Privacy policy

Novira AB (reg. no. 559583-5223), which operates IntygsKlinik
Ellenbogen Läkarhuset, Snapperupsgatan 12, entréplan, 211 35 Malmö
Email: info@intygsklinik.se
Phone: 070-005 00 56

Bookings are made in Meridiq, our booking and patient record system. This also applies when the booking calendar is shown here on the website. What you enter goes straight to Meridiq.

• Data: name, email address, phone number, Swedish personal identity number if you give it (can be verified with BankID), any requests you write, the chosen service, time and payment.
• Why: to handle your booking, send confirmations and reminders, identify you at the visit and take payment.
• Legal basis: contract (your booking) and legal obligation (the Patient Data Act).

The website itself stores no data about you from the booking. For our own statistics we fetch only booking number, service, times and status from Meridiq, never your name or other details about you. Please write only what is needed in the requests field.

At the visit the doctor carries out the examination the certificate requires. What we note is entered in your patient record, which we must keep under the Patient Data Act. Data about your health is processed under GDPR Article 9(2)(h) (healthcare).

• Certificates are sent to the recipient they are meant for when the law or you require it, for example the Swedish Transport Agency (Transportstyrelsen) for driving licence certificates.
• Patient records are kept for at least ten years after the last entry, as required by the Patient Data Act.

When you call, email or write through the contact form, we process the data you give us (for example name, phone number, email and your message) so that we can reply. Legal basis: legitimate interest (answering your question), or contract if your question concerns a booking.

• Messages from the contact form are sent by our web server at Hostinger (the Netherlands) as an email to our mailbox at Strato (Germany). We do not keep them on the web server.
• Do not write your personal identity number or details about your health in the form or in emails. Call us instead.
• Emails and messages are kept for as long as the matter requires, at most 12 months.

• Operation and security: our web host Hostinger (data centre in the Netherlands, backups in Lithuania) records IP address, the page visited, time and browser. This is needed to protect the website and fix problems. The logs are kept for a limited time under Hostinger’s routines and are then deleted automatically. We keep no copies of our own. Legal basis: legitimate interest.
• Statistics and ads: if you choose "Accept all", we use Google Analytics and Google Ads to see how the website is used and which ads lead to bookings. Legal basis: your consent, which you can change at any time. If you choose "Necessary only", Google's tools are not loaded at all and nothing about your visit is sent to Google. We do not use visits to the website for personalised advertising (for example ads that follow you on other websites).
• Map: Google Maps loads only after you choose "Accept all" or click "Show map". Until then a picture of the area is shown and nothing is sent to Google.
• Reviews: on the home page we show some reviews that patients have published themselves on Google, unchanged and with only the first name and the first letter of the last name. If you want us to remove your review from the website, contact us. Legal basis: legitimate interest.

More about cookies and your choice in our cookie policy.

We never sell personal data. Data is shared only with:

• Meridiq: booking and patient record system (data processor).
• Hostinger: hosting of the website (data processor).
• Strato (Germany): our email (data processor).
• Google Ireland Ltd: Analytics, Ads and Maps, only according to your choice above. Google may transfer data to the USA under the EU-US Data Privacy Framework.
• Authorities, when the law requires it, for example the Swedish Transport Agency for driving licence certificates.

You have the right to:

• know what data we process about you and get a copy of it
• have incorrect data corrected
• have data erased or restricted, where the law allows it
• object to processing based on legitimate interest
• receive data you have given us in a common format (data portability)
• withdraw your consent to cookies at any time, via Cookie settings

Patient records cannot be erased on request, because they must be kept under the Patient Data Act. You have the right to read your record. Contact us by email or phone above and we will reply within one month.

If you are not satisfied with how we process your personal data, you can contact the Swedish Authority for Privacy Protection (IMY), imy.se.

We update this policy when we change how we process personal data. The date below shows the latest change.