Privacy Policy

Last updated: 14 November 2025

1. Data Controller

Carewell GmbH ("the Company," "we," "us," or "our") (Bahnhofstrasse 52, 8001 Zurich, Switzerland) is the data controller for personal data processed via gocarewell.com under the Swiss Federal Act on Data Protection (revised FADP / nDSG, in force 1 September 2023). Contact: [email protected] or +41 44 542 6100.

2. What the Platform Does and Why Data Protection Matters Here

Carewell is a two-sided staffing marketplace that connects Swiss clinics and hospitals with freelance nurses for temporary shift coverage. Because we operate in the healthcare sector, the data we process includes professional health credentials, employment history in clinical settings, and shift records tied to specific wards and patient-care contexts. We take our obligations under the FADP seriously and handle all personal data with the care that healthcare-sector information demands.

The Company acts as data controller for nurse profile data (we decide how it is collected, stored, and used for matching). For clinic data entered by ward administrators, the Company also acts as controller. Where a clinic's own employee data is uploaded to manage internal rosters, the clinic may be the independent controller of its own personnel records.

3. Personal Data We Process

Depending on how you use the platform, we process the following categories of personal data:

3.1 Nurse Users

• Identity data: full name, date of birth, contact details (email, phone);
• Professional credentials: nursing qualification (SRK-ASI registration number where provided by you, diploma information, specialisation areas such as ICU, surgical ward, paediatrics);
• Employment history in clinical settings, as entered by the nurse;
• Availability calendar and shift preferences;
• Background check results where the credentialing process requires them;
• Payment details for shift payout processing;
• Shift history on the platform (which shifts were taken, at which clinic, shift times);
• Communications through the platform's messaging feature.

3.2 Clinic Users (Ward Managers and Administrators)

• Identity and contact data of the individual administrator who registers the clinic account;
• Clinic name, address, ward type, and staffing requirements posted as shift listings;
• Subscription and billing information (plan tier, payment method, invoice records);
• Shift history and fill records for their posted shifts.

3.3 Website Visitors

• Technical data: IP address (truncated), browser type, device type, referring URL;
• Usage data: pages visited, time on site, interaction events;
• Analytics data, collected only with your prior consent (see our Cookie Policy).

4. Purposes and Legal Bases

We process personal data for the following purposes under the FADP:

• Platform operation and shift matching: processing nurse credentials and availability against clinic shift requirements to generate match recommendations. This is necessary to perform the service you have requested from us.
• Credential verification: verifying that nurse qualifications and registrations are accurate before a nurse is shown to clinic partners. This is necessary for platform integrity and for clinics' patient-safety obligations.
• Billing and payments: processing clinic subscription fees and nurse shift payouts. Necessary for the contractual relationship.
• Platform security and fraud prevention: monitoring for unauthorised access, abuse of the shift-posting system, or false credential submissions. We have a legitimate interest in maintaining platform integrity.
• Customer support: handling enquiries and disputes between clinics and nurses about shift records or payments.
• Service improvement: anonymised aggregate analysis of matching patterns and shift-fill rates to improve the algorithm. This uses aggregated, non-identifiable data.
• Marketing communications: sending platform updates or shift availability newsletters only where you have given explicit consent. You can withdraw consent at any time.
• Legal compliance: retaining records as required by Swiss accounting and employment law.

5. Data We Do Not Use for Model Training

We do not use nurse profile data, credential records, shift history, or clinic data to train machine learning models without explicit written consent from the affected data subjects. Our matching algorithm is trained on anonymised, aggregated patterns only. Individual nurse credentials and clinic ward assignments are never used as AI training inputs.

6. International Data Transfers

Where we transfer personal data to countries outside Switzerland, we ensure adequate protection through mechanisms recognised by the Federal Data Protection and Information Commissioner (FDPIC), including Standard Contractual Clauses or transfers to countries that the Swiss Federal Council has recognised as providing an adequate level of data protection. Where a transfer involves a country on the Federal Council's adequacy list (which mirrors the EU's adequacy decisions in most respects), we rely on that adequacy status. For all other transfers, we implement Standard Contractual Clauses or equivalent safeguards before any data leaves Switzerland.

Where EU/EEA data subjects use the platform (for example, a nurse with an EU nursing qualification or a cross-border clinic near the Swiss border), we handle their data in compliance with both FADP requirements and the obligations applicable under the EU/EEA framework, using the same protective mechanisms described above.

7. Retention Periods

We retain personal data only as long as necessary for the purposes described:

• Active nurse profiles: for the duration of the account plus 24 months after last platform activity, to handle any disputes about shift records;
• Clinic account data: for the duration of the subscription plus 10 years for invoicing records (Swiss accounting law requires retention of business records for 10 years);
• Shift records: 5 years from the shift date, for dispute resolution and audit purposes;
• Credential verification documents: held for the duration of the nurse's active status on the platform, then deleted within 30 days of account closure unless a dispute is pending;
• Website access logs: 90 days rolling;
• Marketing consent records: retained for the life of the consent plus 3 years.

8. Your Rights under the Revised FADP

Under the revised Swiss Federal Act on Data Protection you have the following rights with respect to your personal data:

• Right to information about whether we process your personal data and, if so, what data, for what purpose, and who receives it;
• Right to access and obtain a copy of the personal data we hold about you;
• Right to rectification of inaccurate data;
• Right to erasure or destruction of data that is no longer necessary or that was processed unlawfully;
• Right to object to processing that is not based on a contractual or legal obligation;
• Right to data portability where processing is automated and based on consent or contract;
• Right not to be subject to automated individual decisions with significant legal or similar effects without the opportunity for human review.

To exercise any of these rights, contact the Company at [email protected]. We respond within 30 days of receiving your request. Where the request is complex or we receive multiple requests simultaneously, we may extend this period by a further 30 days and will notify you of the extension.

9. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with the FADP, you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch. We would, however, appreciate the opportunity to address your concern directly before you contact the FDPIC.

10. Cookies and Analytics

Non-essential cookies, including any analytics or preference cookies, are not set until you give your prior consent through our cookie consent banner. For full details, see our Cookie Policy. You can change or withdraw your cookie consent at any time via the "Cookie preferences" link in the footer.

11. Children

The Carewell platform is intended for healthcare professionals and clinic administrators. It is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that personal data of a person under 18 has been submitted, we will delete it promptly.

12. Changes to This Policy

If we make material changes to this Privacy Policy, we will post the updated version on this page with a new "Last updated" date. For changes that significantly affect how we process your data, we will notify registered users by email.

13. Contact

Carewell GmbH
Bahnhofstrasse 52
8001 Zurich, Switzerland
Email: [email protected]
Phone: +41 44 542 6100