Horten Health Foundation – Privacy Policy

June 2026

Purpose of this Privacy Policy

The Horten Health Foundation ("Foundation", "we", "us" or "our") is committed to protecting the privacy of the individuals with whom we interact and to processing personal data responsibly, transparently and in accordance with applicable data protection legislation.

This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal data in connection with our activities, including our grant-making programmes, scientific review processes, governance activities, contractual relationships and operation of our website.

It also explains the rights available to individuals whose personal data we process.

Controller

Unless otherwise indicated, the data controller responsible for the processing of personal data described in this Privacy Policy is:

Horten Health Foundation
Via Bertaro Lambertenghi 5
CH-6900 Lugano
Switzerland
Email: info@helmut-horten-stiftung.org

If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact us using the details above.

Scope

This Privacy Policy applies to all personal data processed by the Foundation in connection with its activities, including information relating to:

• applicants and grant recipients;
• principal investigators, co-applicants and collaborators;
• scientific reviewers and external experts;
• suppliers, consultants and contractors;
• individuals contacting the Foundation;
• visitors to our website and users of our grant-management platform.

The Foundation processes personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and its implementing Ordinance (OFADP). Where applicable, the Foundation also complies with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

Categories of Personal Data

Depending on the nature of our relationship with you, we may process different categories of personal data.

Applicants and Grant Participants

We may process personal data including:

• name;
• contact details;
• institution and department;
• academic title and position;
• curriculum vitae;
• ORCID or other professional identifiers;
• publication record;
• grant applications and supporting documentation;
• budget information;
• declarations and conflict of interest statements;
• correspondence relating to the application or funded project.

Scientific Reviewers and Experts

We may process:

• name and contact details;
• institution and professional affiliation;
• academic qualifications and expertise;
• curriculum vitae;
• publication record;
• reviewing history;
• conflict of interest declarations;
• communications relating to review assignments;
• review reports and evaluations.

Contractors, Suppliers and Service Providers

We may process:

• contact details;
• professional information;
• contractual information;
• payment details;
• tax, social security or other regulatory information where required by law.

Individuals Contacting the Foundation

When you contact us, we may process:

• your name;
• contact details;
• the content of your correspondence;
• any information you voluntarily provide.

The Foundation only collects personal data that is relevant and necessary for the purposes described in this Privacy Policy.

How We Collect Personal Data

We collect personal data in a variety of ways, including when you:

• submit a grant application;
• create or maintain a profile on our grant-management platform;
• accept an invitation to act as a reviewer or expert;
• communicate with us by email, telephone or other means;
• enter into a contractual relationship with the Foundation;
• participate in meetings or Foundation activities;
• visit our website.

We may also obtain personal data:

• from publicly available professional sources;
• from collaborating institutions;
• from service providers acting on our behalf;
• where otherwise permitted by applicable law.

If you provide personal data relating to another individual, you are responsible for ensuring that you are authorised to do so and, where required, that the individual has been informed accordingly.

Purposes of Processing

The Foundation processes personal data only where necessary to fulfil its statutory mission and operational responsibilities.

Depending on the circumstances, we process personal data for the following purposes.

Grant-making

• administering funding programmes;
• receiving and assessing applications;
• verifying eligibility;
• coordinating scientific peer review;
• making funding decisions;
• monitoring funded projects;
• administering grants and awards.

Scientific Review

• identifying suitable reviewers and experts;
• managing review assignments;
• supporting evaluation processes;
• maintaining the integrity and confidentiality of peer review.

Governance and Administration

• supporting the operational activities;
• maintaining organisational records;
• strategic planning and reporting;
• managing conflicts of interest;
• ensuring accountability and good governance.

Finance and Operations

• administering contracts;
• processing payments and reimbursements;
• accounting and financial reporting;
• auditing and compliance with legal obligations.

Communication

• responding to enquiries;
• communicating with applicants, reviewers and partners;
• providing operational updates;
• maintaining stakeholder relationships.

Security and Compliance

• protecting our systems and infrastructure;
• preventing fraud and misuse;
• investigating incidents;
• complying with applicable legal and regulatory requirements.

Legal Basis for Processing

The Foundation processes personal data only where there is an appropriate legal basis under applicable law.

Depending on the circumstances, processing may be necessary:

• to take steps prior to entering into a contract or to perform a contract;
• to comply with legal or regulatory obligations;
• to pursue the Foundation's legitimate interests, provided these are not overridden by the interests or fundamental rights of the individual concerned;
• because consent has been provided, where consent is required under applicable law.

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Website and Online Services

Visiting our Website

When you visit our website, certain technical information is collected automatically by our web servers to ensure the secure operation of the website and to improve its performance.

This information may include:

• anonymised IP address;
• date and time of access;
• browser type and version;
• operating system;
• device type;
• language settings;
• referring website;
• pages visited;
• files accessed;
• technical information relating to the connection.

This information is generally collected automatically through server log files to:

• ensure the security and stability of our website;
• detect and prevent technical failures or misuse;
• analyse website performance;
• improve the user experience;
• produce aggregated statistical analyses.

Server log files are retained only for as long as reasonably necessary for these purposes.

