viktbehandling.se

Viktbehandling.se

Privacy policy

This policy explains how ViSaeb Medical Group AB processes your personal data under the GDPR and the Swedish Patient Data Act (PDL). The Swedish version at viktbehandling.se/integritet is the reference text.

Last updated: 2026-10-24

Data controller

ViSaeb Medical Group AB, company registration no. 559607-3741, operates viktbehandling.se, a service providing structured medical weight-loss treatment with bookings, intake, assessment and follow-up. We are the data controller for the information you give us in your request, the preliminary check, payment and your patient pages. Contact: email.

Medical assessment and prescribing are carried out by the responsible licensed doctor. The medical record is kept by the healthcare provider responsible for your care, under the Patient Data Act (PDL). The information you receive before your first appointment identifies that provider.

Information we process

  • Contact details: name, email, phone and town or city.
  • The preliminary check: age, height, weight, BMI, weight-related conditions, medicines and your answers to the risk questions, together with your confirmation that the answers are true.
  • Patient pages: weight you log, dose schedule, food and training plans, messages to and from the clinic and conversations with the app's coaches. This is health information.
  • Payment: amount, date, status and receipts, the card type and last four digits, and the id numbers the payment provider gives the customer and the card. We never see or store the full card number.
  • Login: email, a password stored only as a one-way hash, which devices you have approved, and a log of logins where the IP address is hashed.
  • Personal identity number: used for BankID login and identification; we store only a one-way hash. The request and the preliminary check do not require it. At the video appointment you identify yourself with BankID in the video call, and the number is used there for identification and for the healthcare provider's medical record.
  • Technical data: IP address, browser, source page and campaign parameters.
  • Approvals: the time and version of the terms, confirmations, card mandate and consents you have accepted.

Why, and on what legal basis

  • Contract (GDPR Article 6(1)(b)): to provide the programme, take payment and give you access to your patient pages.
  • Health information: your explicit consent (Article 9(2)(a)), which you give when you take the preliminary check and start the programme, and for the care itself, health care (Article 9(2)(h)).
  • The preliminary check and your confirmation are kept together with your booking and payment, so that the doctor can compare them at the appointment and so that we can show what you confirmed if a dispute arises (Article 9(2)(f)).
  • Legal obligation (Article 6(1)(c)): bookkeeping of payments under the Swedish Bookkeeping Act, and the medical record under the PDL at the healthcare provider responsible for your care.
  • Legitimate interest (Article 6(1)(f)): to handle requests properly, prevent misuse of limited appointment times and protect the login against intrusion.

The app's coaches

The weight coach and the motivation coach in your patient pages answer automatically. They are used only if you have approved it yourself in the app, and you can stop using them whenever you like without anything else in the programme being affected.

  • Before a question is sent, we remove email addresses, phone numbers and personal identity numbers. Only that text and your latest questions and answers to the same coach are sent to the supplier that produces the reply. Your name, email and other details from our records are never sent.
  • Questions about acute symptoms, crises and medical questions are never answered by the supplier — they are stopped with us before anything is sent. At signs of a crisis the clinic receives an alert, without the content of what you wrote.
  • The conversations are stored with us as health information and can be read by the clinic.
  • The coaches' replies are guidance, not decisions. No decisions about you are made automatically.

Recipients and processors

Your information is shared only with:

  • Licensed doctors carrying out assessments, and the healthcare provider keeping your medical record
  • Pharmacies for electronic prescriptions (via the Swedish eHealth Agency)
  • Stripe: card payment and the saved card. Stripe receives your name, email and card details; from us Stripe receives only id numbers, no health information.
  • our video service for healthcare: the video appointment with the doctor, including identification with BankID.
  • Criipto (BankID): identification with BankID when it is used for login or booking with us.
  • Anthropic: produces the coaches' automatic replies, using only the redacted message text described above.
  • Google: email that we send and receive.
  • Our server and hosting provider

The suppliers are processors under data processing agreements and may process the information only on our behalf. Stripe also processes some information for its own legal requirements, for example against fraud and money laundering, and is then itself responsible for that.

Transfers outside the EU/EEA

Google, Stripe and Anthropic are, or belong to groups with, companies in the USA, so information may be transferred to or accessed from the USA. Such transfers rely on the European Commission's adequacy decision (the EU–US Data Privacy Framework) where the recipient is certified under it, and otherwise on the Commission's standard contractual clauses with supplementary safeguards. Contact us if you would like a copy of the safeguards.

Retention

We do not delete booking, payment, programme, preliminary-check or patient-page information automatically. You can request deletion; we assess the request against the Bookkeeping Act and the Patient Data Act.

  • Medical records at the healthcare provider: at least 10 years after the latest entry (PDL, Chapter 3, Section 17).
  • Accounting records for payments: 7 years under the Bookkeeping Act.
  • One-time codes and links for creating or changing a password expire after a short time and cannot be reused, but are kept as history.

Security

  • All traffic is encrypted, and health information is shown only after login.
  • Passwords, personal identity numbers and login codes are stored only as one-way hashes. A new device must be confirmed with a one-time code sent by email.
  • If you change your password or choose “Log out of all devices”, all logins and approved devices end immediately.
  • No health information is sent to web analytics tools.

Your rights

  • Access to your information
  • Correction of inaccurate information
  • Erasure — except for what we must keep by law, such as medical records and accounting records
  • Restriction of processing
  • Data portability
  • Objection to processing based on legitimate interest
  • Withdrawing a consent at any time. Withdrawal applies going forward and does not affect earlier processing. You withdraw your consent to the coaches directly in the app.
  • Lodging a complaint with the Swedish Authority for Privacy Protection (IMY)

Requests and booking

When you submit a request through /en/book we ask for no Swedish personal identity number. We collect your name, email and optional phone number so we can contact you. If you have taken the preliminary check, your answers are linked to the booking. Full booking terms: /en/booking-terms.

Cookies

We use necessary cookies to make the service work. In your patient pages these are the login (a session cookie) and, if you choose it, a cookie that remembers an approved device for 90 days. No third-party marketing cookies are loaded before you give consent.

Contact

Send privacy questions to email. We reply within 30 days.