Privacy Policy

Last updated: November 2026

1. Controller

The controller responsible for data processing on this website is:

Alpine Clinical Partners GmbH
Churerstrasse 35
9470 Buchs SG
Switzerland

Email: info@alpineclinical.ch
Authorized representatives: Alexander Röck, M.D. (Managing Director), Gregory Tchkonia, M.D.

Further company details are in our Legal notice: https://www.alpineclinicalpartners.com/legal-notice

2. Scope

This policy applies to the website www.alpineclinicalpartners.com and to contact by email at the address given there. The domain www.alpineclinicalpartners.ch redirects to this website.

Our website is aimed at pharmaceutical, biotechnology and medical device companies. It is not a channel for participation in clinical trials and is not intended for inquiries from patients. We inform data subjects about the processing of data in clinical trials separately, usually through the trial information provided by the sponsor and the trial site. This policy does not cover that processing.

3. Applicable law

We are a company based in Switzerland. The Swiss Federal Act on Data Protection (FADP) applies to us. Our website is also aimed at persons in the European Economic Area (EEA). For these persons, the General Data Protection Regulation (GDPR) also applies under Art. 3(2)(a) GDPR.

Where we name a legal basis under the GDPR below, it applies to persons in the EEA. Under the FADP, private controllers do not need a separate legal basis as long as they comply with the principles of Art. 6 FADP and there is no unlawful breach of personality rights (Art. 30 and 31 FADP).

4. What data we process and why

4.1 Visiting the website (server logs)

When you visit our website, our hosting provider processes technically necessary data:

• IP address of the requesting device (shortened or hashed where stored in logs)
• date and time of access
• page and file requested
• previously visited page (referrer), if your browser sends it
• browser type, browser version and operating system
• amount of data transferred and status code

Purpose: delivery of the website, stability, security (for example, defense against attacks) and error analysis.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

Retention: Webflow retains server logs only for as long as necessary for operation, security and error analysis. According to Webflow, full IP addresses are not stored in its logs. Hashed values are kept only for a short period.

4.2 Hosting

We host the website with Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. Webflow uses data centers of Amazon Web Services, Inc. in the USA and the content delivery network of Cloudflare, Inc., USA. Webflow delivers parts of its scripts through the content delivery network Amazon CloudFront.

Our website is maintained by the agency cloudfood GmbH, Erlenweg 2, 93173 Wenzenbach, Germany. cloudfood operates the Webflow project for us and processes the data in section 4.1 on our behalf. We have a data processing agreement with cloudfood under Art. 28 GDPR and Art. 9 FADP. Webflow is a sub-processor of cloudfood.

The traffic of our website passes through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. cloudfood uses Cloudflare to manage our domains, to redirect www.alpineclinicalpartners.ch, as a content delivery network and for protection against attacks. Cloudflare processes your IP address and the connection data in section 4.1 and retains them for a few days. Cloudflare is a sub-processor of cloudfood.

Webflow, Amazon Web Services and Cloudflare are certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. See section 6 for transfers to the USA.

Webflow privacy policy: https://webflow.com/legal/privacy

4.3 Contact by email

When you write to us by email, we process your email address, the content of your message and the metadata of the email (date, time, mail server). If you provide further details, for example your name, company or telephone number, we process these as well.

Purpose: handling your inquiry and, if you wish, initiating a business relationship.

You are not obliged to provide us with data. Without your email address, however, we cannot answer your inquiry.

Legal basis: Art. 6(1)(b) GDPR (inquiry with a view to a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).

Retention: We delete your inquiry 12 months after the last communication if it has been resolved and no business relationship results. Business correspondence that we must retain under Art. 958f of the Swiss Code of Obligations is stored for 10 years.

Our email mailboxes are operated for us by the agency cloudfood GmbH at Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany. Mittwald is a sub-processor of cloudfood. The mail servers are located in Germany.

Note: Email without additional encryption is not a secure transmission channel. Please do not send us health data, patient data or confidential trial data by email. On request, we provide a secure transmission channel for the exchange of such data.

4.4 No automated decision-making

We do not carry out automated individual decision-making or profiling within the meaning of Art. 22 GDPR.

5. Cookies, tracking and third-party content

Our website does not set cookies for analytics, tracking or marketing and does not use comparable technologies such as local storage. The infrastructure of our hosting provider and of Cloudflare may set one technically necessary cookie. It contains only a random identifier, distinguishes requests during a session, helps to defend against attacks and is deleted when you close your browser. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in the secure operation of the website. We do not use analytics, tracking or marketing services. We do not load fonts from external servers. We do not embed third-party content such as maps, videos or social media elements.

For this reason, our website does not show a cookie banner. Technically necessary cookies do not require consent.

If we use such services in the future, we will update this policy beforehand and obtain your consent where required.

6. Transfers to third countries

Our hosting provider Webflow, its infrastructure provider Amazon Web Services and the network provider Cloudflare are based in the USA. Data from section 4.1 is therefore transferred to the USA.

For persons in the EEA, we base the transfer on the adequacy decision of the European Commission for the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Webflow, Inc., Amazon.com, Inc. (including Amazon Web Services) and Cloudflare, Inc. are listed there as active participants.

For persons in Switzerland: The Swiss Federal Council recognizes the USA as a country with an adequate level of data protection for companies certified under the Swiss-U.S. Data Privacy Framework (Art. 16(1) FADP, Annex 1 of the Data Protection Ordinance).

7. Recipients of the data

Within our company, only the persons who need your data to handle your request have access to it. External recipients are:

• cloudfood GmbH (maintenance of the website and the email mailboxes, sections 4.2 and 4.3)
• Webflow, Inc. (hosting, as a sub-processor of cloudfood, section 4.2)
• Amazon Web Services, Inc. (data centers and content delivery network Amazon CloudFront, on behalf of Webflow)
• Cloudflare, Inc. (DNS, redirect, content delivery network and protection against attacks, as a sub-processor of cloudfood; also content delivery network on behalf of Webflow)
• Mittwald CM Service GmbH & Co. KG (email, as a sub-processor of cloudfood, section 4.3)

We do not pass your data on to other third parties unless we are legally obliged to do so.

8. Data security

The connection to our website is encrypted with TLS (https). Webflow secures the infrastructure in line with the state of the art. We take appropriate technical and organizational measures under Art. 32 GDPR and Art. 8 FADP to protect your data against loss, misuse and unauthorized access.

9. Your rights

Under the GDPR and the FADP, you have the following rights:

• access to your stored data (Art. 15 GDPR, Art. 25 FADP)
• rectification of inaccurate data (Art. 16 GDPR, Art. 32 FADP)
• erasure of your data (Art. 17 GDPR, Art. 32 FADP)
• restriction of processing (Art. 18 GDPR)
• receipt and transfer of your data in a commonly used format (Art. 20 GDPR, Art. 28 FADP)
• withdrawal of consent with effect for the future, where we base processing on your consent in future (Art. 7(3) GDPR, Art. 30(3) FADP)

Right to object: Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, write to info@alpineclinical.ch or to the postal address in section 1.

Right to lodge a complaint: You may lodge a complaint with a supervisory authority.

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, https://www.edoeb.admin.ch/
• EEA: the data protection supervisory authority at your place of residence, place of work or the place of the alleged infringement (Art. 77 GDPR)

10. Changes to this policy

We update this policy when our website or the legal situation changes. The version published on this page at the time of your visit applies.