Schweiz · Suisse · Svizzera · PsyG · StGB Art. 321 · Anordnungsmodell · revDSG
A psychologist holds a federal postgraduate title, recorded in PsyReg. A canton issues the Berufsausübungsbewilligung, and that is what permits practice — there, and sometimes only until a date. A directory that keeps one credential per person will publish somebody who may use the name and may not see a client.
This page sets out the Swiss layer, what is built and running in
ondelights_ch, and what we have not built. The last part is short, specific and
names three things we do not intend to build at all.
Switzerland is not in the EU, so the GDPR does not apply of its own force — but the revised Federal Act on Data Protection (revDSG, in force since September 2023) is built to the same shape, and a practice with clients in the EU is inside the GDPR anyway. Everything on the GDPR page is the right starting point; read it first.
On top of that sit three Swiss things the core cannot express. One is federal and one is cantonal and they are often confused. One is criminal law, and it reaches past the practice to the people who host its data. The fourth thing on this page — insured billing — is a market question rather than a legal one, and we are deliberately half in it.
The Psychology Professions Act confers a postgraduate title and records it in PsyReg. A canton issues the practice permit. Both live in the same PsyReg entry, and a person may hold the first without the second.
Why it matters: publishing a protected title needs both checked, not one. Section 02.
Since 1 July 2022 a psychologist bills basic insurance on a doctor's order. Beyond thirty the insurer must approve the next block.
Why it matters: a practice that loses count delivers a session nobody will pay for and finds out weeks later. Section 03.
The Criminal Code binds the practitioner and their Hilfspersonen — and staff of a provider whose systems can show them plaintext patient data are auxiliary persons, carrying the same criminal duty.
Why it matters: it is the reading that decides how a Swiss practice may buy software at all. Section 04.
A canton corresponds, tenders and expects a product in its own official language. Six cantons lead in French, one in Italian, the rest in German.
Why it matters: the language a practitioner's authorities write in is a field on the practitioner, not a setting. Section 06.
Health is cantonal. That single fact is the shape of the Swiss market: twenty-six regulators, twenty-six licence regimes, twenty-six sets of tariff point values, and a practitioner who may be licensed in one canton and not the next. A product that models “Switzerland” as one country gets the first question in the first meeting wrong.
Norway's refusal has one condition: a checked HPR number. Switzerland's needs two, and checking only the first would ship exactly the bug the module exists to prevent.
A practitioner holds one practice permit per canton, each with its own issuing authority, its own reference and its own expiry. Somebody licensed in Zürich and Vaud has two records, and losing one of them is a real event.
A profile using a protected title is refused publication without both a checked PsyReg number and a current, checked cantonal licence — and the refusal says which of the two is missing rather than failing vaguely.
Where the title is verified and the licence is not, the public status says that. An unverified market is not served by a listing that reads like a verified one, and the temptation to round up is the whole reason the field exists.
Same rule as Finland and Norway. A number in a box is a claim. It becomes a check when a person records that they looked it up, or a register lookup does it for them — and the check runs on write, so a sync cannot get round it.
Fifteen sessions on a doctor's order. One renewal without going back to the insurer, so thirty in all. Past that, the insurer approves the next block or nobody pays for it. That is a counter, a threshold and an expiry per client — which a calendar cannot do and a spreadsheet does badly.
A renewal points at the order before it, and the count runs the whole chain. Counting only the order in front of you is how a practice arrives at session thirty-one believing it is at session one.
The warning comes before the session that would not be paid for, while there is still time to ask the doctor or the insurer. A refusal that arrives after the session has been delivered is a bill, not a control.
A booked session does not. Counting it would stop an order two sessions early, and a practice that loses two paid sessions to its own software stops trusting the counter and goes back to the spreadsheet.
At the second renewal the module refuses without a recorded insurer approval. That is the one place it stops rather than warns, because past that point the money is simply not coming.
Art. 321 of the Criminal Code binds the psychologist and their auxiliary persons to the same criminal duty of secrecy. A receptionist, obviously. A locum, obviously. And the staff of a hosting provider whose systems can show them plaintext patient data.
