Privacy policy

1. Responsible party

Inventage AG
Technoparkstrasse 1
8005 Zurich, Switzerland
Email: [email protected]

2. How the app works

The ImmuSuisse mobile app runs entirely on-device. All data you enter remains on your device. Inventage AG never has access to it. Optionally, you can sync your data with a Solid Pod of your choice (see section 5).

Under Swiss data protection law, vaccination data qualifies as particularly sensitive personal data (health data).

3. Data stored locally

The following data is stored on your device:

• Profile information: name, gender, date of birth, optional postal address (street and number, postal code, city), optional profile picture
• Recorded vaccinations: date, vaccine, lot number. For vaccines outside the Swiss catalogue, also the target diseases you declare yourself
• Recorded past illnesses: illness, date (year, optionally month and day), level of confirmation
• Information about the person administering the vaccination or documenting the illness, if you enter it: name, practice address
• For unlocking the vaccination status for assessment, a randomly generated device code and the redeemed unlock code. The device code only leaves your device if you send it to us to obtain an unlock code

The app's data and the sign-in data of the Solid Pod session are not included in your operating system's automatic cloud backup. The key used for Pod encryption is bound to your device and cannot be transferred via a backup. The data is not transmitted to Inventage AG or any third party, except for the optional Solid Pod sync (see section 5).

4. Device permissions

The app requests the following system permissions when needed:

• Camera: solely to scan QR codes, DataMatrix codes and barcodes (vaccination data, WebID addresses for the Solid Pod sign-in, pairing of another device), to photograph vaccine labels for on-device text recognition and optionally to take a profile picture. No images are saved or transmitted during scanning or text recognition.
• Photos (iOS): only if you choose to pick a profile picture from your photo library. On Android the app uses the system photo picker, which hands over only the chosen picture and needs no permission.

A profile picture is stored exclusively within the app on your device.

5. Optional sync via Solid Pod

You can optionally sync your data with a Solid Pod, an open, decentralised data platform. The choice of Pod provider is yours alone, as is responsibility for that provider's privacy practices. Inventage AG is neither the provider nor a data processor for this sync. Since version 26.10 the app encrypts your vaccination data on the device before writing it to the Pod (see section 8).

When you connect a Pod, the app retrieves the WebID address you entered and checks whether your provider's sign-in service can be reached. The sign-in service in turn loads a file from our web address that the app uses to identify itself. This request is made by the sign-in service, not by your device. No app data is transmitted in the process.

6. Data export

You can create a backup of your app data at any time and store it wherever you choose, either as a password-protected file or as a ZIP file in the open FHIR format (the Swiss health-data standard CH VACD). This operation runs entirely on your device. Password protection is described in section 8.

7. Updates to the vaccination plan and vaccine catalogue

The app retrieves the following files from the internet:

• the Swiss Vaccination Plan (periodically) from a web address operated by Inventage AG
• a version file (at most once per day, without cookies) from the same address, to check whether a newer app version is available
• the Swiss vaccine catalogue and the associated disease names (on launch) from fhir.ch, the official FHIR publication platform of HL7 Switzerland

The files are identical for all users. No app data and no personal identifiers are transmitted. The server logs technically must contain the IP address of the request. It is not linked to your app data.

The web address of Inventage AG is hosted by Netlify (Netlify Inc., USA). The app's requests first reach the network of Cloudflare (Cloudflare, Inc., USA), which passes them on to Netlify. The IP address may therefore be processed in the USA. Both companies are certified under the Swiss-US Data Privacy Framework. The Federal Council's adequacy decision of 14 August 2024 applies to such companies. fhir.ch is hosted in Switzerland (Infomaniak Network SA, Geneva).

8. Data security

On the device

Your app data is protected by the operating system's sandboxing against access by other apps. On a device with a screen lock, it is additionally stored encrypted. On iOS it cannot be read while the device is locked. The one exception is a Solid Pod sync already in progress, which finishes across the lock. On Android the app additionally encrypts its database and its settings itself. The key for this never leaves the device. All internet connections are made over encrypted HTTPS connections.

App lock

You can optionally lock the app with Face ID, Touch ID, fingerprint, face unlock or the device passcode. The check is done by the operating system. The app only receives the result and no biometric data.

Export

By default the backup file is encrypted on your device with a password. The password never leaves your device and is not stored anywhere. Without that password the file cannot be opened again, not even by us. To hand data to a health professional or another program you can choose an unencrypted ZIP file instead.

Solid Pod

The app encrypts your vaccination data on the device before writing it to the Pod, in the same way on iOS and Android. The Pod provider sees how many profiles there are and how many vaccinations and illnesses are stored for each profile. It also sees when entries were changed or deleted. To the provider, the profiles appear as random identifiers. Names, dates of birth, addresses, vaccines, lot numbers, illnesses and details of the vaccinating person cannot be read by the provider.

The key exists only on the connected devices and, protected by a security code, in the Pod itself. The app shows the security code once when you set up the connection. You connect further devices with this code or by pairing with an already connected device. Neither the security code nor the pairing code is transmitted to Inventage AG. Without the security code and without a connected device the data in the Pod can no longer be read, not even by us. A connected device can create a new code at any time.

If you used the Pod before version 26.10, you switch the data to encryption on the "Storage location" page. Until you switch, the data there is unencrypted and the Pod provider can read it.

9. No tracking, no analytics, no advertising

The app contains no trackers, no analytics tools, no advertising, and no third-party crash reporting. The app itself transmits no usage or telemetry data.

Apple and Google show us how often the app has been downloaded. If you have allowed your device to share analytics data with app developers, we also receive technical crash reports and aggregated usage statistics. We use the download figures and the crash reports. The crash reports help us fix bugs.

10. Children and family

The app is suitable for managing the vaccination data of an entire family, including children. The same protections apply to children as to adults. Parents or legal guardians are responsible for managing the data of their minor children.

11. Data deletion

You can delete individual profiles, vaccinations, past illnesses, or all app data within the app at any time. Uninstalling the app permanently removes all locally stored data. "Delete all data" also removes the sign-in data of the Solid Pod session and the key used for Pod encryption. If a Solid Pod is connected, you choose between "Delete locally only" and "Delete everywhere". "Delete everywhere" also removes the vaccination data and the key file in the Pod. Otherwise the data in the Pod is retained until you delete it via another connected device or via your Pod provider.

Inventage AG retains no app data. Accordingly, there are no retention periods set by Inventage AG.

12. Your rights

You have the right to access, correct, and delete your data. Because Inventage AG has no access to your app data, you exercise these rights directly within the app. For any further questions, contact us at[email protected]. Cloudflare (Cloudflare, Inc., USA) receives emails sent to this address and forwards them to the mailbox of Inventage AG.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) if you believe your data protection rights have been violated.

13. Scope and applicable law

ImmuSuisse is intended exclusively for users in Switzerland. The app is based on the Swiss Vaccination Plan and the Swissmedic vaccine catalogue and is not designed for use outside Switzerland.

This privacy policy and the data processing within the app are governed by Swiss law, in particular the revised Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO).

14. Updates

We reserve the right to amend this privacy policy. Changes will be published on this page.

Last updated: October 2026