Data protection

UKBB collects and processes personal data in the context of your or your child's treatment. Data such as name, address, telephone number or health insurance company are used to arrange appointments and issue invoices. In addition, other health data relevant to the treatment will be collected and used. If you have consented to the further use of patient data and samples for research purposes using the separate form provided, the data will also be used within the framework described there.

The collection of personal data complies with the legal requirements for the processing and protection of patient data and is primarily based on the paediatric hospital contract, the Basel-Stadt Health Act and the Basel-Stadt Information and Data Protection Act ("IDG"). The data protection provisions of the IDG Basel-Stadt apply first and foremost. Whether and to what extent other data protection provisions (the Swiss Data Protection Act "DSG", the EU General Data Protection Regulation "DS-GVO") may be applicable may depend on the individual case.

You have the right vis-à-vis the UKBB to inspect your personal data, correct incorrect data and delete unlawfully processed data.

If you have any questions about data protection, you can contact our data protection advice centre:

University Children's Hospital Basel (UKBB)
Data protection
Spitalstrasse 33, P.O. Box
CH-4031 Basel

or "datenschutz@ukbb.ch". The responsibility for data security when disclosing your own personal data via e-mail lies with you.

On the website https://ukbb.ch/verfahrensverzeichnis you will find an overview of the purposes for which the UKBB may process personal data in the course of individual treatment, including the relevant legal bases.

The University Children's Hospital Beider Basel (hereinafter also "UKBB", "we", "us") collects and processes personal data, in particular personal data about our patients, relatives and persons associated with them, other customers, contracting parties, visitors to the website, with their consent, participants in events and recipients of newsletters, healthcare providers and employees (hereinafter also referred to as "You"). We use the term "data" here synonymously with "Personal data" or "Personal data".

With "Personal data" refers to data that can be linked to a specific person, and "processing" refers to any handling of it, e.g. obtaining, storing, using, adapting, disclosing and deleting.

If you transmit or disclose data about other persons, such as family members, work colleagues, etc., we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this data protection declaration.

This privacy policy is based on the Basel-Stadt Information and Data Protection Act ("IDG"), the Swiss Data Protection Act ("DSG") and the EU General Data Protection Regulation ("GDPR"). The provisions of the IDG Basel-Stadt apply first and foremost. Whether and to what extent other laws are applicable depends on the individual case.

The University Children's Hospital Basel, Spitalstrasse 33, CH-4056 Basel is responsible under data protection law for the data processing described in this data protection declaration, unless otherwise communicated in individual cases (e.g. in other data protection declarations, on forms or in contracts).

If you have any questions about data protection, please contact the following address:

University Children's Hospital Basel
Data protection
Spitalstrasse 33, P.O. Box
CH-4031 Basel

Or to "datenschutz@ukbb.ch". The responsibility for data security when disclosing your own personal data via e-mail lies with you.

We process our patients' data in order to be able to provide them with our contractual services, including any pre-contractual communication. The primary purpose is to provide, document and invoice our healthcare services professionally and in accordance with contractual and legal obligations. The data processed in this context, the type, scope and purpose and the necessity of the processing are determined by the underlying contractual relationship. For this purpose, we process your master data (e.g. name, address), as well as contact data (e.g. e-mail address, telephone, etc.), contract data (e.g. services used, costs, names of contact persons) and payment data (e.g. bank details, payment history, etc.). However, we also process your health data in particular (so-called special personal data; information on your past and current state of health, treatment history, therapies, prescribed medication, visual records such as X-rays, tomography or other images, laboratory and other analyses, etc.). We may also receive health data from healthcare professionals who refer you to the UKBB or who have treated you in the past, or we may retrieve health data from the electronic patient dossier (EPD) or receive information from you or your relatives, depending on the case.

We may also process this data within the scope of the law to protect your safety and the safety of other patients for quality assurance purposes or, with your consent, use it for training, further education and training purposes.

The data is deleted when it is no longer required or after the statutory retention and archiving periods have expired.

The legal basis for the processing of your personal data in connection with the provision of healthcare services is our statutory obligations and public duties as an independent institution under public law in accordance with the Children's Hospital Contract, the Cantonal Information and Data Protection Act, the Cantonal Health Act (in particular treatment, documentation and retention obligations), or billing obligations in accordance with the Federal Health Insurance Act).

