Privacy Policy

Welcome to QwickRx Global Care ("QwickRx," "we," "us," or "our"), a Swiss company headquartered in Basel, Switzerland. We are committed to protecting your privacy and ensuring the security of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our healthcare platform and services.

We comply with the Swiss Federal Act on Data Protection (FADP), the European Union's General Data Protection Regulation (GDPR), and the U.S. Health Insurance Portability and Accountability Act (HIPAA) where applicable. By using QwickRx, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use our services.

Personal Information

• Identity Data: Full name, email address, phone number, date of birth, gender
• Contact Data: Billing address, delivery address, country of residence
• Financial Data: Payment card details, bank account information, billing information
• Account Data: Username, password, security questions and answers

Health Information

• Medical Records: Diagnoses, treatment histories, prescriptions, lab results
• Insurance Information: Policy numbers, coverage details, claims history
• Health Metrics: Data from wearable devices, vitals, activity levels
• Appointments: Scheduling information, provider notes, consultation records
• Google Calendar (providers who connect it): OAuth tokens and calendar event data needed to create appointment events and Google Meet links, as described in Google API Data Use below

Technical Data

• IP address, browser type and version, device information
• Usage data, including pages visited, features used, time spent
• Cookies and similar tracking technologies
• Location data (with your permission)

We use your information for the following purposes:

QwickRx uses Google Calendar API data to provide calendar and appointment-management functionality requested by users, including creating calendar events and Google Meet links for virtual consultations. This section describes that use and affirms QwickRx's compliance with the Google API Services User Data Policy, including the Limited Use requirements.

What Calendar data we collect and why

When a consulting doctor or authorized partner connects Google Calendar, we collect only what is needed to run the requested appointment features:

• OAuth access and refresh tokens to keep the Calendar connection working until the user disconnects it
• Calendar event fields we write or read for QwickRx appointments (title, description, start and end time, timezone, attendee emails, conference/Meet link, and Google event ID)
• Connection status (whether Calendar is connected), so we can show the integration in the user's profile

We do not request or use Google user data for independent product research, credit scoring, or any purpose other than providing or improving user-facing features that are prominent in the requesting application's user interface.

How that data is stored and processed

• Google OAuth refresh tokens are stored on the connected user account on QwickRx servers and used only to create or update Calendar events and Meet links for QwickRx appointments.
• Event IDs and Meet URLs needed to run the appointment are stored with the related QwickRx appointment or session record.
• Data is transmitted over TLS and stored with access controls described in Data Security.
• Human access to Google user data is limited to cases needed to operate or secure the feature (for example, diagnosing a failed Calendar connection at the user's request).

Third-party AI providers (Fireflies.ai and OpenAI)

QwickRx may use third-party service providers, including Fireflies.ai for meeting recording and transcription and the OpenAI API for meeting summarization. These services are used only to provide functionality requested by the user (patient-friendly visit summaries after a virtual consultation).

• QwickRx never shares Google OAuth tokens with these providers, and never reads your existing calendar entries in order to forward their contents to them. No Google Calendar API response payload is sent to Fireflies or OpenAI.
• To provide the recorded visit summary feature, QwickRx adds the Fireflies notetaker as an attendee on the single consultation event that QwickRx itself creates, so it can join the Google Meet call and transcribe it. Because attendee notifications are enabled, Google sends Fireflies the standard invitation for that one event, which includes the event title, start and end time, attendee list, and Meet link. Every field in that invitation originates from your QwickRx appointment record rather than from reading your calendar, and Fireflies receives no other Google Workspace data.
• OpenAI receives the Fireflies transcript or summary (and related visit-context needed to write a patient-friendly summary). It does not receive Google Calendar API user data.
• QwickRx does not opt in to sharing OpenAI API inputs and outputs for model improvement or training.
• Neither provider uses Google Workspace user data to develop, train, or improve generalized or foundational AI/ML models.

Retention and deletion

• Google Calendar tokens are kept only while the integration remains connected. Disconnecting Google Calendar in the QwickRx profile revokes and deletes the stored tokens.
• Calendar event identifiers and Meet links stored on appointment records are retained with the appointment according to our ordinary healthcare and account-retention rules, and are deleted or anonymized when the account or records are deleted as described under Your Privacy Rights.
• To request deletion of Google user data, disconnect Calendar in your profile or contact us at hello@qwickrx.ch or dpo@qwickrx.ch.

Raw or derived user data received from Google Workspace APIs is handled in accordance with Google's User Data Policy and Limited Use requirements.

What happens during a virtual consultation

When you book a virtual consultation with a QwickRx consulting doctor, the appointment takes place over Google Meet. An automated notetaker provided by Fireflies.ai joins the call as a visible participant and records and transcribes the conversation. Google Meet also displays a recording indicator while this is active.

The recording exists for one reason: to produce a clear, patient-friendly written summary of what was discussed and what was recommended, so you have an accurate record after the visit and do not have to rely on memory or notes.

