WhiteCross Clinic - One Specialist clinic. Three disciplines.

PRIVACY POLICY

A.1 Introduction

Your privacy and the confidentiality of your health information matter to us. This Privacy Policy explains how WhiteCross AB ("WhiteCross," "we," "us," or "our") collects, uses, stores, shares and protects your personal data when you visit our website, contact us, book an appointment, or receive dental, ear/nose/throat (ENT), or aesthetic treatment (including Botox injections and other minor cosmetic procedures) from us.

This Policy is issued in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Swedish Act supplementing the GDPR (Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning), and the Swedish Patient Data Act (Patientdatalagen (2008:355)), which sets out additional rules specific to healthcare providers.

A.2 Who Is the Data Controller

WhiteCross AB
Org. no.: 556746-6924
Registered address: Gjuterivägen 1, 761 40 Norrtälje, Sweden
Email: expertmed20@gmail.com
Phone: +46 76 800 36 60

WhiteCross AB is the data controller responsible for the personal data processed in connection with our clinical, aesthetic, and administrative services, and our website.

A.3 What Personal Data We Collect

Depending on how you interact with us, we may collect:

Identification and contact data: name, personal identity number (personnummer), date of birth, address, email address, phone number.
Health and patient data: medical and dental history, diagnoses, treatment plans, clinical notes, X-rays and images, test results, medication and allergy information, and other information you or a referring practitioner provide that we need to give you safe care. This is "special category data" under Article 9 GDPR.
Booking and appointment data: appointment times, service selected, and cancellation history, collected via our booking partner Bokadirekt (bokadirekt.se) or by phone.
Payment and billing data: payment confirmation, invoice details, and the VAT treatment of your treatment. Card details are processed directly by our payment provider(s) via Bokadirekt; WhiteCross does not store full card numbers.
Photographs: before/after images for aesthetic treatments, taken only with your separate, explicit consent (see section A.15).
Communications: emails, messages, and notes from phone calls with our clinic.
Website and technical data: IP address, browser type, device information, and cookie data (see section A.12).

A.4 How We Collect Your Data

We collect data directly from you (registration forms, booking, consultations, treatment), automatically through your use of our website (cookies and similar technology), and, where relevant and with your consent or as permitted by law, from other healthcare providers or referring clinicians involved in your care.

A.5 Purposes and Legal Bases for Processing

We process your personal data to:

Provide dental and healthcare services, including diagnosis, treatment, and follow-up care — necessary for the performance of a contract with you (Art. 6(1)(b) GDPR) and for the provision of health/medical care (Art. 9(2)(h) GDPR), read together with the Patient Data Act.
Maintain patient records as required by law — legal obligation (Art. 6(1)(c) GDPR) under the Patient Data Act.
Book, schedule and administer appointments — performance of a contract (Art. 6(1)(b) GDPR).
Handle billing, bookkeeping and VAT reporting — legal obligation (Art. 6(1)(c) GDPR) under the Swedish Bookkeeping Act (Bokföringslagen) and VAT legislation.
Maintain clinic safety, prevent fraud, and enforce our cancellation policy — legitimate interest (Art. 6(1)(f) GDPR).
Send appointment reminders and service-related communications — performance of a contract / legitimate interest.
Send marketing communications (e.g. newsletters, offers) — consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
Take and use before/after photographs for marketing — separate, explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
Operate website analytics and cookies — consent, where required (see section A.12).

A.6 Special Category (Health) Data

Because we provide dental, ENT and aesthetic medical care, most of the data we hold about you is "special category" health data under Article 9 GDPR. We only process this data because it is necessary for the provision of healthcare by, or under the responsibility of, a health professional (Art. 9(2)(h) GDPR), and it is subject to the confidentiality obligations of the Patient Data Act and the professional secrecy rules applicable to Swedish healthcare staff. Access to your health record is limited to staff directly involved in your care and administration, on a need-to-know basis.

A.7 Who We Share Your Data With

We do not sell your personal data. We may share it with:

Bokadirekt, our booking and payment platform provider, which processes your booking and payment data under its own privacy policy (see bokadirekt.se), and, where applicable, as a processor acting on our instructions for booking administration.
IT, hosting, and software providers that support our clinical records systems, website, and email, acting as our data processors under a data processing agreement.
Other healthcare providers or laboratories, where necessary for your treatment (e.g. referrals, dental laboratories), and with your consent where required.
Authorities such as Försäkringskassan, Socialstyrelsen, IVO, the Swedish Tax Agency (Skatteverket), or courts, where we are legally required to disclose information.
Our accountant/auditor, for bookkeeping purposes, subject to confidentiality obligations.

We require all processors to enter into a data processing agreement and to apply appropriate technical and organisational security measures.

A.8 International Data Transfers

We aim to keep your data within the EU/EEA. If any of our service providers (for example, cloud hosting or software providers) process data outside the EU/EEA, we ensure an adequate level of protection is in place, such as an EU Commission adequacy decision or Standard Contractual Clauses, together with supplementary safeguards where required. Contact us for more information about specific transfers.

