Swiss data protection for scheduling

Online scheduling stores names, emails, phone numbers, and sometimes health or legal context in booking notes. That is personal data under Swiss nDSG and, where applicable, GDPR.

You remain responsible to clients; your vendor is a processor. Choose tools that make that relationship documentable.

The revised Swiss Federal Act on Data Protection (nDSG) requires transparency, purpose limitation, and appropriate security. Cross-border disclosure needs a legal basis clients can understand.

US-hosted SaaS often relies on Standard Contractual Clauses—acceptable for some firms, a blocker for others.

If EU residents book appointments, GDPR may apply alongside nDSG. EU hosting simplifies the story for many Swiss exporters and dual-border practices.

Document subprocessors (email, video, payments) in your privacy notice.

Typical data: account profile, calendar tokens, event types, booking metadata, client contact fields, and integration logs. Minimise custom questions on public booking pages.

Retention: define how long you keep no-show records and when you delete client details.

Zitli runs on EU infrastructure with encryption in transit and at rest. You can state hosting region in your own privacy policy without qualifying US defaults.

Self-hosted open source shifts liability to your IT team—factor ops into procurement.

Clients may request access, correction, or deletion. Your scheduling tool should export or delete bookings on request.

Pair technical controls with staff training—reception should not copy booking notes into unsecured channels.