What is processed, and by whom

• Fireflies.ai captures the audio and video of the consultation and produces a transcript and an initial summary. Fireflies does not use meeting content to train AI models and applies a zero data retention policy with its own downstream vendors.
• OpenAI receives the resulting transcript or summary text in order to rewrite it into plain, patient-friendly language. Data sent through the OpenAI API is not used to train OpenAI models, and QwickRx has not opted in to any model-improvement programme.
• QwickRx stores the resulting summary against your consultation record so you and your treating provider can refer back to it.

Because a consultation concerns your health, this material is treated as sensitive personal data and is handled under the safeguards described in Data Security and Regulatory Compliance.

Your choices

• You may ask for the consultation not to be recorded. Tell your provider at the start of the call, or contact us in advance at hello@qwickrx.ch, and the notetaker will be removed. Declining does not affect your access to care or your coverage — you simply will not receive an automated written summary.
• You may ask us to delete a recording, transcript, or summary after the visit by contacting hello@qwickrx.ch or dpo@qwickrx.ch.
• You may request a copy of the summary held about you, as described under Your Privacy Rights.

Retention

Visit summaries are retained with your consultation record under our ordinary healthcare record-retention rules, and are deleted or anonymized when the underlying records are deleted. Recordings and transcripts held by Fireflies.ai are retained according to our configuration of that service and are deleted on request.

We may share your information with:

• Healthcare Providers: Hospitals, clinics, laboratories, and pharmacies within our network for treatment purposes
• Insurance Partners: To process claims and verify coverage
• Service Providers: Third-party vendors who assist in operations, including payment processors, cloud storage, Fireflies.ai (meeting transcription for requested virtual visits), and OpenAI (patient-facing visit summarization). Google Calendar API user data is not shared with Fireflies.ai or OpenAI.
• Legal Authorities: When required by law or to protect rights and safety
• Business Transfers: In the event of merger, acquisition, or sale of assets

We implement industry-leading security measures to protect your information, including Google API tokens and related appointment data:

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Under Swiss data protection law, GDPR, and other applicable regulations, you have the following rights regarding your personal information:

GDPR Rights (for EU/EEA Residents)

• Right of Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data under certain circumstances
• Right to Restriction of Processing: Request limitation on how we process your data
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing of your data for certain purposes
• Right to Withdraw Consent: Withdraw consent where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local data protection authority

Swiss Data Protection Rights

• Right of Access: Request information about data processing
• Right to Correction: Request correction of inaccurate data
• Right to Object: Object to data processing under certain conditions
• Right to Data Deletion: Request deletion when legally permissible

HIPAA Rights (for U.S. Residents)

• Right to Access PHI: Inspect and obtain copies of your protected health information
• Right to Amend: Request amendments to your health records
• Right to an Accounting: Request a list of disclosures of your PHI
• Right to Request Restrictions: Request restrictions on uses and disclosures
• Right to Confidential Communications: Request communications by alternative means

To exercise these rights, including deletion of Google Calendar connection data, contact us at hello@qwickrx.ch or write to our Data Protection Officer at the address listed in the Contact section. You may also disconnect Google Calendar from your QwickRx profile at any time.

GDPR Compliance

As a Swiss company serving users in the European Economic Area (EEA), we are committed to full compliance with the General Data Protection Regulation (GDPR).

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• • Consent: You have given explicit consent for processing
• • Contract Performance: Processing is necessary to fulfill our services
• • Legal Obligation: Required to comply with legal requirements
• • Vital Interests: Necessary to protect life or health
• • Legitimate Interests: For our legitimate business interests, where not overridden by your rights

HIPAA Compliance (for U.S. Operations)

For services provided to U.S.-based users, QwickRx complies with the Health Insurance Portability and Accountability Act (HIPAA) and implements appropriate safeguards.

Swiss Data Protection

As a Swiss company, we comply with the Swiss Federal Act on Data Protection (FADP) and benefit from Switzerland's strong data protection framework, which is recognized as providing adequate protection by the European Commission.

QwickRx operates globally from our headquarters in Basel, Switzerland. Your information may be transferred to and processed in Switzerland and other countries where we operate.

Transfer Mechanisms

We ensure appropriate safeguards are in place for international transfers:

• • EU-Swiss Adequacy Decision: Switzerland is recognized by the EU as providing adequate data protection
• • Standard Contractual Clauses (SCCs): Approved by EU Commission for transfers outside EEA
• • GDPR Article 49 Derogations: When applicable for specific situations
• • Swiss-US Data Privacy Framework: For transfers to certified US organizations
• • Binding Corporate Rules: For intra-group transfers

Our services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

For users between 13-18, we require parental consent for certain features and services.

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• • Posting the updated policy on our website
• • Sending email notification to your registered email address
• • Displaying a prominent notice on our platform

Changes become effective immediately upon posting unless otherwise stated. Your continued use of QwickRx after changes constitutes acceptance of the updated policy.