Legal
Privacy Policy
Effective date: [Insert publication date]
Details shown in square brackets are placeholders. They will be completed with Alexi's official registered legal information before these documents are finalized.
1. Who We Are
The organization responsible for the processing described in this Policy is:
- Trading name: Alexi
- Data controller: [Full registered legal entity]
- Registered address: [Complete registered postal address], Lugano, Switzerland
- Privacy contact: [Official privacy email]
- EU representative: [Insert contact details if legally required and appointed]
- Data Protection Officer: [Insert details if legally required and appointed]
Alexi is based in Switzerland. The Swiss Federal Act on Data Protection (FADP) applies to our relevant processing activities. The European Union's General Data Protection Regulation (GDPR) also applies where its territorial requirements are met.
2. Scope of This Policy
This Policy covers personal data processed in connection with:
- Visiting the Alexi website.
- Contacting customer support.
- Purchasing or requesting information about products.
- Creating and managing an account, where available.
- Receiving marketing communications, where subscribed.
- Using supported Alexi applications and connected wearable services, where available.
Specific information concerning the processing of health or sensor data will also be presented within the relevant application before such processing begins.
Features that are not yet available do not collect data merely because they are described in this Policy.
3. Information We Collect
The categories of information processed depend on the services you use.
3.1 Contact Information
When you contact us, we may process:
- Your name.
- Email address.
- Information included in your message.
- Relevant correspondence and support history.
3.2 Order and Transaction Information
When you make a purchase, we process information necessary to administer the transaction, including:
- Customer identification and contact details.
- Billing and delivery addresses.
- Products ordered.
- Payment confirmation and transaction references.
- Shipping and order status.
- Relevant refund and warranty information.
Payment-card information is handled according to the arrangements disclosed for our selected payment provider.
3.3 Website and Technical Information
When you use our website, technical information may be processed for hosting, security, and service delivery.
This can include IP addresses, browser and device characteristics, request timestamps, and security logs.
Additional analytics information is processed only as described in this Policy and our Cookie Policy.
3.4 Account Information
If customer accounts are offered, we process the information needed to create, authenticate, maintain, and secure them.
This may include account identifiers, authentication information, preferences, and associated purchase records.
3.5 Wearable Device and Sensor Information
When an Alexi wearable application is available and you choose to activate compatible device features, additional data may be processed.
Depending on the verified capabilities of the device, these categories could include:
- Heart-rate measurements and related trends.
- Sleep measurements and estimated sleep patterns.
- Activity and movement information.
- Temperature-related measurements.
- Blood-oxygen measurements.
- Device identifiers, firmware versions, and battery information.
- User settings and device synchronization information.
The precise categories collected, their purposes, and whether they are stored locally or transmitted externally must be disclosed within the application before collection begins.
We recognize that certain wearable measurements and related inferences may constitute sensitive personal data, including data concerning health.
4. How We Use Personal Information
We process personal information for defined purposes.
We will not use personal information for purposes incompatible with the purposes disclosed when it was collected unless another lawful basis permits the processing and any required additional notice or consent has been provided.
| Purpose | Information involved | GDPR legal basis, where applicable |
|---|---|---|
| Processing purchases and delivering orders | Contact, delivery, and transaction information | Performance of a contract |
| Responding to customer requests | Contact information and correspondence | Contractual necessity or legitimate interests, as applicable |
| Operating and securing the website | Technical and security information | Legitimate interests or legal obligation, as applicable |
| Maintaining financial and statutory records | Order and payment records | Legal obligation |
| Sending optional marketing | Contact information and communication preferences | Consent, or another lawful basis where permitted |
| Optional analytics and advertising tracking | Relevant usage and tracking information | Consent where required |
| Delivering connected-device functionality | Device identifiers and necessary service information | Contractual necessity or another established lawful basis |
| Processing sensitive health data | Applicable physiological measurements and health-related inferences | A valid Article 6 basis and a separate Article 9 condition, such as explicit consent, where required |
5. Health Data and Explicit Consent
Health-related information deserves particular protection.
Where processing involves sensitive health data and relies on consent, we will request the appropriate explicit consent before processing begins.
The consent request will explain:
- Which information is collected.
- Why the information is needed.
- Whether processing occurs locally or in the cloud.
- Whether information is disclosed to third parties.
- How long information is retained.
- How consent can be withdrawn.
- What features may become unavailable if consent is withdrawn.
Consent for health-data processing will not be bundled with optional advertising or analytics consent.
Where a different lawful basis or special-category condition applies, we will identify it clearly.
6. Data Storage and Device Synchronization
The storage architecture used by each Alexi service will be explained in the relevant product or application documentation.
For connected wearables, this includes whether information remains on the device, is stored on a connected phone, or is synchronized with remote infrastructure.
Before launching connected-device services, Alexi will publish the actual storage locations, synchronization behavior, cloud providers, and applicable retention rules.
