Privacy & Transparency · Swiss FADP & GDPR
Privacy Policy
1. Data Controller & EU Representative
(a)
This Privacy Policy informs you about how we collect, process, and protect personal data when you visit our website
https://silentsleep.training (including all regional/language versions and order pages), use our web and mobile applications ("Apps"), or interact with our services for Silent Sleep Training®. We process personal data in full compliance with the Swiss Federal Act on Data Protection (revFADP / DSG) and, where applicable, the European General Data Protection Regulation (GDPR). Access and use are subject to Asate's General Terms and Conditions (GTC).(b)
Data Controller:
Asate AG
Schachenstrasse 19, 8633 Wolfhausen, Switzerland
UID:
Email for privacy inquiries: support@silentsleep.training / privacy@asate.com
Asate AG
Schachenstrasse 19, 8633 Wolfhausen, Switzerland
UID:
CHE-113.863.028Email for privacy inquiries: support@silentsleep.training / privacy@asate.com
(c)
Representative in the European Union pursuant to Art. 27 GDPR:
For data subjects located in the European Union / European Economic Area, we have designated the following entity as our EU representative:
Asate Ltd
9 the Business Centre, Fonthill Industrial Park, Fonthill Road, Dublin 22, Ireland
For data subjects located in the European Union / European Economic Area, we have designated the following entity as our EU representative:
Asate Ltd
9 the Business Centre, Fonthill Industrial Park, Fonthill Road, Dublin 22, Ireland
2. Categories of Processed Personal Data
Depending on the services and features you utilize, we process the following categories of data:
- Master, Contract & Order Data: Name, delivery and billing address, email address, phone number, selected training package, order history, hardware serial/activation number, subscription and renewal status.
- Payment & Transaction Data: Payment status, selected payment method, transaction IDs, and settlement records (direct payment instrument processing, such as credit cards, is handled exclusively by certified payment processor Stripe).
- Partner & Referral Attribution (
ref): If you arrive at our Website via a referral link or QR code from a medical professional, sleep lab, pharmacy, or partner (?ref=...), this partner identifier is stored locally in your browser (sst_partner_ref) and passed as a reference (client_reference_id) at checkout to settle partner commissions. Important: Without your separate, explicit consent, no personal health, training, or sleep data is ever transferred back to referring physicians or partners. - Technical Usage & Communication Data: IP address, timestamp, pages visited, browser type, operating system, device information, language settings (
sst_region/sst_preferred_region), consent cookie status (sst_consent_preferences_v2), and correspondence with customer support.
3. Processing of Health, Audio & Training Data in the App (Special Category Data)
Through the use of the Silent Sleep Training® companion App, we process data revealing insights into your personal health condition (Art. 5(c)(2) Swiss FADP / Art. 9(1) GDPR). Processing of these special category data is conducted exclusively based on your explicit consent (Art. 6(7)(a) FADP / Art. 9(2)(a) GDPR), provided during initial account activation and revocable at any time with future effect.
Depending on your active plan and modules used, this encompasses:
(a)
Real-Time Acoustic Training & Biofeedback: When connecting the Medical Didgeridoo® via cable and starting a training session or biofeedback game, acoustic signals generated via the sensor/microphone are analyzed in real time to calculate live visual feedback and store metrics (duration, frequency stability, gaming scores) in your private profile. Audio capture occurs only while an active session is running.
(b)
Nocturnal Snore Tracking & Trend Analysis: When you activate the overnight tracking module, the app processes ambient sound via your device microphone to recognize snore events and prepare trends (intensity, duration, patterns). Recording only occurs while the tracking toggle is active.
(c)
Conversational Personal AI Coach & Guidance: When interacting with the AI coach via voice or text, your inputs and relevant progress metrics are processed to provide personalized training feedback and reminders. Your personal health and audio data are never used to train public third-party foundational AI models.
(d)
Webinars & Multiplayer: Connection metadata and your chosen screen name are processed during live interactive group sessions.
(e)
Strict Separation Between App Operation & Research: App service delivery is strictly segregated from scientific research and algorithmic development. Any secondary use for medical research occurs solely upon separate, voluntary opt-in consent.
(f)
Protection of Minors: Users under the age of 16 require parental or legal guardian consent to use our services.
4. Purposes and Legal Bases for Processing
We process personal data based on the following legal grounds (Art. 6 and 31 Swiss FADP / Art. 6(1) and 9(2) GDPR):
- Contract Performance (Art. 6(1)(b) GDPR): Order fulfillment, shipment of hardware, app account management, renewals, customer support.
