Privacy notice
Last updated: 27 October 2026
This notice explains how HealthSeed AG handles personal data on healthscale.org: when you visit the website, join the HealthScale waiting list, send us a Health Innovation Hub partnership enquiry, or write to us. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
1. Who is responsible
HealthSeed AG, Weidmannstrasse 5, 8046 Zürich, Switzerland, commercial register number CH-020.3.056.106-6, runs HealthScale and is responsible for the processing described here. HealthSeed’s own website, healthseed.vc, has its own privacy policy.
Contact for privacy questions and requests: hello@healthscale.org
2. When you visit the website
When you open healthscale.org, our hosting provider automatically processes technical data so the page can be delivered and protected: your IP address, the date and time of the request, the page requested, and your browser and device type. This data is kept in server logs for a short period set by the hosting provider and is used only to run the website and to detect misuse.
Legal basis (GDPR): our legitimate interest in a secure, working website (Article 6(1)(f)).
The website sets no cookies and uses no advertising tools. Fonts and images are served from our own website, so your visit is not shared with font or image providers.
To understand how the website is used, we use Vercel Web Analytics, which sets no cookies. It records the time of a visit, the page path, the referring website, an approximate location derived from your IP address (country, region, city), and your device, operating system, and browser. It also records when someone joins the waiting list (with the category chosen, but no name or email address) or clicks the sponsorship contact link. Visitors are counted using a hash that is discarded after 24 hours, so you cannot be identified, and we see only aggregated figures. Legal basis (GDPR): our legitimate interest in understanding and improving the website (Article 6(1)(f)).
3. When you join the waiting list
What we collect
- your name
- your work email address
- your company or organisation
- the category you choose (for example start-up, hospital, or investor)
- your consent, with the date and time of sign-up and of confirmation
Why
We use this data to confirm your email address, to tell you when HealthScale opens and when you are invited, including invitations to test it before launch, and to plan invitations by member category. We send no other marketing.
Legal basis: your consent under Article 6(1)(a) GDPR and the FADP. You give it by ticking the box and confirming your email address. We store the date and time of your confirmation as evidence of consent. You can withdraw consent at any time; this does not affect processing that took place before.
Confirmation
After you submit the form, we send one email asking you to confirm your address. You are added to the waiting list only after you click the link. If you do not confirm, we delete your sign-up after 30 days.
For each email we send, our email provider keeps a delivery record: your email address, the email sent, and whether it was delivered, deferred, or bounced. We do not track whether you open our emails or click their links.
Please do not enter health information about yourself or anyone else in the form. We do not need it.
Leaving the waiting list
Every email has a one-click unsubscribe link, and you do not need to give a reason. You can also write to us and we will remove you. When you unsubscribe, sending stops at once. Within 30 days we delete your name, company, and category. We keep your email address with the dates of consent, confirmation, and unsubscribing as a suppression record, so we do not email you again by mistake; this is based on our legitimate interest. You can ask us to erase this record too, but we will then be unable to stop the address being added again.
4. When you write to us
If you email us, for example at sponsorship@healthscale.org or hello@healthscale.org, we process your message and contact details to reply and, where relevant, to prepare an agreement with you.
Legal basis: steps taken at your request before a contract, and our legitimate interest in answering enquiries. Please do not include sensitive information, such as health information, in your message.
5. Partnership enquiries from hubs and accelerators
When you use the form on our Health Innovation Hubs page or our accelerators page, HealthSeed AG collects your name, organisation, role, work email, country, the type of organisation or programme, and your message. We use these details to reply to you and to discuss a possible partnership. Our basis is our legitimate interest in answering enquiries you send us.
If you tick the box for updates, we also send you occasional HealthScale news for partners, based on your consent. You can withdraw it at any time through the unsubscribe link in every email or by writing to hello@healthscale.org.
After you send the form, we email you once through Brevo to confirm we received it. That email has a link to remove your request if you did not send it. We keep your enquiry in Attio, our contact management system, and send updates through Brevo. We keep enquiry details for 12 months after our last contact with you, unless a partnership follows. Please do not include patient information in your message.
6. When you talk to Mira, our AI guide
Mira is an AI guide on healthscale.org. She is not a person. She tells visitors about HealthScale and asks a few optional questions about what they would need from the community. You can type, or press Talk and speak. Please do not share patient or personal health information with her.
To run the conversation, we use three providers. Each one processes data under its own terms and data processing agreement:
- Anthropic (Claude) receives what you type, or the text of what you said, and writes Mira’s replies.
- ElevenLabs turns Mira’s replies into speech. If you press Talk, it also receives your voice recording to turn it into text.