If an external device manufacturer or software provider receives personal data during pairing or synchronization, its identity and role will be disclosed as required.
7. Sharing Personal Information
Where necessary, personal information may be disclosed to organizations providing services on our behalf, such as:
- Website hosting and infrastructure.
- Payment processing.
- Order fulfillment and delivery.
- Customer support.
- Account authentication.
- Technical maintenance and security.
- Consent-based analytics or marketing services.
- Connected-device infrastructure, where applicable.
We will identify relevant providers and their roles in our published privacy documentation, consistent with applicable law.
Service providers acting on our behalf must be subject to appropriate contractual and security obligations.
We may also disclose personal information where legally required or necessary to establish, exercise, or defend legal claims.
8. International Data Transfers
Because Alexi operates internationally and may use service providers established outside Switzerland or the European Economic Area, personal data may be transferred across borders.
Where an international transfer takes place, we will identify the relevant destination countries or regions and use a legally valid transfer mechanism where required.
Depending on the circumstances, this may include adequacy decisions, approved contractual safeguards, or another applicable legal mechanism.
Information about the applicable safeguards and how to obtain relevant details will be provided on request where required.
9. Data Retention
We retain personal information only for as long as necessary for the relevant purpose or to comply with applicable legal obligations.
The specific retention periods or criteria will be documented for each processing activity.
Where information is no longer required, we will delete it, anonymize it, or otherwise handle it in accordance with applicable law.
Exact retention periods must be established and published before the corresponding processing begins.
| Data category | Retention approach |
|---|---|
| Customer orders and invoices | Applicable accounting, tax, and consumer-law retention requirements |
| Support correspondence | Period necessary to resolve requests and manage legitimate follow-up obligations |
| Account information | During account operation, followed by applicable deletion or retention procedures |
| Security logs | A defined and proportionate security retention period |
| Analytics information | The retention period disclosed for the selected analytics service |
| Wearable health information | The product-specific retention period disclosed before connected health features are enabled |
10. Cookies and Similar Technologies
Our website may use cookies and comparable technologies for essential functionality, security, preferences, and, where enabled, optional analytics or marketing.
Where consent is required, optional technologies will not be activated before consent has been provided.
Visitors can review and change their choices through Cookie Preferences.
Further details are available in our Cookie Policy.
11. Your Privacy Rights
Depending on your location and applicable law, you may have rights to:
- Access your personal data.
- Request correction of inaccurate information.
- Request deletion of personal data.
- Request restriction of processing.
- Object to certain processing activities.
- Receive or transfer eligible personal data.
- Withdraw consent at any time where processing relies on consent.
- Receive information about certain automated decision-making activities.
- Lodge a complaint with a competent data protection authority.
These rights may be subject to applicable legal conditions and exceptions.
To exercise your rights, contact [Privacy contact email].
We may request information reasonably necessary to verify your identity before disclosing or modifying personal data.
Requests will be handled within applicable statutory deadlines.
12. Data Security
We apply technical and organizational safeguards appropriate to the nature and sensitivity of the information being processed.
Relevant measures may include encrypted communications, access controls, authentication safeguards, secure development practices, monitoring, and contractual protections for service providers.
No information system can be guaranteed to be completely free from security risks.
Where a personal data breach occurs, we will assess and fulfill our notification and remediation obligations under applicable law.
13. Children's Privacy
Our products and services are intended for the audiences and minimum ages specified in the relevant product or service documentation.
Where children's personal data may be processed, we will apply the additional safeguards, notices, and consent requirements required by applicable law.
We do not intend to collect children's personal information in circumstances where doing so would be unlawful.
14. Automated Analysis and Personal Insights
Certain connected wearable features may use algorithms to analyze measurements and generate summaries, trends, or personalized insights.
When such features are introduced, we will explain the relevant processing and disclose any automated decision-making or profiling that requires specific information under applicable law.
We will not describe analytical estimates as clinically validated results unless the relevant claims have been substantiated.
15. Third-Party Integrations
Where supported, Alexi applications may allow users to connect services such as Apple Health, Android Health Connect, or other third-party platforms.
These integrations will be optional unless otherwise clearly explained.
The permissions requested, categories of information exchanged, and relevant service providers will be disclosed before activation.
Third-party services may apply their own privacy policies when acting as independent data controllers.
16. Changes to This Policy
We may update this Privacy Policy when our services, processing activities, or legal obligations change.
The latest version will be published on this page with its effective date.
Where material changes require additional notice or consent, we will provide them before implementing the relevant processing.
17. Contact and Complaints
- Alexi
- [Registered legal entity]
- [Registered postal address]
- [Privacy contact email]
You may also contact the competent data protection authority.
For matters under Swiss data protection law, the relevant supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC).
For matters subject to the GDPR, you may contact the competent supervisory authority in the European Union or European Economic Area.