Data protection, medical confidentiality and law in corporate health management

The short answer for employees

You alone decide whether to take part in a screening. If you do take part, the results belong to you. You receive them, and nobody else in your company does.

• Who sees my results? The professional who examines you, and you. Not your employer, not your line managers, not the HR department.
• Will anyone know I was there? No. We do not release attendance lists. That is also why someone who does not take part does not stand out.
• What happens to my data afterwards? Participant data is deleted after the measure. Medical data is protected by medical confidentiality.
• Can I withdraw? At any time, without giving a reason and without any disadvantage, and your data will be deleted too.
• Will it cost me anything? No. It is not billed through your health insurance, so there is neither a deductible nor a co-payment.

Chapter 3 onwards explains why this is not just a promise but the legal position.

The short answer for employers

As an employer, you buy a service for your employees, not information about them. This is not a concession but the only lawful structure.

What you receive

• an aggregated, anonymised analysis of the measure,
• an invoice based on aggregated quantities, not on names,
• documents with which you can show internally that the measure has been set up in compliance with data protection.

What you never receive

• individual results, not even with the consent of the person concerned,
• attendance lists, appointment schedules or no-show reports,
• analyses cut so small that individuals can be identified.

What you need to observe yourself

• Do not ask for results. Art. 328b CO does not permit you to process such data, and consent does not cure that.
• Do not put pressure on people to take part, and do not attach benefits to participation. Both undermine voluntariness (Art. 6 para. 6 FADP).
• Consult employee representatives early (Art. 10 let. a of the Participation Act (MitwG), Art. 6 EmpO 3).

Art. 328b CO: the limit that even consent cannot move

This is the most important provision on this page, and it is missing from almost every corporate health management page in Switzerland. Art. 328b CO limits which data an employer may process about its employees at all: only data that 'concern their suitability for the employment relationship or are necessary for the performance of the employment contract'. In all other respects, the Federal Act on Data Protection applies.

A cholesterol value, a bowel cancer screening result, a suspicious skin mark, a stress index or a pharmacogenetic profile meets neither test for an ordinary job. The employer therefore may not hold such data in the first place.

The relationship with the Data Protection Act is cumulative: Art. 328b is the employment-law specification of proportionality and purpose limitation, and the FADP applies 'in all other respects'. Art. 328b acts as a limit, not as an enabling provision that would allow the employer more.

One point should be stated plainly: legal scholarship is not entirely unanimous on whether consent can extend Art. 328b in situations that are solely in the employees' interest. The prevailing view, and the one taken by the FDPIC, is the restrictive one. We follow it.

Art. 328 CO also applies: the employer must respect the personality rights of its employees and have due regard for their health, taking the measures that are 'necessary according to experience, applicable according to the state of the art and appropriate to the conditions of the business'. This is the employer's duty of care under civil law, and it is the honest argument for workplace health promotion. It is not an obligation to offer screenings.

Medical confidentiality: Art. 321 SCC

Medical confidentiality is not a rule of professional etiquette but criminal law. Art. 321 no. 1 SCC threatens disclosure of a professional secret with a custodial sentence of up to three years or a monetary penalty. Liability continues 'even after the end of professional practice or studies'. It is an offence prosecuted on complaint: prosecution requires a complaint from the person concerned.

Important and little known: the list of professions was extended by the Health Professions Act on 1 February 2020. Since then, nurses, physiotherapists, occupational therapists, dietitians and optometrists, among others, have been expressly covered. For a provider with eye screening and nutrition coaching, this is directly relevant.

This gives us a design rule for running a screening station: every measurement must be assigned to a named professional who is responsible under Art. 321, so that supporting staff genuinely count as auxiliary persons. Everyone else involved needs a written confidentiality agreement that survives the end of the engagement. Art. 62 FADP also makes breach of professional confidentiality a criminal offence under data protection law.

Revised FADP: health data is sensitive personal data

The revised Federal Act on Data Protection (FADP) has applied since 1 September 2023. Its ordinance has been called the DPO ever since, no longer the VDSG; anyone still writing 'VDSG' in 2026 is working from outdated material.

Health data and genetic data

Art. 5 let. c FADP lists six categories of sensitive personal data. Two of them bear directly on a health programme: 'data on health' and 'genetic data'. All screening results fall into the first category, and all pharmacogenetic and epigenetic analyses into the second.

Principles and consent

Art. 6 FADP requires lawfulness, good faith, proportionality, purpose limitation, transparency and accuracy. Under Art. 6 para. 4 FADP, personal data must be destroyed or anonymised as soon as they are no longer needed for the purpose of processing. Under Art. 6 para. 6 FADP, consent is valid only if it is given freely, for one or more specific processing operations, after the person has been properly informed; under Art. 6 para. 7 FADP, consent to the processing of sensitive personal data must be explicit. A blanket clause included in the employment contract does not meet that standard.