- Simli AS, Norway, animates Mira’s face from her spoken replies. It receives Mira’s voice, never yours, and your IP address for the video connection. Simli’s terms allow it to use the content it processes to improve and train its own models, so Mira never repeats your name, organisation, or other personal details aloud.
We do not store your conversation. At the end, Mira asks whether we may use your answers. Only if you agree do we record anonymous themes from them, such as the type of organisation and the kind of support that would help, in Vercel Web Analytics, without what you said or who you are. Mira makes no decisions about you.
Legal basis (GDPR): our legitimate interest in answering visitors’ questions (Article 6(1)(f)), and your consent for the anonymous themes from your answers (Article 6(1)(a)). If you choose to speak, you consent to the use of your microphone by pressing Talk and allowing it in your browser (Article 6(1)(a)); you can type instead at any time.
Each provider keeps data for the periods set in its own terms. Anthropic and ElevenLabs are based in the USA, and ElevenLabs is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks; section 8 explains how transfers are protected.
Who is responsible for what. HealthSeed AG is responsible for offering Mira, for choosing these providers, for the instructions Mira follows, and for the anonymous themes we record with your consent. Each provider is responsible for its own compliance with data protection law when it processes data under its own terms. Simli is based in Norway, in the European Economic Area, and processes data under the GDPR.
7. Who receives your data
Only HealthSeed AG staff who need it for the purposes above see your data. We do not sell personal data. We use these service providers, who process data on our behalf under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc., USA | Website hosting, the waiting-list form, and visit statistics | Server functions in Frankfurt, Germany; content delivery network worldwide; company in the USA |
| Brevo SAS, Paris, France | Confirmation emails and the waiting list | EU (France, Germany, Belgium) |
| Google (Google Workspace) | Our email inboxes | EU and USA |
| Attio Ltd, London, United Kingdom | Hub and accelerator partnership enquiries, and consent records | Hosted on Google Cloud; company in the United Kingdom; some sub-processors in the USA |
| Anthropic PBC, USA | Writing Mira’s replies | USA |
| ElevenLabs | Mira’s voice, and turning your speech into text when you press Talk | USA (certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks) |
| Simli AS, Oslo, Norway | Animating Mira’s face | Norway (EEA), under the GDPR. Simli is responsible for its own compliance, including the hosting providers it uses |
We may also disclose data to advisers, authorities, or courts where the law requires it or to protect our rights.
8. Transfers outside Switzerland and the EU
Some providers are outside Switzerland, the EU, and the EEA, including in the USA. We transfer data only on the basis of an adequacy decision, EU and Swiss standard contractual clauses, or certification under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks, with additional safeguards where appropriate. You can ask us for a copy of the relevant safeguards.
Attio is based in the United Kingdom, which Switzerland and the EU recognise as providing an adequate level of data protection. Where Attio uses sub-processors in the USA, transfers are covered by standard contractual clauses under Attio’s data processing agreement.
9. How long we keep data
| Data | Kept for |
|---|---|
| Server logs | A short period set by the hosting provider, then deleted |
| Conversations with Mira | Not stored by us; anonymous themes only, as visit statistics. Providers keep data under their own terms |
| Unconfirmed waiting-list sign-ups | 30 days |
| Confirmed waiting-list entries | Until you unsubscribe or withdraw consent |
| After you unsubscribe | Name, company, and category deleted within 30 days; suppression record kept as described in section 3 |
| Email delivery records | 24 months |
| Hub and accelerator partnership enquiries | 12 months after our last contact with you, unless a partnership follows |
| Emails you send us | For the exchange plus up to 24 months, or as long as any resulting relationship lasts |
| Records the law requires us to keep | The statutory period |
10. Your rights
Under Swiss and EU data protection law you can:
- ask what personal data we hold about you and receive a copy
- have incorrect data corrected
- have your data deleted
- object to processing based on our legitimate interest, or ask us to restrict it
- receive data you gave us in a common electronic format
- withdraw your consent at any time, with effect for the future
To leave the waiting list, use the unsubscribe link in any of our emails or write to hello@healthscale.org. For any other request, write to the same address or to HealthSeed AG, Weidmannstrasse 5, 8046 Zürich, Switzerland. We may ask you to confirm your identity.
You can also complain to a data protection authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). In the EU or EEA you can contact the supervisory authority in your country.
11. Automated decisions
We do not make decisions about you by automated means alone, and we do not build profiles from your data.
12. Security
We protect personal data with technical and organisational measures, including access controls, encryption in transit, and contractual safeguards with our providers.
13. Children
HealthScale is for people working in health innovation and is not directed at children. We do not knowingly collect data from children.
14. Changes
We will update this notice when HealthScale opens and whenever our processing changes. The date at the top shows the current version.