Privacy

Responsible person

Dr. phil. Daryl Niedermoser, Praxis Niedermoser, c/o MedBasel, Steinenvorstadt 75, 4051 Basel, Switzerland. For privacy questions: info@niedermoser.ch.

Visiting the website

The public website is hosted by Green in Switzerland. For operation and protection against misuse, the host processes access data including IP address, time, requested address, and information about browser and operating system.

The site has no visitor analytics or advertising trackers. Images and design resources are served locally. No external maps, videos, social media widgets or font services are embedded. Public information pages do not set their own cookies. Necessary session cookies are used for the enquiry form, member area and world map as described below.

Language and reading settings

English pages are served directly by this website; no external translation service is embedded. Text size, contrast, spacing, reduced motion, reading view and speech speed are stored in sessionStorage for the current browser tab. No form entries or health information are stored by these controls. Reset removes the settings; storage lifetime also depends on browser session restoration.

Read-aloud starts only when you select it. It reads visible information in the main page, not form input. Only speech voices reported by your browser as local are used. The website does not send text to a speech service. Availability and playback depend on your browser, operating system and installed voices. If no suitable local voice is available, use your device's accessibility features.

Protected member area

Opening Member / Login sets the necessary session cookie niedermoser_members. It supports login, session assignment and form protection; it is not used for advertising or analytics. Login requires it. You can block or delete cookies and still read the public information pages.

The session cookie is intended for the browser session and is deleted at logout. Browsers may restore sessions when reopened. Access expires after 30 minutes of inactivity or a maximum of eight hours.

The hosting server stores the username and a one-way password hash, not the plain-text password. Failed login attempts are recorded with hashed IP-address and username identifiers to protect against repeated attempts. These are not fully anonymous. Outdated attempt identifiers are removed after no more than 24 hours at the next use of the member area.

When additional authentication is configured, the authenticator key is encrypted in the private application database; the encryption key is stored separately outside the public website directory. Recovery codes are shown once and then stored only as hashes. Used codes cannot be reused. The practice has no access to your authenticator app.

To let the practice resend a complete personal invitation, an additional invitation code is stored as a hash and in encrypted form in the private application area. The encryption key is kept separately outside the public website directory. Only confirmed administration can retrieve the invitation again. The invitation remains bound to the participant account, its access version and expiry. Existing passwords are not replaced. Blocking, deleting or renewing the account invalidates its previous invitation. Share personal links and codes only with their intended recipient.

The currently offered five-finger exercise processes your input in the browser. Its code does not send your notes to the server or store them in browser storage. Printing or saving as PDF may create a copy on your device, for which you are responsible.

Enquiry form

The form distinguishes individual appointments, assessments, course or corporate enquiries and other organisational matters. It collects your name, email address and chosen service. For service enquiries, acknowledgment of relevant terms is recorded with the document version, time and document identifier in the message to the practice inbox. This acknowledgment is not consent to treatment or confirmation of a booking.

For course enquiries, you can add group size, location and preferred period. Details are sent to the practice inbox to answer your enquiry. Please do not enter findings, diagnoses or detailed health information.

A necessary browser-session cookie protects against third-party and duplicate submissions. It is not used for advertising or analytics. To limit automated enquiries, temporary entries with a salted IP identifier are stored on the hosting server outside the public website directory. They contain no names, email addresses or message content and are removed after no more than 24 hours at the next form use. They are not fully anonymous.

The message itself is subsequently processed and retained in the practice inbox. Without the necessary session cookie, you can contact the practice by post.

Your communication choice

You select ordinary email for your enquiry and organisational replies using a separate, unselected checkbox. Risks, scope and providers are explained beforehand. Post is available without an email address or email consent.

Consent does not cover therapeutic content, clinical findings, reports or invoices and is not a blanket release from professional confidentiality. Its exact text, version, SHA-256 document identifier, supplied email address and time are recorded in the message to the practice inbox. The email address is recorded as your statement, not technically verified as your identity.

After successful submission, a personal text copy is available over HTTPS in the same browser session for at most one hour. Access is then blocked and the session entry is removed at the next form use. Documentation in the practice inbox is separate.

You may change or withdraw your choice for future communication by post or an already agreed channel. State how you wish to be contacted instead. This does not end our collaboration. Your choice does not replace legal duties or the separate review of providers and international processing.

Full communication information and consent text.

Contact and confidential documents

When you contact the practice, your contact details and information are processed to answer your enquiry and explore working together. Email links open your email application. An email or form enquiry alone is not blanket permission for unprotected communication or disclosure. Informed consent for ordinary organisational email replies is clarified separately.

Email to info@niedermoser.ch and the previous practice address is forwarded to the practice Gmail inbox. Green and Google therefore process those messages. Google also processes data outside Switzerland, particularly in the USA. Google's privacy notice and international transfer information describe its processing and safeguards.

Ordinary email does not ensure confidentiality throughout. Do not send diagnoses, reports or detailed health information with an initial enquiry. We personally agree a suitable encrypted route or post for confidential documents beforehand. Any password is shared through a separate channel. Only send the documents after the route has been agreed.

Retention

Retention depends on the processing purpose and applicable legal duties. You can ask the responsible person about periods relevant to your enquiry. If treatment or counselling begins, documentation arrangements are explained separately.

Your rights

Within applicable law, you may request access, correction or deletion and exercise other data protection rights. Statutory retention duties may prevent immediate deletion. Contact the person named above. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB).

