We reserve the right to amend the privacy policy in order to adapt it to changed legal situations or in the event of changes to the service and data processing. However, this only applies with regard to declarations on data processing. If user consent is required or components of the privacy policy contain provisions of the contractual relationship with the users, the changes will only be made with the consent of the users.
Users are requested to inform themselves regularly about the content of the privacy policy.
edupression.com®
Privacy Policy – Switzerland (CH)
Scope of This Privacy Policy
This Privacy Policy provides information about the processing of personal data in accordance with the EU GDPR and the Swiss Data Protection Act (nDSG, SR 235.1) in connection with the use of this website and the edupression.com® health app (the “App”).
Introduction
We at SOFY GmbH, Am Renninger 8, 3400 Klosterneuburg, Austria, info@sofy.group, (hereinafter referred to as “SOFY,” “we,” or “us”) have set ourselves the goal of building edupression.com® exclusively on the foundation of evidence-based medicine. People going through a difficult time should have the opportunity to access online self-help resources and build their coping skills, in addition to existing forms of therapy such as psychotherapy and psychotropic medications. We are committed to scientific rigor and the use of state-of-the-art technology. Therefore, the protection of the personal data of our customers (users) and prospective customers is of particular importance to us, especially in this sensitive area. We process this data exclusively in accordance with applicable, strict legal provisions (the EU GDPR and the Swiss nDSG, SR 235.1).
Registration and Use of the edupression.com® Health Application
In order to use edupression.com® as an online platform and medical device, and thus in accordance with Article 6(1)(b) of the GDPR (Article 31 of the nDSG), users must register (valid email address, password). As part of the mandatory onboarding process (which includes online instructions for use), users must also confirm that they do not have any urgent suicidal thoughts or plans.
When registering, you must also expressly consent to the processing of your personal data, in particular the processing of your health data in accordance with Article 9(2)(a) of the GDPR (Article 34 of the nDSG: special categories of personal data). Registration is permitted only for users who are at least 18 years of age.
When using edupression.com®, the following data is processed:
1. Data that users actively enter: contact information, form entries regarding knowledge status, self-assessments, well-being, forums, etc.
2. Data that can be passively collected via (mobile) devices (user activities and usage patterns, gamification data).
This data forms the basis for the technically correct use and effectiveness of edupression.com® products as medical devices.
Communication Within the Application
The pusher.com service from Messagebird in the Netherlands is integrated for user notifications and the optional chat feature between connected users and depression specialists. Content and data are transmitted securely via encryption.
Health Data – Use of Medical Devices
For the purpose of using these products as medical devices, we process the health data listed below. This is necessary to ensure the product’s effectiveness.
edupression.com® Psychoeducation (Therapy Units)
- Data related to the administration of courses (start and end times of course modules and their components, timeline, duration of study, repetitions, etc.)
- Data from the self-assessment test for depression (questions about symptoms related to various mood states, biological functions, feelings, and thoughts)
- Data from brain training on reaction time, concentration, and attention
- Data from interactive fields in the course modules (e.g., word associations, WordRap, personal list of positive activities, questionnaire responses, etc.)
- Data from the user’s quiz answers
edupression.com® Mood Chart
Data on daily mood to calculate a depression score, affective episodes, impairments, general factors such as sleep, menstruation, alcohol/drugs, stressful events, and specific factors such as positive activities, exercise, and therapy.
Use as a depression specialist
As part of the registration process to become a depression specialist, personal data is collected for the purpose of using the user account, specifically name, contact information, profession, and educational background. Furthermore, once SOFY approves the conclusion of the contract with the depression specialist, the depression specialist’s activities on the platform—such as invitations and accesses—are processed based on legitimate interest and to protect other users.
Users can voluntarily connect with a depression specialist. To establish a connection between a user and a depression specialist, both must give their explicit consent (invitation and consent). Once the two are connected, the depression specialist can view data from the user’s dashboard—such as progress, activities, and mood charts—through their own account. This provides the depression specialist with information regarding the period and progress between in-person sessions. Additional data processed in connection with linking a user to a depression specialist includes the user’s contact information, as well as data from communications between depression specialists and users. The user may revoke their consent at any time without providing a reason; however, once consent is revoked, linking the user and the depression specialist is no longer possible.
Use under a private insurance policy
If the service is used through private health insurance or supplemental insurance, data is primarily transmitted to the respective insurance provider for billing purposes.
The data processing operations mentioned above are generally carried out on the basis of Article 6(1)(b) of the GDPR (Article 31 of the nDSG); however, insofar as health data is involved, the data processing operations are carried out on the basis of Article 9(2)(a) of the GDPR (Article 34 of the nDSG).
The user may revoke their consent at any time without providing a reason; however, all personal data will then be deleted, subject to other legal grounds.
