Privacy Policy

1. Privacy first — our commitment

BlancChain AG puts privacy at the centre of its product vision. Our approach is guided by purpose limitation, data minimisation, transparency, security, and privacy by design and by default. We are committed to meeting the Swiss Federal Act on Data Protection (FADP) and its implementing ordinance, and the EU General Data Protection Regulation (GDPR) wherever it applies to our activities.

This notice describes the coming-soon website and launch-update signup, not a live clinical service. A statement of commitment is not a certification of compliance or a guarantee that every future service has already been assessed.

2. Controller and contact

The controller for this website’s signup data is BlancChain AG, Grabacherstrasse 24, 6354 Vitznau, Switzerland. Company identification number: CHE-456.173.548.

For privacy enquiries, withdrawal of consent, or requests concerning your personal data, write to BlancChain AG at this postal address and mark your correspondence “Privacy”. Please do not send patient records or sensitive medical information in a website enquiry.

3. Scope and information we collect

When you subscribe, we collect your email address, optional first name, selected language, consent confirmation, signup timestamp, and an internal record identifier. Your first name is voluntary. Email and consent are required for signup; without them we cannot register you for launch updates.

Website delivery involves technical information such as IP address, browser and device information, request times, and requested resources being made available to hosting and delivery providers. The public signup form does not request patient, treatment, payment, or booking data.

4. Purposes and legal grounds

Signup information is used to maintain the launch-update list, prevent duplicate registrations, and prepare communications about BlancChain’s launch and product developments. Under GDPR Article 6(1)(a), where applicable, the basis for promotional updates is your freely given consent. You may choose not to subscribe.

Necessary delivery and security processing may rely, where GDPR applies, on legitimate interests under Article 6(1)(f): making the website available and protecting it from misuse, subject to your interests and rights. Processing required by law relies on Article 6(1)(c). Under Swiss law we follow the applicable processing principles and, where a justification is necessary, the relevant statutory grounds.

5. Consent, withdrawal, and communications

The signup checkbox is not selected by default. Consent to updates is separate from receiving clinical care or using a future clinic service. You can withdraw consent at any time by writing to the controller. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The website currently records signups; it does not itself send newsletters. Any future promotional messages will need a functioning, free unsubscribe route. Withdrawal must be as easy as giving consent.

6. Recipients and service providers

Signup data is stored using Lovable Cloud. Access to the subscriber list is restricted to the password-protected administration area; the public form does not provide public access to that list. Authorised administrators can view and export records for the stated purposes.

Website hosting and content delivery providers receive information necessary to deliver the site and its images. Inter fonts are currently requested from Google Fonts, which connects your browser to Google services and exposes technical request information, including your IP address. The website therefore involves third-party data flows and is not represented as exclusively Swiss-hosted.

Personal data may be disclosed to authorities where required by law.

7. Switzerland and international transfers

Switzerland is BlancChain’s stated location for intended data handling. This does not establish that hosting, backups, support access, content delivery, font services, or future AI processing all occur exclusively in Switzerland.

Where personal data is disclosed abroad, Swiss FADP requirements apply, including information about destination countries and, where necessary, appropriate safeguards. Where GDPR applies, transfers must meet Chapter V requirements, for example an applicable adequacy decision or appropriate contractual safeguards with any necessary supplementary measures.

8. Storage and deletion

The intended retention principle is to keep personal data only as long as necessary for the stated purpose. Following withdrawal or an accepted deletion request, update-list data should be deleted or anonymised unless a lawful obligation or justified need requires limited retention, such as evidence needed to handle a dispute.

Signup records do not expire automatically. You may request deletion by contacting BlancChain AG at the address above.

9. Browser storage and security

Your selected language is saved in browser local storage under “blancchain-language”. It remains until cleared or changed. The administrator area uses an encrypted, HTTP-only session cookie with a one-hour lifetime; it is used for access control, not marketing.

The website’s own presentation code does not add advertising pixels or marketing analytics. This is not a guarantee about all platform-level logging or third-party services. Signup writes are validated, and subscriber reads and exports require an administrator session. No system can guarantee absolute security.

10. Your rights and complaints

Subject to the conditions of applicable law, you can request information and access, correction, deletion, and restrictions on processing, and withdraw consent. Where GDPR applies, you may also have rights to data portability and to object to processing based on legitimate interests; you may object to direct marketing at any time.

Send requests to the controller at the postal address above. Only proportionate identity checks should be requested when necessary. Under GDPR, responses are generally due within one month, with lawful extensions where justified; Swiss access requests are generally answered within 30 days, subject to applicable exceptions.

You can contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where GDPR applies, lodge a complaint with the competent EU/EEA supervisory authority, including in the country of your habitual residence, workplace, or the alleged infringement.

11. AI agents and future clinical services

The screenshots show fictional demonstration data. This launch signup does not make decisions about your treatment and does not use signup information for automated decisions with legal or similarly significant effects.

Our future product vision is for doctors to treat patients while AI agents support administration, consent workflows, accounting, and bookings. Patient consent remains a patient decision; clinical accountability is not transferred to an AI agent.

Before handling real patient data, the relevant services require separate, accurate notices and controller/processor responsibilities, processing agreements, appropriate grounds for sensitive health data (including GDPR Article 9 where applicable), security and access controls, retention rules, and risk or impact assessments where required. AI providers, international transfers, training use, and human oversight must be assessed and disclosed. This website notice does not authorise patient-data processing or certify a future clinic deployment.

12. Updates

Last updated: 14 October 2026. This notice may be updated when processing arrangements or applicable requirements change; material changes affecting consent may require a new notice or renewed consent.