Public world map: “Our little world”

The map and homepage globe show published place contributions. Participation, year, text and photo are voluntary; no name or account is required. Only the centre of a place is taken from the location list. The service is independent of treatment and is not linked to patient records. Do not include health or identifying information or photos of real people.

Place, optional year, text and photo, category, submission time, review status and reasons are processed on Green hosting in Switzerland. Unpublished contributions, photos, accounts and review logs are kept in a private application database or image folder outside the public website directory. Images are re-encoded, resized to a maximum side length of 1,800 pixels and stripped of metadata such as geotags.

The necessary niedermoser_map session cookie supports form protection and map administration, not advertising or analytics. Administration expires after 30 minutes of inactivity and at most eight hours. Salted IP identifiers limit misuse and are not fully anonymous. Expired rate-limit identifiers are removed on the next use after their one-hour window.

Your browser retrieves map and place data from this website. Our server retrieves needed map resources from the providers described below. The globe retrieves public contributions and the local base map from this website.

Text-only contributions are published if a local word and pattern filter finds no reason for review. Flagged text is held for manual review. The filter has limited contextual understanding and can both flag harmless text and miss problematic text.

Photos are reviewed manually unless optional automatic image review is separately configured and selected by the contributor. Automated recognition can make mistakes. Possible people, identifying details, problematic content, uncertainty and technical errors lead to manual review.

Only when image review is enabled and the contributor makes a separate voluntary selection is the resized, metadata-free photo sent server-side to OpenAI in the USA. Place, contribution text and visitor identifier are not sent with it. Manual review is available without this selection. Responses are requested with response storage disabled. Under OpenAI's published processing information, API content is not used for training by default; abuse-monitoring retention is generally up to 30 days and may be longer in specified exceptions. Before activation, the practice owner must review the applicable API-account data-processing and international-transfer conditions. These notices do not replace that review.

The practice owner receives the place contribution and any metadata-free photo in the practice inbox. Green and forwarding to Google/Gmail are involved, including processing outside Switzerland, particularly in the USA. Delivered photo attachments must be managed separately from the map application.

Published contributions remain in the public travel album until hidden or removed. Contributions held for content-related review and explicitly rejected contributions are kept securely for at least 60 calendar months under the practice's operating rule, to document decisions and handle complaints. This is a period chosen by the practice, not a general statutory requirement. Continued necessity is reviewed after that period; there is no automatic publication. Privacy rights and mandatory rules remain reserved.

Requests for access, correction, objection or deletion are reviewed individually by the practice owner. State the place and approximate submission time; the contribution identifier shown after successful submission can also help.

Full multilingual world map privacy information.

World map services

The worldwide basemap uses OpenFreeMap with OpenStreetMap data. Our server retrieves only needed map tiles and map-label glyphs. The optional Swiss detailed map comes from swisstopo/geo.admin.ch. Map resources are temporarily cached on our server and in your browser; the server-side map cache is limited to 100 MB. Your browser connects only to this website. Map providers receive our server IP and the requested map areas, not your browser IP. Contribution text, photos, account data and device location are not transmitted. Public-place search runs only when you click: the selected town and search term are sent to geo.admin.ch through our server. Private-address search is excluded. Short-lived salted IP identifiers only limit map requests and are removed within 24 hours on the next use.

Optional information about new course programmes

You may request email updates about new course programmes from niedermoser.ch. The form asks only for your email address and requires you to actively select a separate, initially empty consent checkbox. Signing up is optional and independent of purchase, course access, assessments or participation records. Please do not submit health information. Existing course accounts and patient records are not automatically added to this list.

Consent lasts no more than twelve calendar months from your explicit registration. We record the purpose, email address, language, consent wording and version, registration time, confirmation status and fixed expiry date. An email from kurse@niedermoser.ch contains a confirmation link valid for 48 hours. You must explicitly confirm on the linked page before your subscription becomes active. Opening the link alone does not activate it. Confirmation, resending the message or signing into a course does not extend the deadline. There is no automatic renewal.

You may withdraw at any time without signing in, using the personal unsubscribe link in the emails or contacting kurse@niedermoser.ch. Confirmed withdrawal immediately blocks further course updates. The list is separate from course accounts. Deleting a course account neither extends consent nor replaces withdrawal. Contact details are not shared with advertising companies.

The responsible person is Dr. phil. Daryl Niedermoser, Praxis Niedermoser, c/o MedBasel, Steinenvorstadt 75, 4051 Basel, Switzerland. The list is held in a separate, non-public database on Green hosting in Switzerland, accessible to the practice owner through protected administration. Internal notifications contain only a random reference and an administration link. Your email address is passed to the existing email service to send the requested messages. The Green/Google recipients and international processing described on this page and in the email communication information apply.

Unconfirmed registrations are removed after seven days. Contact details are cleared at the next maintenance processing after withdrawal or expiry. Minimal evidence remains for at most another 30 days before deletion. Checks run when the application is used and through the existing five-minute maintenance schedule. An interrupted server service can delay cleanup. Regardless of cleanup, an expired or withdrawn address is blocked from new course updates. Earlier consents retain their original purpose and previous 180-day retention period. They are not automatically enrolled in the new list.

Salted abuse-prevention identifiers are removed after 24 hours at the next processing. Normal host access logs may be processed separately. A necessary session cookie protects the form. No advertising trackers are used. You may request access, correction, withdrawal or deletion through the contact details above. Backup copies may remain until the end of the existing backup cycle and are not used for new contact.