ℹ Note for Switzerland: On the Swiss market, edupression is available as a self-pay product. If used through supplemental health insurance (Zusatz-KV), the terms and conditions of the respective private insurance provider apply.
Support with a phone number (e.g., password reset)
As part of the registration process for the health app, your cell phone number is also collected. The number is used exclusively for support purposes, such as an additional factor for password reset. The data is processed only to the extent necessary for the provision and secure operation of the app.
Collaboration with Research Partners and Sharing of Anonymous Data
Users may optionally give their consent to the anonymization of their data for the purposes of further development, ensuring technical functionality, and enhancing user-friendliness. This consent may be revoked at any time without providing a reason. In our development and refinement efforts, we collaborate with recognized medical and scientific research institutions. Data required for scientific purposes is transmitted exclusively in anonymized form, so that researchers cannot identify individual users.
Our shared goal is to continue developing edupression.com® in such a way that our users receive the best possible support and guidance as they cope with their illness.
Spam and Bot Protection for Websites and Health Apps
To protect the website and the health app, we partner with the Austrian service captcha.eu. This allows us to ensure the continuity of operations (GDPR Art. 6(c) / nDSG Art. 31(2)) and, for this purpose, we process technical data, including IP addresses, session times, etc. See also the captcha.eu Privacy Policy: https://www.captcha.eu/de/datenschutz/
Playing Videos from Vimeo on a Website and in a Health App
We use the Vimeo video portal, operated by Vimeo.com, Inc., to play videos in our app and on our website. The videos are embedded and use only the data technically necessary to play and control each video. This is ensured by the “hide from Vimeo” setting for all videos played. Vimeo.com, Inc. acts as a data processor in this context; we have entered into standard contractual clauses with Vimeo.com, Inc. for this purpose. You can find Vimeo’s privacy policy here: https://vimeo.com/privacy.
Contacting Us via the Website or in General
If you would like to contact us, you can do so, for example, via the web form, by sending an email to info@sofy.group, or by phone. We process your email address, phone number, and the content of your message and communication for the purpose of handling your inquiry and in case of follow-up questions, and we store this information for up to six months pursuant to Article 6(1)(b) of the GDPR (Article 31 of the nDSG).
Insofar as health data is involved, it will be processed exclusively with your explicit consent in accordance with Article 9(2)(a) of the GDPR (Article 34 of the nDSG).
To communicate with us regarding the health app, we provide an option in the Feedback/Request menu that allows you to contact us directly through the app. In the case of deletion requests, this data will also be deleted.
Online Payments
To process online payments, and thus in accordance with Article 6(1)(b) of the GDPR (Article 31 of the nDSG), we only transfer the most essential personal data to the payment service provider: name, purpose of the transaction, and amount. This data is transmitted in encrypted form and is used solely for the purpose of processing the payment.
Accepted payment methods in the Swiss market: credit card (via Stripe Inc.), and PayPal (Europe) S.à r.l. et Cie, S.C.A.
Privacy Policy stripe.com: https://stripe.com/en-at/privacy
If users use PayPal, they have already agreed to PayPal’s terms and conditions: https://www.paypal.com/at/webapps/mpp/ua/privacy-full
Website – Cookies
Our website uses what are known as cookies. These are small text files that are stored on your device by your browser. They do not cause any harm.
We use cookies to make our website user-friendly and to ensure that our web service functions properly. Some cookies remain stored on your device until you delete them. They allow us to recognize your browser on your next visit and, for example, make our web service available more quickly.
Cookie-Manager Cookiebot
Before we set cookies that are not technically necessary for providing the service, we obtain the visitor’s consent via a cookie banner. For this purpose, we use the Cookiebot cookie manager on our website. Cookiebot is a service provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, DK. When using Cookiebot, user data is processed, such as an anonymized IP address, the date and time of consent, URL, browser data, an anonymized and encrypted key, and permitted cookies. Users can find information about Cookiebot’s data processing here: https://www.cookiebot.com/de/privacy-policy/
If a visitor does not grant certain consents, the functionality of our website and our online store may be limited.
Digital Health Application – Cookies
The edupression.com® health app itself runs solely on technically necessary cookies from our own server.
Website – Measuring Reach with Google Analytics
To measure reach and track the success of advertising campaigns, we use services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services include the web analytics service Google Analytics, which is implemented using Google Tag Manager.
Google Analytics is used only if the website visitor provides consent (Art. 6(1)(a) GDPR / nDSG Art. 31). Google Analytics collects a wide range of data that allows us to draw conclusions about your use of our website (e.g., URLs visited, duration of visit, browser and operating system used, etc.).