A.9 How Long We Keep Your Data

Patient/medical records: kept for at least 10 years after the last entry, in accordance with Chapter 3, Section 17 of the Patient Data Act (Patientdatalagen), and longer where required by law or clinical necessity.
Booking and administrative data: kept for as long as needed to manage your relationship with us, then deleted or anonymised.
Accounting records (invoices, VAT documentation): kept for 7 years after the end of the relevant financial year, as required by the Swedish Bookkeeping Act.
Marketing consents and marketing photographs: kept until you withdraw consent, plus a reasonable period to give effect to your request.
Website/cookie data: kept according to the retention periods set out in our cookie banner/tool, typically no longer than 26 months for analytics cookies.

A.10 How We Protect Your Data

We apply technical and organisational security measures appropriate to the sensitivity of health data, including access controls and authentication, staff confidentiality obligations, encryption of data in transit, access-logged patient record systems, and regular review of who has access to your information. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where required, and inform you directly where the breach is likely to result in a high risk to you.

A.11 Your Rights

Subject to the conditions and exceptions set out in the GDPR and the Patient Data Act (for example, your right to erasure does not apply to information we are legally required to keep in your patient record), you have the right to:

Access the personal data we hold about you and receive a copy;
Rectify inaccurate or incomplete data;
Request erasure ("right to be forgotten") of data we no longer need, where no legal retention obligation applies;
Restrict processing in certain circumstances;
Object to processing based on legitimate interests, including direct marketing;
Data portability for data you provided to us that we process by automated means on the basis of consent or contract;
Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
Lodge a complaint with the supervisory authority (see section A.17).

To exercise your rights, contact us using the details in section A.18. We may need to verify your identity before responding, and will respond within one month as required by the GDPR.

A.12 Cookies and Similar Technologies

Our website may use cookies and similar technologies to make the site work (strictly necessary cookies), remember your preferences (functional cookies), and understand how visitors use our site or show relevant offers (analytics/marketing cookies). Non-essential cookies are only set with your prior consent, in accordance with the Swedish Electronic Communications Act (Lagen om elektronisk kommunikation) and the GDPR. You can manage or withdraw your consent at any time via the cookie banner/settings on our website or through your browser settings. Note that our booking platform, Bokadirekt, operates its own website and sets its own cookies under its own policy when you complete a booking there.

A.13 Children and Minors

Some of our services (dentistry, ENT) may be provided to minors, generally with the consent of a parent or legal guardian, who will act on the minor's behalf regarding their personal data where required by law. We do not perform aesthetic treatments, including Botox, on individuals under 18 years of age. Where Swedish law allows minors aged 13 and over to consent to certain online/information-society services in their own right, we apply that threshold only to the use of our website, not to clinical consent, which follows healthcare consent rules.

A.14 Marketing Communications

We will only send you marketing communications (e.g. newsletters, offers) if you have opted in. You can unsubscribe at any time using the link in our emails or by contacting us directly. Opting out of marketing does not affect appointment reminders or other service communications necessary for your care.

A.15 Photographs (Before/After Images)

For aesthetic treatments, we may take before/after photographs for your medical record and, separately and only with your explicit written consent, for marketing purposes (e.g. website, social media). You may decline or withdraw marketing consent at any time without affecting your treatment; clinical photographs kept as part of your medical record remain subject to the retention rules in section A.9.

A.16 Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or our services. The current version is always available on our website, with the "last updated" date shown above.

A.17 Supervisory Authority

If you believe we have not handled your personal data in accordance with the law, you may lodge a complaint with:
Integritetsskyddsmyndigheten (IMY) — the Swedish Authority for Privacy Protection
Website: imy.se | Phone: 08-657 61 00

We would appreciate the chance to address your concerns directly first — please contact us using the details below.

A.18 Contact Us

WhiteCross AB — Gjuterivägen 1, 761 40 Norrtälje, Sweden
Email: expertmed20@gmail.com | Phone: +46 76 800 36 60

TERMS AND CONDITIONS

B.1 About These Terms

These Terms and Conditions ("Terms") govern your use of the WhiteCross AB website and your booking of, and attendance at, appointments for dentistry, ear/nose/throat (ENT) care, and aesthetic treatments (including Botox injections) provided by WhiteCross AB. By booking an appointment or using our website, you accept these Terms.

B.2 About WhiteCross AB

WhiteCross AB — Org. no.: 556746-6924
Registered address: Gjuterivägen 1, 761 40 Norrtälje, Sweden
Email: expertmed20@gmail.com | Phone: +46 76 800 36 60

B.3 Our Services

WhiteCross AB provides dental care, ENT (ear, nose and throat) care, and minor aesthetic/cosmetic treatments such as Botox injections, delivered by qualified, registered healthcare professionals. Information published on our website is general in nature, provided for informational purposes only, and does not constitute medical advice or replace an individual consultation, diagnosis, or treatment plan from one of our practitioners. Aesthetic treatments are provided only to individuals aged 18 or over, following a consultation to assess suitability. We reserve the right to decline treatment where, in the professional judgment of our clinicians, it is not clinically appropriate.

