Privacy Policy

This Privacy Policy explains how BioQuant IQ GmbH (“BioQuant IQ”, “we”, “us”) processes personal data in connection with the Echo website and product. We are committed to processing personal data lawfully, fairly and transparently under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

1. Who we are — and when we act as controller or processor

The data controller is BioQuant IQ GmbH, Baselmattweg 135, 4123 Allschwil, Switzerland. For any privacy question or to exercise your rights, contact letustalk@bioquantiq.ch.

Roles depend on the processing context. For this website — visits, your analytics choice, and demo requests — BioQuant IQ GmbH is the data controller. For the Echo product deployed inside a client organisation, the client is the controller (and, under the EU AI Act, the deployer) and BioQuant IQ GmbH processes personal data as its processor under a Data Processing Agreement — the role split is set out in our DPIA summary.

2. What we collect

• Contact & demo requests — work email, name, company, role, LinkedIn and the skills you tell us you want to work on.
• Product data (Echo) — role and company context you provide, your responses within scenarios, the resulting competency scores, feedback and progress history.
• Technical & usage data — with consent, analytics about how you use the site (see our Cookie Policy).

3. Why we process it, and our legal bases

• To respond to demo and contact requests — legitimate interest / steps prior to a contract.
• To provide and improve the Echo product to our customers — performance of a contract with the customer organisation.
• To run analytics and improve the site — consent (which you can withdraw at any time).

Model training. We do not use customer scenario data or personal responses to train general-purpose or third-party AI models. We confirm this on request.

4. Echo scores — what we measure, visibility, and how outputs may be used

Echo is deployed by an organisation. Access to an individual’s scores is role-based — typically the individual, their manager or coach, and authorised HR administrators, as configured by the customer. Measurement stays invisible during the experience itself.

What we measure. Echo scores the decisions and behaviours a person makes inside a scenario — not personality, identity, or protected characteristics. Progress is measured you-versus-you, against a person’s own baseline, not ranked against colleagues.

Default use — development. By default, Echo is a development tool: scores help a person and their organisation see capability grow over time. Organisations configure visibility, retention and reporting before any scenario runs.

Client-enabled people decisions. Where a client organisation chooses to enable it, Echo’s outputs may also inform people decisions — such as hiring, promotion or readiness — as one input to a decision made by a person. This is selected by the client organisation, not by the individual; the client sets the purpose and, where the law requires, informs affected individuals and their representatives.

Human oversight — never solely automated. Consistent with Article 22 GDPR and the EU AI Act’s requirements for AI used in employment contexts, no decision producing legal or similarly significant effects — hiring, promotion, readiness, termination or selection — is ever based solely on automated processing. A qualified person with the authority to reach a different outcome always makes the final call. The individual can ask for the logic to be explained, put their point of view, and contest a result and have it reconsidered by a person.

Safeguards. We apply bias and validation checks, keep activity logs, and make a Data Protection Impact Assessment (DPIA) and, where relevant, a fundamental-rights impact assessment available to customers. See our DPIA summary.

5. Retention

We keep personal data only as long as necessary for the purposes above or as required by law, then delete or anonymise it. Default retention periods are set out in our customer agreements. As a guide, demo-enquiry data is kept for up to 24 months and product data for the term of the customer agreement, unless a longer period is required by law.

6. Your rights (GDPR / FADP)

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority (in Switzerland, the FDPIC; in the EU, your local authority). To exercise any right, email letustalk@bioquantiq.ch.

7. International transfers

Where personal data is transferred outside Switzerland or the EEA, we rely on recognised safeguards such as adequacy decisions or Standard Contractual Clauses. Echo is hosted within Switzerland and the EEA; a current list of sub-processors is available on request.

8. Sub-processors & where data lives

This website is served through Netlify (global CDN; demo-form submissions are processed by Netlify Forms). Consent-based analytics run on Plausible Analytics, hosted in the EU. For the Echo product, sub-processors (hosting and AI infrastructure) are engaged under data-processing agreements with appropriate transfer safeguards; the current sub-processor list and data-location detail are available on request via letustalk@bioquantiq.ch and will be published on this page once the pending commercial-registry and counsel review completes.

9. Changes

We may update this policy; material changes will be reflected by the “last updated” date above.