Privacy
Policy
1. Data Controller and Legal Basis for Processing
This Privacy Policy applies when Sand Clinic (“Sand Clinic”, “we”, “our”, “us”), registration number 559207-1590, Hagaesplanaden 49, 113 68 Stockholm, processes personal data relating to individuals who use Sand Clinic’s services and member portal (“you”, “your”). Sand Clinic’s processing of personal data complies with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
Processing of personal data in connection with the use of Sand Clinic’s services is based on an agreement between you and Sand Clinic, to fulfil legal obligations under law and regulatory decisions, and, in some cases, on your consent. Processing also occurs when using Sand Clinic’s member portal and electronic health record system, HLTHY. Logging in to the portal constitutes active consent (opt-in) to the continued processing of personal and health data in accordance with this policy.
2. Purpose of Processing
Sand Clinic processes your personal data when necessary to perform agreements, provide medical care, and fulfil legal obligations. Personal data is used, among other things, for the administration of healthcare services, bookings and communication, medical recordkeeping and documentation, invoicing and payments, as well as to make medical records available to you through the HLTHY member portal. Processing is also carried out to comply with the obligations set out in the Health and Medical Services Act (2017:30), the Patient Data Act (2008:355), and the Public Access to Information and Secrecy Act (2009:400).
Processing of personal data may also take place for communication, newsletters, or research purposes, in cases where you have given separate consent.
3. Personal Data Processed
Sand Clinic processes identification data (name, personal identity number, gender), contact details (address, telephone, email), payment information, health data (including medical records and test results), as well as IT-related data (e.g., IP address, login data in HLTHY). Within the HLTHY member portal, communication, messages, documents, and other information related to the care process are also handled.
4. Recipients of Personal Data
Sand Clinic may share personal data with other healthcare providers — for example, clinics, primary care centers, laboratories, specialists, and IT system developers — when necessary to perform agreements, fulfil legal obligations, or ensure technical operations. All parties are bound by confidentiality and data processing agreements.
5. Retention and Deletion of Personal Data
Personal data is retained only as long as necessary to fulfil its purpose or to meet statutory requirements. Medical records are kept for ten (10) years after the last entry in accordance with the Patient Data Act. Accounting information is retained for seven (7) years in accordance with the Bookkeeping Act (1999:1078). When data no longer needs to be stored, it is deleted or anonymized.
6. Information Security
Sand Clinic implements appropriate technical and organizational measures to protect personal data in accordance with the GDPR. All communication via the HLTHY member portal is encrypted and follows current security standards for handling sensitive personal data within healthcare. Login requires strong authentication. In the event of a personal data breach, affected individuals are notified in accordance with Article 34 of the GDPR.
7. Your Rights
You have the right to withdraw your consent at any time, request access to, correction, or deletion of your personal data, and object to processing. Withdrawal of consent can be made via the HLTHY member portal or by contacting Sand Clinic (medlem@sandclinic.se). Withdrawal does not affect the legality of processing that has already taken place. You always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
8. Contact
For questions about personal data management, access requests, or deletion, please contact:
Email: info@sandclinic.se
Address: Sand Clinic, Hagaesplanaden 49, 113 68 Stockholm