B.4 Bookings and Appointments

Appointments can be booked online via our booking partner Bokadirekt (bokadirekt.se) or by phone on +46 76 800 36 60. When you book through Bokadirekt, you are also subject to Bokadirekt's own terms of use and privacy policy for the booking platform. Please provide accurate personal and health information, including your personal identity number where requested, and any relevant medical history, so that we can provide safe care.

B.5 Cancellations, Rescheduling and No-Shows

You may cancel or reschedule your appointment free of charge up to 48 hours before the scheduled time, via Bokadirekt or by phone/email. Cancellations made less than 48 hours before the appointment, and missed appointments ("no-shows"), may be charged a cancellation fee, as stated in our current price list or communicated to you at the time of booking. We will make reasonable efforts to notify you promptly if we need to cancel or reschedule an appointment on our side, for example due to illness or an emergency, and will offer you a new time as soon as possible.

B.6 Prices and Payment

Prices for our services are shown on our website, on Bokadirekt, or provided directly by our staff, and may be updated from time to time. In accordance with Swedish law, dental and medical care is exempt from VAT (moms), while aesthetic/cosmetic treatments (such as Botox) that are not medically necessary are subject to 25% VAT. Payment is due at the time of treatment (or as otherwise agreed) and is processed via Bokadirekt or directly at the clinic; we do not store your full payment card details.

B.7 Right of Withdrawal

Under Article 3(3)(c) of EU Directive 2011/83/EU on consumer rights and the corresponding provisions of the Swedish Act on Distance and Off-Premises Contracts (Distansavtalslagen (2005:59)), healthcare services provided by health professionals are excluded from the statutory 14-day right of withdrawal that applies to many other online purchases. This means that, once booked, appointments for dental, ENT, and aesthetic medical treatments are governed by our cancellation policy in section B.5 rather than a general right of withdrawal. Where a service is not a healthcare service for the purposes of this exclusion, applicable statutory withdrawal rights will be honoured.

B.8 Patient Rights and Consent to Treatment

Before any treatment, you will be given appropriate information about the proposed treatment, its risks, alternatives, and expected outcome, in accordance with the Patient Data Act and the Patient Act (Patientlagen (2014:821)), and your informed consent will be obtained. You have the right to ask questions, request a second opinion, and decline or withdraw from treatment at any time, subject to any clinical implications of doing so, which will be explained to you.

B.9 Complaints

If you are dissatisfied with the quality of care you received, you may raise this directly with WhiteCross AB, and/or contact your regional Patient Advisory Committee (Patientnämnden) or the Swedish Health and Social Care Inspectorate (IVO, ivo.se), which oversee the safety and quality of healthcare in Sweden. For complaints relating to a consumer purchase or service dispute that does not require a medical assessment, you may be able to bring the matter before the National Board for Consumer Disputes (Allmänna reklamationsnämnden, ARN, arn.se), subject to its eligibility criteria and value thresholds.

B.10 Liability

WhiteCross AB is not liable for temporary technical disruptions to our website or booking system, or for indirect or consequential losses arising from such disruptions, except where caused by our gross negligence or wilful misconduct. Nothing in these Terms limits our liability for personal injury or death caused by our negligence, or any liability that cannot be limited or excluded under Swedish law, including our liability for the quality and safety of clinical care under applicable patient safety legislation.

B.11 Intellectual Property

All content on this website, including text, images, logos and design, is the property of WhiteCross AB or its licensors and is protected by copyright and other intellectual property laws. You may not reproduce, distribute or otherwise use our content without our prior written consent, except for personal, non-commercial use.

B.12 Website Use

You agree to use our website lawfully and not to misuse it, for example by introducing malicious code, attempting unauthorised access, or submitting false information. We may suspend or restrict access to our website where necessary to protect its security or integrity.

B.13 Force Majeure

WhiteCross AB shall not be liable for any failure or delay in performance to the extent caused by circumstances beyond its reasonable control, including but not limited to acts of God, fire, flood, epidemic, strikes, or governmental action.

B.14 Changes to These Terms

We may update these Terms from time to time to reflect changes in our services or applicable law. The version published on our website at the time of your booking will apply, and material changes will be highlighted where reasonably practicable.

B.15 Governing Law and Disputes

These Terms, and any dispute or claim arising out of or in connection with them or our services, are governed by Swedish law. Disputes shall, where possible, first be addressed directly with WhiteCross AB. Consumers may also refer eligible disputes to the National Board for Consumer Disputes (ARN, arn.se). Subject to any mandatory consumer protection rules that apply regardless of choice of forum, the Swedish general courts shall have jurisdiction.

B.16 Contact