Privacy Statement
Luminance Health AG
Last updated: 10 September 2026
Your privacy matters to us.
Luminance Health AG processes personal data in a transparent, proportionate and secure manner. We may use personal data to operate our website, communicate with clients and business contacts, provide consulting services, organize events, manage applications and comply with legal obligations. This Privacy Statement explains what personal data we may process, why we may process it, with whom we may share it, how long we may keep it and what rights you may have under applicable law.
1. Controller and contact
Luminance Health AG, Schillerstrasse 7, 4053 Basel, Switzerland, is responsible for the processing of personal data described in this Privacy Statement. For privacy-related requests, you may contact us at: info@luminance-health.com.
2. Applicable law
We are subject to Swiss data protection law, in particular the Swiss Federal Act on Data Protection (FADP). In certain cases, the EU General Data Protection Regulation (GDPR) may apply.
3. Personal data and purposes of processing
We may process different categories of personal data depending on the nature of our relationship with you and the circumstances. The categories, examples and purposes listed below are illustrative, may not apply in every case, and are not exhaustive.
| Category of personal data | Examples | Main purposes |
|---|---|---|
| Contact and identification data | Name, business address, email address, telephone number, company, function, country | Communication, business relationship management, business development, preparation of offers, contract administration |
| Communication data | Emails, meeting notes, messages, call details, online meeting metadata, content of enquiries | Responding to enquiries, arranging meetings, documenting interactions and managing the relevant matter |
| Client, project and service data | Project documents, deliverables, contracts, regulatory, quality, compliance, market access, public affairs or medical communication materials | Providing consulting services, managing projects, preparing deliverables, liaising with clients, authorities or third parties where authorized |
| Sensitive personal data | Health-related data or other sensitive data where provided by a client or required for a mandate | Processing only for agreed project purposes and in line with confidentiality, contractual and legal obligations |
| Website and technical data | IP address, device and browser information, date and time of access, pages visited, referring website, log and security data | Operating, securing, maintaining and improving the website, troubleshooting, preventing misuse and maintaining system stability |
| Event data | Registration details, attendance information, speaker data, feedback, photos or recordings where applicable, payment-related information where relevant | Organizing events, webinars or workshops, communicating with participants, processing registrations and payments, documenting participation and following up |
| Application data | CV, cover letter, qualifications, references, interview notes, recruitment correspondence, identity, right-to-work documentation, and related application materials | Assessing applications, conducting interviews, communicating with candidates, verifying eligibility to work, and preparing employment contracts where applicable |
| Publicly available and third-party data | Information from professional networks, registers, websites, event organizers, business partners or other permitted sources | Business development, relationship management, compliance checks and communication where relevant and lawful |
4. Legal basis where the GDPR applies
Where the GDPR applies, we may rely in particular on the following legal bases: performance of a contract or pre-contractual measures; legitimate interests, including establishing and maintaining business relationships, operating our website, ensuring IT security and proportionate business-to-business marketing; compliance with legal obligations; and consent where we ask for it, for example for specific marketing, cookies, analytics or event-related processing.
You may withdraw consent at any time with effect for the future.
5. Website, cookies and similar technologies
When you visit our website, technical data may be collected automatically in server logs. We may use this data to provide the website, ensure security and stability, analyze errors and prevent misuse. Log data is retained only for as long as necessary for these purposes, unless a longer retention period is required for security incidents, misuse or legal claims.
Our website may use cookies that are necessary for the website to function properly. You can configure your browser to reject or delete cookies. Disabling cookies may affect the functionality of the website.
6. Communications and client work
If you contact us by email, telephone, contact form, LinkedIn or other communication channels, we process the information you provide to respond to your enquiry, communicate with you and manage the matter to which it relates.
In connection with client work, we may process personal data provided by clients, their employees, representatives, contractors, partners, authorities or other third parties. We process such data only for the agreed project purposes and in accordance with applicable confidentiality, contractual and data protection obligations.
