Privacy Policy

01Data controller

HC Operations AB is the data controller for your personal data.

• Organisation number: 559338-3309
• Address: Kungstensgatan 2, 114 25 Stockholm, Sweden
• Email: info@healthclinic.se
• Data Protection Officer: dpo@healthclinic.se

02Categories of data we collect

• Identity and contact data: name, personal identity number (personnummer) or equivalent, address, phone number, email.
• Health data (special category under GDPR Article 9): diagnoses, clinical notes, test results, medication history, imaging and laboratory data, treatment plans.
• Administrative data: appointment bookings, billing details, insurance and embassy coverage information, consent records.
• Technical data: IP address, browser type, device type, and website interaction data collected via cookies (see our Cookie Policy).

03Purpose and legal basis for processing

• Delivery of healthcare — medical assessment, diagnosis, and treatment. Legal basis: legal obligation under the Patient Data Act (2008:355) and the Health and Medical Services Act (2017:30); GDPR Article 9(2)(h) for special category data.
• Patient safety and documentation — maintaining accurate medical records and history. Legal basis: legal obligation.
• Bookings, payments, and membership — managing appointments, processing payments through Klarna, fulfilling membership agreements. Legal basis: performance of a contract (GDPR Article 6(1)(b)).
• Insurance and embassy billing — only where you have expressly authorised us to bill on your behalf. Legal basis: performance of a contract (Article 6(1)(b)) combined with Article 9(2)(h) for health data.
• IT security, fraud prevention, and internal audits — legitimate interests (Article 6(1)(f)).
• Marketing and non-essential website analytics — based on your consent (Article 6(1)(a)), which you may withdraw at any time.

04How we share your data

Your health data is protected by medical confidentiality under Chapter 6 of the Patient Safety Act. We share data only when necessary for your care or required by law, and only under written data processing agreements (GDPR Article 28) where applicable.

• Medical partners: referral clinics, laboratories (for blood tests), and radiology providers.
• Payment providers: Klarna for billing and financing.
• Authorities: IVO, Socialstyrelsen, Skatteverket, or other authorities when legally required.
• Insurers and embassies: only where you have authorised direct billing.
• IT vendors: journal-system and secure cloud-hosting providers, under strict data processing agreements.

05Data retention

• Medical records: retained for a minimum of 10 years after the last entry, as required by Chapter 3 §17 of the Patient Data Act.
• Financial records: retained for 7 years in accordance with the Swedish Accounting Act (Bokföringslagen, 1999:1078).
• Marketing data: retained until you withdraw consent, or for 12 months after your last interaction, whichever is earlier.
• Cookie consent logs: retained for up to 12 months as documentation.

06Data security

We protect your data with technical and organisational measures proportionate to its sensitivity:

• Encryption — data encrypted in transit (TLS) and at rest.
• Access control — only authorised clinical staff involved in your care may access your health records (“inner secrecy”).
• Audit logging — every access to a medical record is logged and reviewed.
• Backups — redundant, encrypted backups in EU/EEA data centres.
• Training — all staff receive regular training on confidentiality, data protection, and information security.

07Your rights

Under the GDPR, you have the following rights:

• Right of access — request a copy of your medical records and personal data.
• Right to rectification — ask us to correct inaccurate administrative data. Medical record corrections follow the specific procedure in the Patient Data Act and may take the form of an annotation rather than a deletion.
• Right to erasure — ask us to delete administrative data. We cannot delete medical records before the statutory 10-year retention period expires; for journal destruction you may apply to IVO.
• Right to restriction — ask us to limit processing in specific circumstances.
• Right to object — object to processing based on legitimate interests, and opt out of marketing at any time.
• Right to data portability — receive your administrative data in a structured, commonly used format.
• Right to withdraw consent — where processing is based on consent (for example cookies or marketing), withdraw it at any time.
• Right to lodge a complaint — with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), at imy.se or imy@imy.se.

08Children and minors

For children and adolescents, parental or guardian consent is assessed individually based on age, maturity, and the nature of the care. In Sweden, the age for independent digital consent to non-healthcare services is 13. For healthcare decisions, Swedish law and clinical judgement apply.

09International transfers

We prioritise keeping your data within the EU/EEA. If data must be transferred outside the EEA (for example, a specific international specialist consultation at your request), we ensure appropriate safeguards are in place — typically the European Commission’s Standard Contractual Clauses (SCCs), supplementary measures where needed, or an adequacy decision.

10Changes to this policy

We may update this Privacy Policy to reflect legal, technical, or operational changes. The current version is always available on our website. Material changes will be communicated to active patients by email or through our booking platform.