Privacy Policy - AIAgens

1 Introduction

AIAgens is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI virtual assistant services.

GDPR Compliant

FADP Compliant

2 Information We Collect

We collect several types of information in connection with our services:

Account Information Name, email address, password (encrypted), payment information, and license details.
Usage Data Conversations, queries, preferences, and interaction patterns with the AI assistant.
Technical Data IP address, browser type, operating system, and device identifiers.
Voice Data Voice audio stream processed in real-time by our AI assistant (not stored; streaming-only processing)

3 Data Processing Overview

This section provides transparency about how we process your data, the legal basis for each processing activity, and retention periods.

Data Category	Purpose	Legal Basis	Retention Period
Account Data	Service provision, authentication	Art. 6(1)(b) GDPR - Contract performance	Duration of account + 3 years
Usage Data	Service improvement, analytics	Art. 6(1)(f) GDPR - Legitimate interest	13 months
Voice Data	AI assistant functionality	Art. 6(1)(b) GDPR - Contract performance	Never stored (real-time only)
Triage Data (Transcripts)	Appointment routing, conversation audit trails, quality assurance	Art. 6(1)(f) GDPR / nLPD Art. 6	Zero retention (real-time processing only)
Technical Data	Security, fraud prevention	Art. 6(1)(f) GDPR - Legitimate interest	Zero retention
Payment Data	Transaction processing	Art. 6(1)(b) GDPR - Contract performance	10 years (legal requirement)
Conversation Logs	Quality assurance, dispute resolution	Art. 6(1)(f) GDPR - Legitimate interest	30 days

4 How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our AI assistant services
Personalize user experiences and enhance AI responses
Respond to your inquiries and provide customer support
Process transactions and manage billing
Monitor and ensure the security of our services
Comply with legal obligations and enforce our terms

5 Data Sharing

We do not sell your personal data. We share information only as described below:

Service Providers Payment processors and hosting providers (all FADP/GDPR compliant).
Legal Requirements When required by law or to protect our rights and safety.

View complete list of sub-processors →

6 Data Retention

We retain your data only as long as necessary for service provision and legal compliance. Voice audio data is processed in real-time and never stored. Conversation transcripts are not stored by default (zero retention mode). Customers may opt into transcript retention via the Recording & Transcripts Addendum. Conversation transcripts and triage data are processed in real-time with zero retention — no conversation data is stored by AIAgens. Long-term retention in the patient record is the responsibility of the healthcare provider.

7 Your Rights

Under FADP (Swiss Federal Data Protection Act) and GDPR, you have the right to:

Right to Access: Access your personal data
Right to Rectification: Rectify inaccurate information
Right to Erasure: Request deletion of your data
Right to Restriction: Restrict processing of your data
Right to Portability: Request data portability
Right to Object: Object to certain processing activities
Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing
Right to Lodge a Complaint: File a complaint with your national data protection authority

8 Exercise Your Rights

You can exercise your data protection rights using our online form or by contacting our DPO directly.

Available Requests

Access Request

Obtain a copy of your personal data

Rectification

Correct inaccurate information

Erasure (Right to be Forgotten)

Request deletion of your data

Restriction

Limit how we process your data

Data Portability

Receive your data in a portable format

Object to Processing

Object to specific processing activities

Submit Request

9 Automated Decision Making

We use AI to assist with certain decisions. Here's what you need to know:

Our AI assistants do not make automated decisions that produce legal or similarly significant effects on you.
Human oversight is always available. You can request human agent transfer at any time.
Your personal data is NOT used to train AI models. Your conversations remain private.
AI responses are clearly identified. Our assistants identify themselves as virtual assistants.

10 FADP Compliance (Switzerland)

As a Swiss-based company, we comply with the Federal Act on Data Protection (FADP). This includes:

Transparency: Clear information about data processing activities
Purpose Limitation: Data collected only for specified, legitimate purposes
Data Minimization: Only collecting data that is necessary
Accuracy: Ensuring data is accurate and up-to-date
Security: Appropriate technical and organizational measures to protect data
Cross-Border Transfers: Adequate safeguards when transferring data outside Switzerland

Data Protection Officer: For FADP-related inquiries, contact our DPO at dpo@aiagens.ch

11 Security

We implement industry-standard security measures to protect your data, including AES-256 encryption, secure data transmission, and strict access controls. All data is hosted in Switzerland at ISO/IEC 27001 compliant data centers.