The legal core

Organisational duties that follow

• Record of processing activities under Art. 12 FADP. The SME exemption in Art. 24 DPO expressly does not apply where sensitive personal data are processed on a large scale. A provider that runs screenings across several client companies must therefore keep the record, whatever its headcount.
• Data protection impact assessment under Art. 22 FADP: required where processing may entail a high risk, which Art. 22 para. 2 let. a FADP assumes for large-scale processing of sensitive personal data. If a high residual risk remains, Art. 23 FADP requires consulting the FDPIC or, alternatively, the organisation's own data protection adviser.
• Processing regulations and logging under Art. 5 DPO and Art. 4 DPO, triggered by the same thresholds.
• Duty to inform under Art. 19 to 21 FADP, in a precise, transparent, comprehensible and easily accessible form (Art. 13 DPO).
• Data security and privacy by design under Art. 7 and Art. 8 FADP, specified in Art. 1 to 4 DPO.
• Notification of data security breaches under Art. 24 FADP and Art. 15 DPO.

Art. 60 to 64 FADP make certain violations a criminal offence. In practice two points matter more than the size of the fine: the penalty targets the responsible individual, not primarily the company, and only intentional conduct is punishable. For the exact wording and the amounts, please consult the current version on fedlex.

No disclosure to third parties: roles, processors, transfers abroad

The third commitment is that data are not passed on to third parties as a matter of principle. Legally, it turns on three questions: who is the controller, who is the processor, and where do the data technically flow?

The question of roles is the most important decision point

For screening results, the examining professional and the provider must be the controllers; the employer must be neither a controller nor a recipient. If the provider were set up as the employer's processor, the employer would become the controller of its employees' health data, which collides head-on with Art. 328b CO.

For genuine processors, such as an analysing laboratory or a hosting provider, Art. 9 FADP applies. Processing may only take place as the controller itself would be permitted to carry it out; no statutory or contractual duty of confidentiality may prevent it; the controller must satisfy itself that the data are secure; and any onward delegation needs prior authorisation (para. 3, supplemented by Art. 7 DPO).

Disclosure abroad

Under Art. 16 FADP, disclosure abroad is permitted only if the Federal Council has recognised the country as providing adequate protection (Annex 1 DPO) or one of the safeguards under Art. 16 para. 2 is in place, such as standard clauses approved by the FDPIC. Art. 17 FADP allows narrowly defined exceptions, including explicit consent. For genetic testing abroad, Art. 29 HGTA additionally requires written consent.

Data storage and hosting

We inform the persons concerned, when their data is collected, which processors we use and to which countries personal data may be disclosed (Art. 19 FADP). On request, you can obtain this information at any time under the right of access (Art. 25 FADP).

Aggregated analyses and the question of minimum group size

The fifth commitment is that reports and statistical analyses do not allow conclusions about individuals. This is where most providers become imprecise, so the uncomfortable truth comes first.

Anyone who names a fixed number is therefore stating their own rule, not a statutory one.

We report figures only for groups large enough that no conclusions can be drawn about individual persons.

Two points that matter more than the number

• Differencing attacks. Anyone who reports 'Department A: 12 people' and 'Department A without team 1: 9 people' has disclosed team 1. Suppression must be consistent across the whole report and across successive reports, otherwise the link to individuals arises through comparison.
• Small businesses. In a company with 15 employees, practically no breakdown is safe. In such cases the output is a single overall figure or no quantitative analysis at all. That is a statement about care, not about capability.

On wording: 'anonymous' does not mean the same as 'the employer receives no individual data'. We therefore say that the employer receives only aggregated, anonymised analyses, and we tell participants that their results belong to them alone.

Withdrawal, deletion and your rights

The first and the sixth commitment concern the same right from two directions: data are deleted when they are no longer needed, and you can withdraw at any time.

• Deletion. Art. 6 para. 4 FADP requires data to be destroyed or anonymised as soon as the purpose of processing has been fulfilled.
• Withdrawal. Consent that cannot be withdrawn without consequences is not voluntary within the meaning of Art. 6 para. 6 FADP. For genetic testing, Art. 5 para. 2 HGTA expressly provides for withdrawal at any time.
• Access. Art. 25 FADP; requests must be answered within 30 days (Art. 18 DPO).
• Data release and data portability. Art. 28 FADP.
• Rectification. Art. 32 FADP.