Cookies

Our website uses cookies and similar technologies to ensure its proper operation and to improve the user experience. Cookies are small text files stored on your device when you visit a website. They allow websites to recognise your browser and remember certain information during or between visits.

We may use the following categories of cookies.

Essential Cookies

These cookies are necessary for the operation and security of the website and cannot be disabled through our systems.

They enable functions such as:

• secure browsing;
• page navigation;
• protection against malicious activity;
• website functionality.

Preference Cookies

These cookies remember user preferences, such as language settings, and improve the user experience during future visits.

Analytics Cookies

Subject to applicable legal requirements, we may use analytics cookies to understand how visitors use our website, including which pages are visited most frequently and how users navigate through the site.

These data are analysed in aggregated form and help us improve the website's content, usability and performance.

You may configure your browser to refuse or delete cookies at any time. Please note that disabling certain cookies may affect the functionality of the website.

Google Analytics

The Foundation uses Google Analytics, a web analytics service provided by Google LLC or Google Ireland Limited, depending on the location from which the service is provided.

Google Analytics uses cookies to collect information about how visitors use the website. The information generated may include:

• anonymised or truncated IP address;
• browser type;
• operating system;
• device information;
• pages visited;
• duration of visits;
• navigation behaviour;
• approximate geographic location.

Where available, IP anonymisation is activated before storage or further processing.

Google processes this information on our behalf to provide aggregated reports on website usage and performance.

Further information regarding Google's processing of personal data is available in Google's Privacy Policy.

Grant Management Platform

The Foundation uses the Optimy grant-management platform to administer grant applications, scientific review processes, funding decisions and grant administration.

Through this platform, personal data may be processed in connection with:

• applicant and reviewer profiles;
• grant applications;
• supporting documentation;
• peer review reports;
• correspondence;
• activity logs;
• authentication and login records.

Optimy acts as a data processor on behalf of the Foundation and processes personal data exclusively in accordance with our documented instructions and applicable contractual obligations relating to confidentiality, information security and data protection.

The Foundation implements appropriate contractual and organisational safeguards to ensure that personal data processed through the platform remain adequately protected.

Disclosure of Personal Data

The Foundation treats personal data confidentially and discloses it only where necessary to fulfil the purposes described in this Privacy Policy or where required by law.

Depending on the circumstances, personal data may be shared with:

• members of the Board of Trustees;
• members of advisory bodies and committees;
• scientific reviewers and external experts;
• external consultants;
• auditors;
• legal advisers;
• banks and payment service providers;
• IT and cloud service providers;
• providers supporting the operation of our grant-management platform;
• regulatory or supervisory authorities;
• courts or other public authorities where disclosure is required by law.

Recipients receive only the personal data necessary for the specific purpose for which the information is shared and are expected to process such data confidentially and in accordance with applicable data protection requirements.

International Transfers of Personal Data

Some of our service providers or professional advisers may process personal data outside Switzerland or the European Economic Area (EEA).

Where personal data are transferred internationally, the Foundation implements appropriate safeguards in accordance with applicable data protection legislation.

Depending on the circumstances, these safeguards may include:

• transfers to countries recognised as providing an adequate level of data protection;
• the use of the Swiss Federal Data Protection and Information Commissioner's recognised contractual safeguards or the European Commission's Standard Contractual Clauses, where applicable;
• other safeguards or legal mechanisms recognised under Swiss or European data protection law.

Where required, we take additional technical and organisational measures to ensure that transferred personal data remain appropriately protected.

Service Providers

The Foundation works with carefully selected external service providers to support its activities.

These providers may process personal data on our behalf in areas including:

• website hosting;
• cloud infrastructure;
• grant management;
• information technology;
• accounting;
• legal and compliance services;
• communications;
• cybersecurity;
• document management.

All service providers are required to process personal data only for the agreed purposes, maintain appropriate confidentiality, implement suitable technical and organisational security measures and comply with applicable data protection legislation.

Links to third-party websites

For third-party websites accessible from this website, as well as for embedded content from external websites (e.g. videos, images or articles), the privacy notices and data protection policies of the respective third-party providers apply, as such content is treated in the same way as if the visitor had accessed the external website directly.

Users' rights

Upon request (at info@helmut-horten-stiftung.org), users have the right to obtain, free of charge and at any time, information about the processing of their personal data.

Further rights, such as the right to deletion or correction of data, restriction of processing, and data portability, may be exercised within the limits of the applicable legal framework.

To ensure that our Privacy Policy remains compliant with the applicable legal requirements at all times, we reserve the right to make changes to it at any time.

Confidentiality

Experts and our collaborators acknowledge that, in the course of carrying out the mandate entrusted to them, they may have access to personal data, confidential information, and documents relating to users or third parties.

Experts and our collaborators undertake to use such data, information, and documents exclusively for purposes connected with the mandate and only to the extent strictly necessary for its performance, in compliance with applicable law.

Experts and our collaborators further undertake not to disclose, communicate, or make such data, information, or documents accessible to third parties, except to the extent necessary for the performance of the mandate.

Jurisdiction and applicable law

This Privacy Policy and agreements that are concluded based on or in connection with this privacy policy are governed by Swiss law unless the law of another state is necessarily applicable. Jurisdiction is at the headquarters of the Foundation unless another jurisdiction is mandatory.