Privacy Policy

1. Introduction

With this privacy policy, we, easyall GmbH, Stäffiserweg 13, 4500 Solothurn, Switzerland (hereinafter “we”, “us” or “easyall”), inform you about the processing of personal data in connection with our website www.easyall.ch and our online comparison portal for health insurance.

This privacy policy is based on the Swiss Federal Act on Data Protection (FADP/nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Controller

3. What data we collect

3.1 When you visit our website

When you access our website, the following data is automatically stored in server log files:

• IP address (anonymised)
• Date and time of access
• Page / URL accessed
• Referrer URL
• Browser type and version
• Operating system

This data is technically necessary to deliver the website correctly and is not merged with other data sources.

3.2 When you use the comparison calculator

To calculate and compare health insurance premiums, we collect:

• Postcode / place of residence
• Year of birth
• Gender
• Desired insurance category and options

This information is used for the premium calculation and to document the intermediation (activity log, section 13); if no application follows, it is stored only under a pseudonymous session ID and deleted after 90 days.

3.3 When you register

If you create a user account, we collect:

• First and last name
• Email address
• Phone number
• Password (stored encrypted)

3.4 When you apply for insurance

If you apply for insurance via our platform, we additionally collect:

• Full address
• Date of birth
• AHV number
• Health information (health questionnaire)
• Current insurance details

Health data is considered particularly sensitive personal data pursuant to Art. 5 lit. c nFADP. This data is only collected with your express consent and used exclusively for the application process.

3.5 Premium alert

If you subscribe to our premium alert, we store your email address and the comparison data you provide (canton, year of birth, deductible, current insurer). We use this data exclusively to notify you by email once a year about the new health insurance premiums. The subscription only becomes active after you confirm it by email (double opt-in). You can unsubscribe at any time via the unsubscribe link in every email; after that we no longer use your data for the premium alert.

4. Purposes of data processing

We process your personal data for the following purposes:

• Provision and operation of our website and the comparison calculator
• Calculation and display of insurance premiums
• Management of your user account
• Processing of insurance applications
• Documentation of the intermediation (consultation protocol and activity log)
• Payment of cashback and management of referrals
• Communication with you (e.g. notifications, support)
• Improvement of our services and website
• Compliance with legal obligations

5. Disclosure to third parties

We only disclose your personal data to third parties in the following cases:

• Insurance companies: When you submit an insurance application, the necessary data is transmitted to the chosen insurance company. This only happens with your express consent.
• IT service providers: We use third-party providers for hosting (Vercel Inc., USA) and data storage (Amazon Web Services). Data processing agreements are in place with these providers. For AI-assisted features (chat assistant, easy, policy analysis) we use Anthropic PBC (USA). For sending transactional emails (e.g. account confirmation, application status) we use Resend Inc. (USA) or Amazon SES; the email address and message content are transmitted in the process. For error monitoring we use Sentry (Functional Software Inc., USA) — personal data is removed before transmission.
• Legal obligations: Where we are legally required to do so or where it is necessary to enforce our rights.

6. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. These include:

• SSL/TLS encryption of the entire website
• Encrypted storage of passwords (bcrypt)
• Access restrictions and role-based permissions
• Regular security updates

To protect the service, we log abusive requests (e.g. automated bulk queries of the comparison data) and may temporarily block the IP addresses concerned; the legal basis is our legitimate interest in the secure and undisturbed operation of the platform (Art. 31 para. 1 nDSG).

7. Data transfers abroad

Our website is hosted by Vercel Inc. (USA). The database is located on Amazon Web Services in Switzerland (Zurich region). For data transfers to the USA, we rely on the adequacy decisions of the Swiss Federal Council and standard contractual clauses. For AI-assisted features, content is additionally transmitted to Anthropic PBC (USA); the transfer is based on standard contractual clauses. Technical error reports also go to Sentry (Functional Software Inc., USA; standard contractual clauses); personal data is removed beforehand.

8. Cookies

Our website uses technically necessary cookies that are required for the operation of the website (e.g. session cookies, language settings). Session cookies are deleted at the end of the browser session; the login cookie of signed-in users remains stored for up to 30 days.

With your consent we additionally use analytics cookies from Google Analytics (see section 9). They are only set after you click “Accept” in the cookie banner. Without consent no analytics cookies are set; only cookieless, aggregated signals without recognition are transmitted (Google Consent Mode). Declining has no effect on your use of the website; you can change your choice at any time via “Cookie settings” in the footer. We do not use marketing cookies.

9. Web analytics

To analyse the use of our website, we use Vercel Web Analytics, a cookie-free web analytics service provided by our hosting provider Vercel Inc. It works entirely without cookies and without persistent identifiers: there is no cross-site tracking, and only aggregated statistics (e.g. page views, referrers, device type) are compiled. As no cookies are set and no personal data is processed, no consent is required for this.

In addition we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — in Google Consent Mode: without your consent no cookies are set and no persistent identifiers are used; only cookieless, aggregated signals (e.g. page views) are transmitted. Only with your consent given via the cookie banner does Google Analytics use cookies; your IP address is processed in truncated form. Data may be transferred to Google LLC in the USA; Google is certified under the Swiss–U.S. Data Privacy Framework. We use the data for aggregated statistics about the use of the website. You can withdraw your consent at any time via “Cookie settings” in the footer.

10. Your rights

You have the following rights with regard to your personal data:

• Right of access: You may request information about the personal data we process.
• Right to rectification: You may request the correction of inaccurate data.
• Right to erasure: You may request the deletion of your data, unless statutory retention obligations apply.
• Data portability: You may request your data in a commonly used format.
• Right to object: You may object to the processing of your data at any time.
• Withdrawal of consent: You may withdraw any consent you have given at any time.

To exercise your rights, contact us at: datenschutz@easyall.ch

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

11. Retention period

We retain your personal data only for as long as is necessary to fulfil the purposes stated or as required by statutory retention obligations. In Switzerland, business records are subject to a retention period of 10 years (Art. 958f CO).

12. Changes

We reserve the right to amend this privacy policy at any time. The current version is always available on our website. In the event of significant changes, we will inform you through appropriate channels.

13. AI-assisted features and activity log

easyall.ch offers an AI chat assistant, the interactive companion easy and an AI-assisted policy analysis. To answer your requests, the messages you enter and the insurance documents you upload are transmitted to Anthropic PBC (USA) and used there for one-time processing; the transfer is based on standard contractual clauses.

• Chat assistant and easy: Conversations are stored without IP addresses under a pseudonymous session ID and evaluated for quality assurance. If an application follows, they are retained as part of the activity log for that application (see below); otherwise they are deleted automatically after 90 days at the latest. Please do not share health data in the chat; any information you nevertheless enter is not transferred into the application, is not passed on to insurers, and is subject to the same deletion periods.
• Policy analysis: Uploaded documents are processed solely for the one-time extraction and are not stored by easyall; only the structured result (recognised products and your corrections) is returned to your browser and recorded in the activity log.

Activity log (Verlaufsprotokoll)

To document the intermediation, we store your inputs and interactions on the platform (comparison calculator, policy upload, easy, chat assistant, application form) under a pseudonymous session ID, without IP addresses. Answers to health questions, passwords, payment details and AHV numbers are not recorded in it. If an insurance application follows, this record is assigned to the application as an internal activity log and retained together with the application (statutory retention of business records: 10 years, Art. 958f CO); you may request it from us at any time; it is not passed on to insurers — the insurer receives only the consultation protocol. If no application follows, the record is deleted after 90 days. Storage takes place in Switzerland (Amazon Web Services, Zurich region).