1. Controller

The controller of the processing carried out for its own purposes and described in this Policy is Andréas Dimitri Bergerat, an individual, domiciled at Route du Pont-de-Pierre 7, 1822 Chernex, Vaud, Switzerland, acting under the name AQELIOS. Data protection contact: contact@aqelios.ch.

2. Scope

This Policy applies to use of the website, contacts, demonstration requests and professional relationships with prospects, clients and partners. Where AQELIOS processes data on a Client’s behalf, the contract and the applicable DPA supplement this Policy.

It is established primarily with regard to the Swiss Federal Act on Data Protection (FADP). Other rules apply only where their material or territorial scope is actually met.

This Policy also covers AQELIOS Mobile for iPhone. The app is free to download and is reserved for authorised users with a previously provisioned AQELIOS account. No purchases or subscriptions are sold within the app. Data in professional workspaces is accessible according to the account's permissions. The version currently offered must not be used with real patient data; demonstration and App Store review data is entirely synthetic.

3. Data and purposes

The website and its hosting may process the technical data required for transmission, operation and security: IP address, date and time, requested resource, referrer transmitted by the browser, browser, operating system and technical logs.

In the context of professional contact, AQELIOS processes contact details and information provided voluntarily in order to respond, organise a demonstration, prepare an offer, manage the contractual relationship, invoice, ensure security and defend legal rights.

Do not transmit any patient data or medical information through the website or the general contact address.

AQELIOS does not sell personal data and does not use it for a purpose incompatible with its collection.

AQELIOS Mobile: account, session and activity

When signing in, the sign-in address and password are transmitted to the authentication service to verify access. Account, session and professional workspace identifiers are used to load permissions and authorised information. The app does not retain the sign-in password. Session tokens and local preferences are retained in the device's secure storage.

Requests, details, deadlines, histories and evidence are retrieved from the AQELIOS service. Actions performed in the app, including decisions on an approval, may be recorded with their date, reference, the account and session concerned, and the receipts and audit trails needed to follow them up. This processing serves to provide the requested functions, control access and ensure operational traceability.

The authentication and API services also process technical data, including the IP address, software and device information transmitted with requests, timestamps and technical logs. This information is used for security, diagnostics and service continuity. It may be linked to the account or session.

Local biometric unlocking is performed by iOS. AQELIOS Mobile neither receives nor transmits facial templates or biometric fingerprints. Additional checks for protected actions remain separate from local unlocking.

This version of the app does not provide voice listening or recording, or WhatsApp data collection from within the app. It does not include targeted advertising or cross-app tracking of users for advertising purposes. Mobile data is not sold to data brokers.

4. Grounds and proportionality

Depending on the context, processing is based on the person’s request, pre-contractual measures, performance of a contract, a legal obligation, security and legitimate management of the professional relationship, or consent where required. The principles of lawfulness, good faith, transparency, proportionality, purpose limitation and security are applied.

5. Recipients and service providers

Access is limited to persons who need it and are subject to appropriate obligations. According to the information currently established, the public website and email service are provided using Infomaniak services hosted in Switzerland.

The website loads the Inter and Manrope fonts from Google Fonts. The browser then transmits to Google the technical data required for the request, including the IP address and browser information. Components present only in development or pre-production are not presented as production service providers.

For AQELIOS Mobile, authentication and operational data are processed through the Supabase services used by AQELIOS. The data accessible to a user remains limited to their workspace and permissions. Operational access is limited to authorised persons and service providers involved in providing, securing or maintaining the service. Biometric mechanisms and local secure storage are provided by iOS. The link to this Policy opens in the device's browser; the website processing described in this Policy then applies.

6. Disclosures abroad

Loading Google Fonts may result in technical data being disclosed to Google Ireland Limited and subsequently processed outside Switzerland, including in the United States. Any safeguard relied upon depends on the recipient entity and its actual status, for example an applicable adequacy decision, a valid Swiss–U.S. Data Privacy Framework certification or recognised clauses. Transfers relating to a Client service must be documented separately before activation.

The main database of the Supabase project used by AQELIOS Mobile is configured in the Frankfurt region in Germany. This location does not mean that all support operations and all of the provider's subprocessors are located exclusively in that region. Any international disclosures and access relating to these services are subject to the contractual provisions and safeguards actually applicable to the provider concerned; no exclusively Swiss location is promised for Mobile.

7. Retention

Data is retained for as long as necessary for its purpose and is then deleted or anonymised, subject to legal, accounting or tax obligations, security requirements and the defence of legal rights. The relevant accounting books and records are retained for ten years in accordance with Swiss law. Data processed on a Client’s behalf follows the periods set out in the contract, DPA and actually demonstrated configuration. No unsubstantiated backup or deletion period is promised here.

The app's account, session and activity data, together with its technical logs, are retained for the period necessary to provide the service, ensure its security and meet applicable obligations. When no longer needed, they may be deleted or anonymised, subject to retention obligations and justified traceability needs. No uniform numerical retention period or immediate deletion of logs and backups is promised. Requests concerning deletion of an account or Mobile data should use the AQELIOS contact channel indicated below.

8. Security

AQELIOS applies organisational and technical measures proportionate to the risk and the actual state of the service. No system can guarantee absolute security. Measures for a Client service are specified in the contractual documents and are not inferred solely from publication of this Policy.

9. Cookies and similar technologies

As at 4 September 2026, an anonymous audit of the home page and legal pages identified no audience analytics tool, advertising pixel, marketing tracker, third-party iframe or readable cookie placed by those pages. External loading of Google Fonts remains described above. If an optional technology is added, the information and, where required, the choice mechanism will be updated before its activation.

10. Rights

Within the limits of the FADP, a person may request access to their data, rectification, delivery or transmission where the conditions are met, and seek its deletion or object to processing where permitted by law. Proportionate verification of identity may be requested. Requests may be sent to contact@aqelios.ch. A person may also contact the Federal Data Protection and Information Commissioner (FDPIC).

For a request relating to AQELIOS Mobile, including deletion of an account or its data, you may write to contact@aqelios.ch, specifying that your request concerns the Mobile app. Do not transmit any password, authentication code or patient data. AQELIOS may request the information strictly necessary to verify identity and specify any retention obligations applicable to the request.

11. Updates

This Policy is adapted when the processing, service providers or applicable requirements change. Last updated: 22 September 2026.

—

In the event of any discrepancy in interpretation between the language versions, the French version shall prevail.