Google provides us with this data only in aggregated and anonymized form, so we do not have direct access to it. Users can find information about Google’s data processing practices here: https://policies.google.com/privacy
E-Mail-Newsletter and transactional mails
We send email newsletters to prospective clients and our users (customers) to provide information about mental health conditions and our services. These newsletters are sent based on the prospective client’s consent in accordance with Art. 6(1)(a) of the GDPR (Art. 31 of the nDSG) and on the contractual relationship as a customer. Subscription takes place via a “double opt-in” process (after signing up, the interested party receives an email asking them to confirm their subscription; the email newsletter is sent only after confirmation). You can easily unsubscribe at any time using the unsubscribe link in the newsletter.
To send our newsletters, we use Mailjet, an email marketing service based in France, as a data processor. For this purpose, only the following data is transferred: name, title, and email address. When sending the newsletter, usage data (reports) is also collected; this data is used exclusively to improve our newsletter service and thus to safeguard our legitimate interests pursuant to Article 6(1)(f) of the GDPR. If you have given your consent pursuant to Article 6(1)(a) of the GDPR to receive email newsletters, we will store your data until you revoke your consent.
Transactional emails: Unlike newsletters, personalized communication via email (reminders, information, congratulations, etc.) is an important part of the therapeutic services we offer our users and is therefore a contractual component of our service (Art. 6(1)(b) GDPR / Art. 31 nDSG).
Recipients of Personal Data
The transfer and processing of personal data generally take place only to the extent necessary to fulfill the contractual relationship or to implement pre-contractual measures (based on Art. 6(1)(b) GDPR / Art. 31 nDSG), to comply with a legal obligation (Art. 6(1)(c) GDPR), to safeguard legitimate interests (Article 6(1)(f) of the GDPR), or to assert, exercise, or defend legal claims (Article 9(2)(f) of the GDPR), or if the user or prospective customer has given their explicit consent (Article 6(1)(a) or Article 9(2)(a) GDPR / Art. 34 nDSG).
In addition to the data processors listed above, users’ and prospective customers’ personal data is transferred in particular to data centers (in Austria), IT service providers, and accounting service providers.
In addition, disclosure may be required in connection with, among other things, requests from government agencies or court orders.
In particular, due to our obligations under applicable medical device law, we, as a manufacturer or distributor, are subject to specific requirements regarding the monitoring of product performance. The processing of personal data may also occur in connection with this regulatory monitoring and reporting system. The legal basis for this is Article 9(2)(i) of the GDPR.
ℹ Data Center: The servers are located in Austria. Austria has an adequate level of data protection recognized by Switzerland (Annex 1 of the Data Protection Ordinance (DSV), SR 235.11), so no special safeguards are required for this transfer.
Retention period
Your personal data will generally be stored for as long as necessary to fulfill contractual obligations and for the purposes for which it was collected. After that, the data will be deleted. Exceptions apply in cases where there are statutory retention or storage requirements under Swiss law (in particular, Art. 962 of the Swiss Code of Obligations and the Swiss Value-Added Tax Act).
Data Breaches – Reporting Requirements
In the event of a data breach that is likely to result in a high risk to the data subjects, we are required to report it immediately to the Federal Data Protection and Information Commissioner (FDPIC) (nDSG Art. 24). To the extent that the EU GDPR applies, the reporting obligation under Articles 33 and 34 of the GDPR to the competent supervisory authority and the data subjects also applies. Affected users will be informed immediately if there is a high risk to their rights and freedoms.
Rights of Data Subjects
Please note that you may exercise your rights at any time regarding access, data portability, rectification, restriction, withdrawal of consent, objection, and erasure of your personal data (Art. 15 et seq. of the GDPR; Art. 25 et seq. of the nDSG). Unless other legal grounds preclude it, we will comply with your request in a timely manner.
No automated decisions, including profiling, are made using your data.
You have the right to file a complaint with the competent data protection authority:
Contact and Data Protection Officer
SOFY GmbH c/o Data Protection Officer
Am Renninger 8, 3400 Klosterneuburg, Austria
E-Mail: datenschutz@edupression.com
ℹ CH Note: The nDSG does not require smaller companies to appoint a data protection officer. SOFY has voluntarily appointed a data protection officer and can therefore be contacted directly regarding data protection inquiries.
Data Security
We implement appropriate technical and organizational security measures in accordance with Article 32 of the GDPR (Article 8 of the nDSG) to protect your personal data against accidental or unlawful destruction, alteration, or loss, as well as against unauthorized disclosure or access.
For your safety, please take all possible IT security measures—see the security guidelines:
https://edupression.com/en-ch/safety-instructions
Changes to the Privacy Policy
We reserve the right to amend the Privacy Policy to adapt it to changes in the legal landscape or to changes in the service and data processing. However, this applies only to statements regarding data processing. If user consent is required or if parts of the Privacy Policy contain provisions governing the contractual relationship with users, changes will be made only with the users’ consent.
Users are asked to review the contents of the Privacy Policy on a regular basis.
edupression.com® – Privacy Policy – Switzerland (CH) | SOFY GmbH, Klosterneuburg | Status: July 2026
Germany
Switzerland