Security Measures

Encryption: TLS/SSL for data in transit, AES-256 for data at rest
Access Controls: Role-based access control (RBAC) for internal systems
Regular Audits: Periodic security assessments and penetration testing
Incident Response: Documented procedures for data breach notification
Employee Training: Regular security awareness training for all staff

12 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. Here's what you need to know:

Types of Cookies We Use

Essential Cookies: Required for authentication, security, and basic functionality. These cannot be disabled.
Preference Cookies: Remember your language and regional settings
Analytics Cookies: Help us understand how you use our service to improve it
Security Cookies: Detect and prevent security threats

Cookie Management

You can control cookies through:

Browser Settings: Most browsers allow you to block or delete cookies
Opt-Out Tools: Use industry opt-out tools for analytics cookies
Our Settings: Manage cookie preferences in your account settings

Third-Party Cookies

We may use third-party services that set their own cookies:

Analytics provider: For usage analytics (anonymized)
Payment processor (EU): For payment processing
Voice AI Provider (EU): For voice AI processing

13 Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children.

If we discover that we have collected personal data from a child under 16 without parental consent, we will delete it immediately. Parents who believe their child's data has been collected should contact us at info@aiagens.ch.

14 Privacy FAQ

Common questions about how we handle your data

All data is stored in Switzerland and the EU. Our primary infrastructure is hosted in Germany, and voice AI processing uses EU data centers.

No. Your personal data and conversations are never used to train AI models. We use our EU-based Voice AI provider for voice processing, which does not train on enterprise customer data.

You can request data deletion through our Privacy Request form, by emailing dpo@aiagens.ch, or through your account settings. We process deletion requests within 30 days.

Only authorized AIAgens employees with a business need have access to customer data. All access is logged and audited. Our sub-processors are listed on our Sub-processors page.

Voice data is processed in real-time and never stored. No voice recordings are kept - only appointment details are stored.

Some sub-processors operate from countries outside Switzerland and the EU/EEA. We use Standard Contractual Clauses (SCCs) and additional safeguards for all international transfers.

You can reach our Data Protection Officer at dpo@aiagens.ch. We respond to all inquiries within 30 days.

Upon account cancellation, we retain your data for 30 days (recovery period), then permanently delete it within 90 days. You can request immediate deletion.

Google Calendar is compliant through three layers: (1) Since September 2024, Switzerland recognizes the Swiss-US Data Privacy Framework - Google is DPF certified; (2) We configure EU data residency (Belgium) - your data never leaves the EU; (3) For healthcare, we offer E2E encryption of medical notes with doctor's public key - neither Google nor AIAgens can read the plaintext.

For healthcare providers, we offer end-to-end encryption that goes beyond legal requirements. Medical information collected during calls is encrypted with the doctor's RSA-2048 public key before being saved to Google Calendar. Only the doctor, with their private key and PIN (protected by PBKDF2-SHA256 with 100,000 iterations), can decrypt it. This is a zero-knowledge architecture - our servers never see plaintext medical data.

15 Policy Change Log

We maintain transparency about changes to our privacy practices.

Version	Date	Summary of Changes
2.0	January 2026	Enterprise Privacy Center: Added data processing table, retention periods, FAQ section, change log, rights request form
1.1	November 2025	Added FADP compliance section, healthcare provider terms
1.0	October 2025	Initial privacy policy publication

16 Authentication Data, Voice Biometrics & Account Deletion

The Stratega apps for iOS and Android use modern authentication methods. Below we explain which authentication data we process, how we protect your voice identity, and how you can delete your account at any time.

Passkeys (WebAuthn/FIDO2): we store only your passkey's public key and a credential identifier. The private key and on-device biometrics (Face ID, Touch ID, fingerprint) never leave your device and are never transmitted to our servers.
Recovery code (TOTP): for access recovery we store a TOTP secret in encrypted form, used solely to verify the six-digit codes generated by your authenticator app.
Microphone and voice biometrics: the app uses the microphone for the voice assistant. Speaker voice verification (biometric identity recognition) is special-category data under GDPR Art. 9 and the Swiss FADP: it is enabled only with your explicit consent, is based on a mathematical voiceprint (embedding) rather than stored audio recordings, and is revocable at any time by deleting the voiceprint from the Security Center.

Account deletion: you can delete your account directly in the app, from the Security Center, with two-step confirmation. Deletion immediately revokes passkeys, recovery code, voiceprint and session; permanent erasure occurs after a 7-day grace period. Alternatively, you can request deletion by contacting the data controller (see Contact section). Public page: https://aiagens.ch/privacy#account-deletion

17 Data Protection Officer

For all privacy-related inquiries, you can contact our Data Protection Officer:

Email

dpo@aiagens.ch

Address

Exatoshi AG
Piazza Cioccaro 4
6900 Lugano, Switzerland

We respond to all requests within 30 days as required by GDPR and FADP.

Submit Request