Privacy Policy
Version 2 — effective 9 October 2026. This policy covers the website attune-session.com and our services for customers of Attune-Session. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR. A German version is available (Datenschutzerklärung); in case of discrepancy, the German version prevails.
1. Controller
Wombel GmbH
Route du Grand Pre 18, 1700 Fribourg, Switzerland
Email: info@attune-session.com
2. Recordings stay on the device
Session recordings, transcripts, subtitles and the names of case files are stored and processed on the Attune-Session device in the practice. Speech recognition, speaker labelling, translation and summaries run locally; no recording is sent to a cloud service for processing. For this data the practice is the controller. We have access to the device only as the practice's processor, for maintenance and support (see section 5).
If you were recorded by a therapist, please contact the therapist or practice directly about your data.
3. Data we process
Website visitors: technical data such as IP address, time, page requested and browser information, processed by Cloudflare to deliver and protect the website. This website sets no cookies and uses no analytics or tracking.
Contact: what you write to us by email, with your email address and name.
Customers:
- practice name, address, contact persons and billing details;
- therapist accounts on the device: username, name, email address for remote sign-in, roles;
- license records: expiry dates, renewal dates, and a one-way hash of each license code used;
- payment data: invoices and, for online payment, the payment provider's customer and transaction IDs. We do not store card data.
On the device, for operation and maintenance:
- an activity log of who used the device and how: username, time, access path (cable or remote), sign-ins and changes made;
- system and error logs, and the processing queue.
Remote access: when a therapist uses the device from outside the practice, Cloudflare processes their email address (to send the sign-in code), IP address and the encrypted connection data.
4. Purposes and legal bases
- Contract performance: delivering, operating, maintaining and licensing the Service, invoicing, support.
- Legitimate interests: security of the device and website, fraud prevention, improving the Service, informing existing customers about updates and offers (you can object at any time).
- Legal obligations: accounting and retention duties.
We do not sell personal data.
5. Maintenance access
We can maintain the device and activate updates over a secured remote connection. For this purpose we have technical access to the device. Where data is encrypted, we have no access to the stored data. In every case we use this access exclusively for maintenance, troubleshooting and support, and only on the Customer's explicit instruction. Raw camera and microphone files are deleted automatically after a retention period the practice can set (default 14 days).
6. Third-party processors
| Processor | Purpose | Location |
|---|---|---|
| Cloudflare | Website hosting, DNS, email forwarding, remote access and sign-in to the device | EU/US |
| Google (Gmail) | Our email inbox | EU/US |
| Stripe | Online payment, once offered | US |
Transfers outside Switzerland and the EU are made under the Swiss-U.S./EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
Remote connections are encrypted between the browser and Cloudflare and between Cloudflare and the device; like any such network service, Cloudflare decrypts the traffic at its servers in order to forward it.
7. Retention
- Email correspondence: as long as needed for the request, at most 2 years after the last contact unless part of a contract.
- Customer, license and payment records: for the duration of the contract and 10 years afterwards, as required by Swiss accounting law.
- Therapist accounts: until the account is deleted. License records are kept after an account is deleted, so a renewed account keeps its license history.
- Activity and system logs on the device: for a limited period in the system log.
- Recordings on the device: raw files until the retention period ends; finished videos and subtitles until the therapist deletes them, or until the device's data is deleted at the end of the contract.
8. Your rights
Under the FADP and the GDPR you can request access to your data, its correction or deletion, restriction of processing, data portability, and object to processing; where processing is based on consent, you can withdraw it at any time. Write to info@attune-session.com. We respond within 30 days.
9. Cookies
This website sets no cookies. The device's dashboard and editor use only cookies needed to work: a login session cookie, Cloudflare's sign-in cookie for remote access, and a cookie that remembers that a license reminder was already shown today.
10. Security
- All connections to the device and this website are encrypted (HTTPS/TLS).
- Each therapist has a personal account and sees only their own recordings.
- Remote access only through a personal sign-in; the device is not openly reachable from the internet.
- The cameras are on a separate network connected directly to the device.
No system is completely secure. If a breach affects your personal data, we inform you and the authorities as required by law.
11. Changes
We may update this policy. Material changes will be communicated to customers by email at least 14 days in advance.
12. Supervisory authority
You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. EU residents can also contact their local data protection authority.
13. Contact
Wombel GmbH, info@attune-session.com