One qualification: statutory retention duties can override immediate deletion. In genetic testing, for example, the retention period for laboratories was cut from 30 to 5 years by the revision of 1 December 2022 (Art. 11 HGTA and the provisions of the GUMV (SR 810.122.1)). Where such a period applies, the data are deleted once it has expired.

The boundary: occupational medicine and voluntary corporate health management

For HR, this is the most useful section of the page. Occupational health check-ups and voluntary corporate health management screenings look similar from the outside but are legally two different things.

Even where the check-up is mandatory, then, the employer learns only the result 'fit', 'conditionally fit' or 'unfit', never the medical findings. Suva describes this process in its description of the fitness assessment. If the employer receives only a fitness decision even where an examination can be ordered, it follows that nothing individual may be passed on for a voluntary measure.

The duties that actually exist

Art. 6 para. 1 EmpA requires the employer to take all measures to protect health that experience has shown to be necessary, that are applicable given the state of the art and that are appropriate to the conditions of the business, and to protect personal integrity. Art. 2 para. 1 EmpO 3 specifies this as physical and mental health. Art. 3 para. 3 EmpO 3 requires an occupational medical assessment where there are indications that health is being impaired by the work performed. Art. 5 EmpO 3 governs information and instruction, which must take place during working hours and not at the employees' expense.

In occupational safety, Art. 82 AIA requires the necessary measures, and Art. 11a OPA requires occupational physicians and occupational safety specialists to be called in where this is necessary to protect health. EKAS Directive 6508 specifies this duty to call them in. One point matters for classification: under Art. 52a para. 2 OPA, compliance with an EKAS directive creates a presumption that the specified provisions have been met. The directive is therefore not directly applicable law, and an equivalent alternative route remains permissible under para. 3.

And the honest flip side: none of these provisions obliges an employer to offer general preventive check-ups. They require protection against work-related hazards. Voluntary corporate health management goes beyond the statutory minimum. Anyone who claims otherwise is selling compliance anxiety, not giving advice.

What 'voluntary' must mean in law

There is no statutory definition of voluntariness for participation in corporate health management. The standard derives from Art. 6 para. 6 FADP, the FDPIC's position on the subordinate relationship, and Art. 328 and Art. 328b CO. Seven verifiable requirements follow from this.

1. No pressure, whether direct or indirect. No enquiries from line managers about who took part, no framing as an expectation.
2. No disadvantage for not taking part, whether in appraisals, bonuses, shift planning or promotion. Non-participants must not be identifiable as such at all.
3. No participation lists to the employer. Attendance lists, appointment calendars and absence notices are themselves health data in a screening context. Invoicing is based on aggregated quantities.
4. No incentives that amount to coercion in practice. A small, uniform benefit that does not depend on participation is unproblematic. Bonuses, rankings or benefits tied to results turn consent into a purchase.
5. During working hours and at the employer's expense. This reflects the assessment in Art. 5 para. 3 EmpO 3.
6. Revocable at any time, before, during and after the measure, with a clear consequence: deletion.
7. Separate, granular consents for participation, storage, use in the aggregated analysis and any genetic testing. A single blanket consent contradicts the requirement of 'specific' processing in Art. 6 para. 6 FADP.

What the consent declaration must contain

The minimum content follows from Art. 6 and Art. 19 FADP, Art. 5 and 6 HGTA and Art. 321 no. 2 SCC: who the controller is, and explicitly that it is not the employer; the purpose of each individual examination; what is measured and what data this produces, including possible incidental findings; who receives what; any disclosure abroad, with the country and the safeguard; retention period and deletion; an explicit statement that participation is voluntary and that non-participation has no consequences whatsoever; the right to withdraw at any time; the rights under the FADP; a separate consent for genetic testing; and confirmation that no participation list goes to the employer. A general release from professional secrecy must not form part of it.

Genetic data: Art. 37 to 41 HGTA

Genetic testing is subject to its own, stricter regime. The HGTA was completely revised and the new version has been in force since 1 December 2022. The articles were renumbered in the process: the employment-law provisions are now Art. 37 to 41. Documents that still cite 'Art. 21 to 25 HGTA' for the employment relationship are out of date.

For the individuals concerned, the following also applies: genetic testing requires free and explicit consent given after adequate information (Art. 5 para. 1 HGTA), and that consent can be withdrawn at any time (para. 2). Art. 6 HGTA sets out what the information must cover, and Art. 8 HGTA the right not to know. Only a physician or a professional instructed by them may communicate the result (Art. 26 para. 1 HGTA), and the individual decides for themselves what happens to surplus information (Art. 27 para. 1 HGTA).

Pharmacogenetics belongs to the medical field: it assesses the effect of a possible therapy and therefore falls under Art. 19 HGTA. Art. 5 to 7 of the GUMV (SR 810.122.1) govern who may order such tests and make this conditional, among other things, on testing a limited selection of variants and on evidence-based measures being available.