Employee of the practice, locum or freelance clinician, IT support with access to systems, hosting or cloud provider whose staff can read plaintext, and other processors — billing, transcription, archiving.
reads_plaintextA practice that ticks it for its hosting provider has just written down, in its own words and on its own record, why encryption the operator cannot read is worth paying for. Nothing else on this page argues the product as well as that tick does.
Not a statutory period — a review interval, so that a list written once does not quietly become a list of people who have left. The module reports the ones that are overdue.
It records a decision somebody made, with who made it and when. The judgement about whether a disclosure was indispensable and foreseeable is a lawyer's, and the register exists so that conversation has a document to start from.
A tariff edition, positions in taxation points, point values per canton and insurer class, and a draft line per delivered session. What is deliberately absent is the TARDOC catalogue itself.
Tariff positions and cantonal point values are licensed reference data. We do not ship them, and we will not invent them, because a plausible invented code is one somebody bills on.
It names the canton that has no point value loaded. It never prints a franc figure, because zero francs would mean the session costs nothing, and that is a different statement from “we cannot price this”.
No state in this module pretends to. The line is a draft for the practice's own billing system, and whether to compete with a Swiss practice-management incumbent on insured billing at all is a commercial decision rather than a coding one.
The same rule as everywhere else in the platform: what applied is written onto the session when it happens, so changing a setting tomorrow never reaches back into a period somebody has already reported on.
Norway needed a new retention kind because “keep while needed” has no clock. Switzerland does not, and adding one would have been a second way of saying something the engine already says.
Ten years after the last contact is the common Swiss floor, and the document service already had years after last contact. A rule is seeded, scoped to Switzerland, and that is the whole of it.
The cantons a practitioner is licensed in decide which language their authorities correspond in. Six lead in French, Ticino in Italian, the rest in German — and a bilingual canton still has a leading language.
German, French and Italian throughout the interface, in the words the authorities use. A Hilfsperson rather than an “auxiliary person”. A translated term that nobody in the canton would write is a term nobody can search for.
Swiss German usage, Swiss legal references and the ß that Switzerland does not use mean the German edition cannot simply be pointed at Switzerland. It is tracked as its own piece of work rather than quietly assumed.
Three of these we do not intend to build, and say so rather than leaving them to be discovered. None of them is a data-protection gap.
The structure of insured billing is here; the positions and cantonal point values are licensed data a deployment loads. We will not ship an invented catalogue, and a demo that showed one would be found out in the first meeting.
Swiss healthcare's secure-communication and identity layer needs credentials and an interface this deployment does not have. A practice that requires HIN today should not be sold this platform as if it did.
The EPDG total revision will oblige the whole outpatient sector to connect, but the bill is in Parliament and operation is expected around 2030. Building to a moving standard is how a module becomes a liability.
The module speaks its own terms in all three languages. The product around it does not yet have Swiss editions — that is localisation work, not a module, and it is tracked separately.
The Swiss rules in the module were read from published summaries in September 2026, not from the Systematic Compilation, and the module says so in its own source. Confirm each rule before relying on it in a bid.
The same boundary as every other country page, with the Swiss names on it.
Whether a disclosure to an auxiliary person was indispensable and foreseeable, whether a licence still covers the work being done, whether an order should be renewed. The software records who decided, when and why. It does not decide.
Self-hosted means the practice or its hosting partner owns the servers, the backups and the restore test. We will not describe your backups as ours — and under Art. 321 the question of who can read them is yours to answer.
Encryption, the access decision, the log nobody can edit, the two-condition refusal, the counter that runs the chain, and the registers behind all of it.
Section 07 is the part of this page to read twice. Three of the four are things we do not intend to build, and a supplier who says that early is easier to plan around than one who discovers it with you.
This page was written from the module's own source and from published summaries of Swiss law, not settled with Swiss counsel. Confirm each rule before relying on it, and treat the article and act references as a starting point for that conversation rather than as its conclusion.