The UKBB collects and processes data from applicants (e.g. contact details, CV, qualifications, letter of motivation) for the purpose of handling the application process and, in the case of successful applications, for the preparation and conclusion of a corresponding contract. Please refer to the privacy policy in the application portal for detailed data protection information on the application process.

In particular, we may transfer your personal data to the following categories of recipients:

• If necessary for the fulfilment of the contract or required by law, we transmit the data we receive from you to medical specialists (in particular general practitioners, medical practices, other clinics and hospitals), cost bearers, authorities, relatives, third parties typically involved in the treatment, such as laboratories, drug and medical product manufacturers, ambulance and rescue services or comparable service providers, if this is necessary, required by law or with your express consent.
• We use various services from third parties, in particular IT services (examples include providers of hosting and data analysis services), shipping and logistics services and services from banks, the post office, consultants, etc. These service providers may also process personal data to the extent necessary. Where appropriate and justifiable, cloud-based solutions may be used (including foreign providers where applicable). Our service providers are contractually obliged to process the data exclusively on our behalf and in accordance with our instructions.

The recipients of data are not only located in Switzerland. This applies in particular to certain service providers (especially IT service providers). These have locations both within the EU or the EEA, but also in other countries worldwide. We may also transfer data to authorities and other persons abroad if we are legally obliged to do so or, for example, as part of legal proceedings. Not all of these countries have adequate data protection. We regulate data protection through appropriate contracts.

In certain cases, we may transfer data in accordance with data protection regulations, e.g. if you have consented to the corresponding disclosure or if the disclosure is necessary for the performance of a contract, for the establishment, exercise or enforcement of legal claims or for overriding public interests.

Every time you use our website, certain data is automatically collected for technical reasons and temporarily stored in log files (log data), in particular the IP address of the end device, information about the Internet service provider and the operating system of your end device, information about the referring URL, information about the browser used, date and time of access and content accessed when visiting the website. We need this data so that our website can be used, to ensure system security and stability and to optimise our website, and for statistical purposes. Deletion takes place as soon as the storage of the access data is no longer required to fulfil the purposes for which it was collected (usually after 10 to 30 days).

For these purposes, we use the services of Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland on our website.

• Google Analytics
• Google Tag Manager
• Google reCaptcha

We also use other services from Google Ireland Limited to display content and offer additional functions.

• Google Maps
• Google Tag Manager
• Google Fonts
• YouTube

If you have your own Google account and are logged in to Google in your web browser, it can be assumed that your use of Google Maps and YouTube will be assigned to you via the ukbb.ch website.

Our website also uses cookies, i.e. files that your browser automatically saves on your end device. This allows us to recognise individual visitors, but generally without identifying them. Cookies may also contain information about pages accessed and the duration of the visit. Certain cookies ("session cookies") are deleted when the browser is closed. Others ("persistent cookies") remain stored for a certain period of time so that we can recognise visitors on a subsequent visit.

You can configure your browser settings to block certain cookies or similar technologies, or to delete cookies and other stored data. You can find out more about this in the help pages of your browser (usually under the heading "Data protection").

In principle, our website can also be used without significant functional restrictions without accepting cookies.

For the UKBB, many processes are not possible without processing personal data. It is not always possible to determine this precisely in advance, nor the scope of the data processed, but below you will find details of typical (though not necessarily frequent) cases:

• Initiation, conclusion and processing of contractsWith regard to the conclusion of a contract (e.g. when purchasing hotel services), we may in particular obtain and otherwise process your name, contact details, health data, photos, declarations of consent, powers of attorney, contract contents, creditworthiness data and all other data which you provide to us or which we collect from public sources or third parties (e.g. reference information).

We obtain and process personal data so that we can fulfil our legal and contractual obligations towards patients, authorities, insurers and other contractual partners (e.g. other healthcare providers, referring physicians, suppliers, service providers) and provide and demand the contractual services. This also includes data processing for the care of our customers who are not patients, as well as the enforcement of contracts, accounting and public communication.

