logging of access to personal data and all modifications thereto; and
an incident response plan, including procedures for the detection, reporting, and management of personal data breaches.

9. How long do we retain your personal data?

Unless a more specific period is stated in this Privacy Policy, we keep your personal data until the purpose for which it was collected has been fulfilled, or until you withdraw your consent, whichever is earlier. Thereafter, we retain it only for as long as we are required to by law or need to in connection with a potential legal claim.

In general, your personal data is stored for ten (10) years after our last interaction with you.

The following retention periods apply:

Business records (e.g., invoices or contract documents): ten (10) years.
Recruitment and application data: if we are unable to make you a job offer or you reject a job offer or withdraw your job application, we retain your personal data for up to three months from the end of the application procedure (rejection or withdrawal of the application). We may ask for your consent to store your application data for future job positions at our organisation.
Health data reports: 20 years from the date of the last entry in your medical record with us. Where a shorter or longer period applies under the law of the country in which your check-up took place, that period applies instead.
Wearable and fitness data: until you ask us to delete it. Connection details are deleted when you disconnect a source. Findings a doctor has recorded in your report form part of your medical record and are kept as health data and reports.
Newsletter data or other personal data that is processed based on your consent: until consent is withdrawn.
Cookies and tracking data: see our Cookie Policy (section 4).
Data processed for scientific research, statistical analysis, AI model training, or the development of diagnostic algorithms: for the period communicated to you separately prior to obtaining your consent, or until you withdraw your consent, unless the data has been anonymised.

Some of these periods apply regardless of whether you withdraw your consent or ask us to delete your data, because we are required by law to keep certain data for a minimum period. In such cases, we restrict the access and use to such data so that it is retained only to meet that obligation and is not used for any other purpose.

10. What rights do you have?

As a data subject, you have various rights in relation to your personal data. These include the:

right of access;
right to rectification;
right to erasure (“right to be forgotten”), subject to statutory retention obligations;
in certain cases, right to restrict our processing activities;
right to data portability (where applicable);
in certain cases, the right to object to processing based on legitimate interests.

You may also withdraw your (explicit) consent at any time; however, such withdrawal will not affect the lawfulness of any processing carried out prior to the withdrawal on the basis of that consent.

You may exercise your rights by contacting us at privacy@aheadhealth.com. We will respond to your request as soon as possible and, in any event, within one month of receipt of your request. At our discretion, we may request proof of identity in order to process your request.

Please note that we may refuse or restrict the exercise of these rights on legal grounds or as permitted under data protection laws. In such cases, we will inform you of the reasons for our decision as required by law.

If you believe that we are not processing your personal data in accordance with applicable data protection laws, you also have the right to lodge a complaint with a competent supervisory authority.

For processing activities subject to Swiss data protection law:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, CH-3003 Bern, Switzerland
www.edoeb.admin.ch

For residents in the EU:
A list of data protection authorities in the EU member states and their contact details can be found at the following link: List of data protection authorities in the EU. You can contact the authority of the country you reside in.

11. Privacy of minors and third parties

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data relating to a minor, we will delete such personal data without undue delay. Our partner clinics and hospitals or test centres as well as medical healthcare professionals may also refuse to provide their services to minors.

If you provide us with personal data relating to other individuals, such as family members, you confirm that you are authorised to do so. We ask that you inform these individuals about this Privacy Policy.

12. Can this Privacy Policy be amended?

We reserve the right to update and amend this Privacy Policy from time to time to reflect changes in the way we process your personal data or due to changes in legal requirements. Any changes we make to our Privacy Policy in the future will be published on this website. Please check back regularly to stay informed about updates or changes to our Privacy Policy.

Material changes will be communicated through the website, by email and/or other suitable means.