- Explicit Consent (Art. 6(7)(a) FADP / Art. 6(1)(a) & 9(2)(a) GDPR): Processing of health, audio, and training metrics in the app, as well as voluntary analytics/marketing cookies on the website.
- Legitimate Interests (Art. 6(1)(f) GDPR): IT infrastructure security, fraud prevention, partner commission accounting (
ref), legal defense. - Legal Obligations (Art. 6(1)(c) GDPR): Compliance with statutory commercial, tax, and medical device vigilance retention periods.
5. Service Providers (Processors) and Third-Party Disclosures
We do not sell personal data. Disclosures are limited to vetted processors under strict data processing agreements:
- Cloud Infrastructure & Backend (Google Cloud / Firebase): Hosted securely within Google Cloud Platform / Firebase (Google Ireland Limited / Google LLC) with primary storage in the European Union (e.g.,
europe-west4, Netherlands). - Payment Processing (Stripe): Payments and subscriptions (
order.silentsleep.training) are handled securely via Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.). See https://stripe.com/privacy. - Shipping & Logistics: Name, delivery address, and tracking contacts are shared with logistics providers (e.g., Swiss Post, DHL) to fulfill device shipments.
- AI & Teleconferencing Providers: Specialized processors are utilized for voice synthesis, AI assistance, and interactive webinars.
6. International Data Transfers
Data processing takes place primarily in Switzerland and the European Economic Area (EEA). When global IT providers transfer data to third countries (such as the United States), adequate safeguards are guaranteed via:
- Certification under the Swiss-U.S. Data Privacy Framework (DPF) and EU-U.S. Data Privacy Framework (Swiss Federal Council & European Commission adequacy decisions), and/or
- Execution of approved Standard Contractual Clauses (SCC) including Swiss addenda required by the Federal Data Protection and Information Commissioner (FDPIC / EDÖB).
7. Cookies, Local Storage & Consent Management (Google Consent Mode v2)
(a)
Essential Storage: We use strictly necessary cookies and local storage items (
localStorage) to enable core functions:sst_consent_preferences_v2: Stores cookie preferences (Necessary, Analytics, Marketing).sst_preferred_region/sst_region: Retains country and language selection.sst_partner_ref: Retains referral ID (?ref=) for checkout attribution.
(b)
Consent Banner & Google Consent Mode v2: All non-essential categories are denied by default. Without consent, no tracking cookies are set; only cookieless status signals (cookieless pings) are transmitted. Preferences can be altered at any time via "Cookie Settings" in the footer.
8. Web Analytics & Marketing Technologies (Consent-Only)
Subject to prior consent in the cookie banner, we may employ:
(a)
Google Analytics 4 (GA4): Analyzes aggregated website navigation and conversion funnels with IP anonymization active.
(b)
Google Ads Conversion Tracking: Measures ad campaign efficacy and orders.
(c)
Meta Pixel / Conversions API: Measures social campaign efficacy under Joint Controller terms.
(d)
Health Data Protection in Marketing: We never upload customer lists of medical device purchasers to third-party ad networks for Custom Audiences / Customer Match targeting.
9. Data Retention and Deletion
Personal data is retained only as long as necessary for the purpose or as required by statutory retention obligations (including the Swiss 10-year commercial book-keeping requirement under Art. 958f CO). App health metrics are permanently deleted upon user request or account closure.
10. Data Security
We implement state-of-the-art technical and organizational measures (including TLS encryption, role-based access control, and routine audits) to protect your personal information against unauthorized access, loss, or manipulation.
11. Your Rights as a Data Subject & Supervisory Authorities
(a)
Under applicable privacy laws, you possess the right to:
- Access your personal data (Art. 25 FADP / Art. 15 GDPR),
- Rectification of inaccurate data (Art. 32 FADP / Art. 16 GDPR),
- Erasure of your records (Art. 32 FADP / Art. 17 GDPR),
- Restriction of processing (Art. 18 GDPR),
- Data Portability in a standard machine-readable format (Art. 28 FADP / Art. 20 GDPR),
- Object to data processing and withdraw consent at any time.
(b)
Right to Lodge a Complaint:
You have the right to lodge a complaint with a competent supervisory authority:
You have the right to lodge a complaint with a competent supervisory authority:
- In Switzerland: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, Switzerland (https://www.edoeb.admin.ch).
- In the EU: The data protection supervisory authority in your member state of residence.