• CommunicationWhen you contact us via the contact form, by e-mail, telephone, letter or other means of communication, we collect the data exchanged between you and us, including your contact details and the marginal data of the communication. We may also process information to verify your identity. We use the information you provide voluntarily (e.g. name, e-mail address, telephone number, question) solely to process your enquiry and involve the departments and persons responsible for this internally.

  We would like to point out that communication by e-mail does not take place via a secure or encrypted data connection. This means that your data may be lost during transmission or may be viewed by unauthorised persons. Contacting us by e-mail is therefore at your own risk. We accept no responsibility in this regard and reject any liability claims made in this respect.

• Compliance with legal requirementsWe may disclose data to authorities within the scope of legal obligations or authorisations and in order to comply with internal regulations (e.g. health police obligations, obligations and reporting rights under child and adult protection law, professional obligations in healthcare, reporting rights in the area of road traffic law or narcotics law).
• ResearchIf you have consented to the further use of patient data and samples for research purposes, your personal data may also be processed for research purposes. The data will be used as described on the consent form. Whenever compatible with the research purpose or provided for by law, we anonymise the data so that it can no longer be traced back to you personally or only with disproportionate effort. If anonymisation is not possible or only possible with disproportionate effort, we will pseudonymise your data. The research results will only be published in anonymised form.
• Legal proceedingsIf we are involved in legal proceedings (e.g. court or administrative proceedings), we process data, e.g. about parties to the proceedings and other persons involved, such as witnesses or persons providing information, and disclose data to such parties, courts and authorities, possibly also abroad.
• For contractual partners who The company If you are in contact with us, we process data of the contact persons with whom we are in contact, e.g. name, contact details, professional details and details from communication, and details about managers etc. as part of the general information about companies with which we work.
• TransactionsWhen we sell or acquire receivables, other assets, business units or companies, we process data to the extent necessary for the preparation and execution of such transactions, e.g. information about customers or their contact persons or employees, and also disclose corresponding data to buyers or sellers.
• Other purposesWe process data to the extent required by law and to the extent necessary for other purposes such as IT security, training and education, administration (e.g. contract management, accounting), enforcement of and defence against claims, evaluation and improvement of internal processes, preparation of anonymous statistics and analyses; organisation of events (e.g. specialist events for healthcare or other professionals); acquisition or sale of receivables, businesses, parts of businesses or companies and protection of other legitimate interests.

We process your personal data as long as it is necessary for the purpose of processing (in the case of contracts, generally for the duration of the contractual relationship), as long as we have a legitimate interest in storing it (e.g. to enforce legal claims, for archiving and/or to ensure IT security) and as long as data is subject to a statutory retention and archiving obligation (e.g. a 20-year minimum retention period applies to health data). After these periods have expired, we delete or anonymise your personal data.

You have certain rights under applicable data protection law to obtain further information about our data processing and to influence it:

• You can request information about our data processing. We are at your disposal for this purpose. You can also submit a request for information if you would like further information and a copy of your data;
• You can object to our data processing;
• You can correct or complete incorrect or incomplete personal data or have it supplemented by a note of dispute;
• You can request the blocking of the disclosure of personal data to private individuals (e.g. sending the discharge report to the family doctor; so-called information blocking);
• If we process data on the basis of your consent, you can withdraw your consent at any time. The revocation is only valid for the future, and we reserve the right to continue processing data on another basis in the event of a revocation.

Please note that conditions, exceptions or restrictions apply to these rights in accordance with the applicable data protection law (e.g. to protect third parties or professional and business secrets).

If you wish to exercise such a right, please contact us (see UKBB data protection contact point). As a rule, we will have to verify your identity, e.g. by means of a copy of your ID. You are also free to lodge a complaint against our processing of your data with the competent supervisory authority, which in the canton of Basel-Stadt is the cantonal data protection officer for Basel-Stadt.

We may amend this privacy policy at any time. The version published on this website is the current version.

Under the Cantonal Information and Data Protection Act, public bodies are obliged to keep records of procedures in which personal data is processed (§ 24 IDG and § 16 IDV). The list of procedures involving personal data is published on the UKBB website and can be downloaded here:

If you have any questions about data protection or wish to exercise your rights, please contact the following address:

University Children's Hospital Basel
Data protection
Spitalstrasse 33
CH-4056 Basel

datenschutz@ukbb.ch