Epigenetic services are not easy to classify legally. Whether a given epigenetic analysis counts as genetic testing within the meaning of the HGTA and, if so, whether it falls into the medical field (Art. 19 HGTA) or the non-medical field of sensitive characteristics (Art. 31 HGTA) cannot be answered across the board, and the consequences are considerable. In the second case, restrictions on ordering apply, together with a licensing requirement for the laboratory (Art. 35 HGTA) and a ban on communicating surplus information (Art. 33 HGTA). Classification must therefore be clarified for each service individually.

Practical consequence for reporting: in our reading, Art. 37 HGTA read together with the penalty provision of Art. 56 HGTA means that genetic results have no place in employer reporting at all, not even in anonymised form.

Involvement of employee representatives

When a company introduces a health programme, employee representatives have a say but no veto. The Participation Act (MitwG, SR 822.14) is titled 'Information and Participation', and that is exactly what it provides: consultation, not co-determination.

• Art. 10 let. a MitwG grants special participation rights on occupational safety within the meaning of Art. 82 AIA and on employee protection within the meaning of Art. 48 EmpA. The reference is to exactly these provisions, not to Art. 6 EmpA.
• The procedure is set out in Art. 6 EmpO 3 and Art. 6a OPA: early and comprehensive consultation, a right to make proposals before the decision, and a duty on the employer to give reasons if it does not follow them.
• Businesses with 50 or more employees can elect an employee representative body (Art. 3 MitwG); where there is none, the employees themselves hold the rights (Art. 4 MitwG).
• Members of the representative body are bound by a duty of confidentiality that expressly covers the personal affairs of individual employees and continues after they leave (Art. 14 MitwG).

In practice, involving the staff committee early is more than a legal duty: it is the best available proof that participation really is voluntary.

The data flow on a screening day

All the previous chapters add up to one picture. This is how data flow on a screening day, and how they do not.

The legal basis of our commitments

This table links the six commitments on our Data security page to the provision from which they follow. The wording of the commitments has been carried over unchanged.

What we do not claim

A page about the law is only as credible as what it refrains from claiming. Four claims that are often made in this market are ones we do not make:

1. No law obliges employers to offer preventive screenings. Art. 6 EmpA, Art. 2 EmpO 3, Art. 82 AIA and EKAS Directive 6508 require protection against work-related hazards. Voluntary corporate health management goes beyond that.
2. Swiss law has no statutory minimum group size for aggregated analyses. Anyone who presents a number as statutory is mistaken. The standard is that of Art. 5 let. a FADP and the FDPIC.
3. Switzerland has no occupational reintegration management as German law defines it. There is no duty to start a structured procedure after a set period of incapacity for work. What does exist is early detection and early intervention by the invalidity insurance (IVA (SR 831.20)), the duty of care under Art. 328 CO, and the occupational medical assessment under Art. 3 para. 3 EmpO 3. Companies with a German parent are regularly surprised by this.
4. We make no statement on whether individual screenings are covered by basic health insurance. Art. 26 HIA covers only what is expressly listed in the HCBO. What is certain is the reverse: a service paid for by the employer is not billed through compulsory health insurance, so neither the deductible nor the co-payment under Art. 64 HIA applies.

Frequently asked questions

• Will my employer receive my result if I consent?–

  No. Under Art. 328b CO, the employer may only process data that concern your suitability for the employment relationship or that are necessary to perform the employment contract. A screening finding is neither. Because Art. 328b is listed in Art. 362 para. 1 CO, any agreement that departs from it to your detriment is void under Art. 362 para. 2 CO. Your consent therefore cannot shift the boundary.

• Will my employer find out whether I took part at all?+

• What happens to my data after the measure?+

• Is my health insurer informed, and do I pay a deductible?+

• What exactly does my employer see in the reporting?+

• Does the staff committee have to agree?+

• Does anything different apply to genetic testing?+

• Where are the data stored?+

Legal sources

All legislation is cited in the consolidated version on fedlex.admin.ch, the Confederation's official publication platform. This page was last reviewed in September 2026.

Further official sources

• FDPIC, Data processing by the employer
• FDPIC, Health
• Suva, Fitness assessment in occupational health check-ups
• EKAS, Directive 6508 (ASA Directive), as at 23 October 2025
• FOPH, Professional or medical confidentiality

Disclaimer

This page explains current Swiss law and is not legal advice. It does not replace an assessment of the individual case and does not create a mandate. All statements reflect the position as at September 2026; the wording of the current version on fedlex.admin.ch always prevails. This page makes no statements on medical content or on the benefit of individual examinations.