We may share project-related data with employees, contractors, service providers, authorities, notified bodies, consultants or other third parties where necessary to perform our services, authorized by the client, required by law or otherwise permitted.
7. Online tools, electronic signatures and AI-supported tools
We use cloud-based productivity, communication, collaboration and document-management services, including Microsoft 365, for email, calendar management, online meetings, document storage and collaboration.
Where relevant, we may use electronic signature or document-execution tools to manage contracts and other business documents.
We may use AI-supported tools to assist with drafting, summarizing, structuring, reviewing or analyzing information. Where personal data is processed using such tools, we take appropriate measures and use such tools in line with applicable obligations.
Unless otherwise communicated, we do not intentionally use client confidential information or personal data to train public AI models.
8. Marketing and events
Where permitted, we may send business contacts information about Luminance Health, our services, events, publications and related topics. You may object to marketing communications at any time.
If we organize or participate in events, webinars or workshops, we process personal data to manage registrations, participation, materials, speaker management, feedback and follow-up communications. If photos, recordings or participant lists are used, we provide appropriate information and obtain consent where required.
9. Recruitment
If you apply for a position with us, whether in response to a specific vacancy or on a speculative basis, we process the personal data you provide during the recruitment process to assess your application, communicate with you, conduct interviews and decide whether to enter into an employment relationship.
We retain application data only for as long as necessary for the recruitment process and any applicable legal obligations, unless a longer retention period is justified or consented to.
10. Recipients
We may disclose personal data to the following categories of recipients where necessary and permitted: employees and contractors; clients and project partners; external experts, consultants and service providers; IT, hosting, cloud, communication, document-management, electronic-signature, security and business-administration providers; banks, insurers, accountants, auditors and professional advisers; authorities, regulators, notified bodies, courts or other public bodies; business partners in connection with events or collaborations; and potential acquirers, investors or advisers in the context of corporate transactions.
Service providers who process personal data on our behalf are required to implement appropriate confidentiality, data protection and security measures.
11. International transfers
We are based in Switzerland. Some recipients of personal data may be located in other countries, including the European Economic Area, the United Kingdom and, depending on the tools and service providers used, other countries such as the United States.
Where personal data is transferred to countries that do not provide an adequate level of data protection under Swiss or applicable EU data protection law, we implement appropriate safeguards, such as standard contractual clauses or other legally recognized transfer mechanisms, unless an exception applies.
12. Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as long as we have a legitimate interest or legal obligation to retain it.
Client, project, accounting and business records may be retained for the duration of the business relationship and thereafter as required for contractual, documentation, accounting, regulatory or legal purposes. Accounting and business records may be retained for statutory periods of up to ten years under Swiss law. Where personal data is no longer required, we may take appropriate measures in the circumstances and in accordance with applicable law.
13. Data security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration or disclosure. These measures may include access controls, confidentiality obligations, secure IT systems, backups, encryption where appropriate and internal policies.
However, no method of transmission over the internet or electronic storage is completely secure. If you communicate with us electronically, you should be aware that such communications may involve security risks.
14. Your rights
Depending on the applicable law and subject to the relevant legal conditions and limitations, you may have certain rights in relation to your personal data, including the right to request information about whether and how we process your personal data, access your personal data, request correction, deletion or restriction of processing, object to certain processing, withdraw consent, receive certain personal data in a commonly used electronic format or request transfer to another controller where applicable, and lodge a complaint with a competent data protection authority.
To exercise your rights, please contact us using the contact details above. We may need to verify your identity before responding. We may refuse, restrict or delay a request where permitted or required by law, for example to protect the rights of others, comply with legal obligations or safeguard privileged or confidential information.
15. Changes to this Privacy Statement
We may update this Privacy Statement from time to time, for example if our data processing practices, tools, services or legal requirements change. The version published on our website is the current version.