Privacy policy

Care Links Sweden AB respects your privacy. This policy explains how we process personal data when you contact us, apply for MAL services or administer a potential collaboration. Patient data processed under a separate medical engagement may be subject to additional rules and privacy information.

Care Links Sweden AB (company registration number 559292-8633) is the data controller for the processing described in this policy. MAL Sverige™ is the service brand.

Postal address: Tömvägen 44, 193 91 Sigtuna, Sweden. Telephone: +46 70 624 11 79. Email: info@nordicskinklinik.se. Website: https://www.malsverige.se.

When you contact us or apply for MAL services, we may process your name, contact details, professional role, clinic name, business information, selected package, messages and relevant correspondence.

For applications and professional verification, we may process licence details, IVO registration information, patient insurance, training certificates, contracts and, where necessary, identity documents and Swedish personal identity numbers. Identity numbers are used only where clearly justified and legally permitted.

Technical systems may also process IP addresses, timestamps and security logs. Please do not submit patient records or health information through ordinary website forms.

We process information to respond to enquiries, assess applications, verify professional credentials, prepare and administer MAL agreements, meet legal obligations, protect our systems and, where necessary, establish or defend legal claims.

Depending on the circumstances, the legal basis may be steps before entering into or performance of a contract with an individual (GDPR Article 6(1)(b)), legitimate interests in business communications, credential checks and IT security subject to a balancing test (Article 6(1)(f)), legal obligation (Article 6(1)(c)), or consent where specifically required (Article 6(1)(a)).

Where an application is made on behalf of a limited company, Article 6(1)(b) will generally not apply to processing the company representative’s data; legitimate interests may instead apply. We do not rely on blanket consent for all application processing.

If a submitted document exceptionally contains special-category data under GDPR Article 9, we separately assess whether its processing is necessary and lawful.

Documents submitted by nurses, dentists and other applicants through our web forms are stored, under our current arrangement, on Microsoft servers located in the Netherlands, within the European Union.

Within Care Links Sweden AB, only its CEO, specialist physician Alex Sajjad, is authorised to open and review submitted identity, professional licence and credential documents. This restriction concerns internal business access and does not exclude technical processing by a service provider under contract.

We request only the documents necessary for the application or credential check, limit access on a need-to-know basis and do not retain them longer than necessary.

Enquiries that do not proceed further are deleted once no longer needed to respond to and close the enquiry or for a documented legitimate purpose.

Application files and identity/credential documents are deleted when the review is complete and continued retention is no longer necessary. Where an agreement is concluded, relevant contractual records are retained during its term and subsequently for applicable legal obligations or specific legal claims. Accounting records are retained as required by Swedish accounting law.

Specific retention periods for each data category are documented in our internal procedures. You may contact us to ask which period or criteria apply to your data.

Information may be processed by authorised representatives of Care Links Sweden AB and by suppliers providing Microsoft storage, web hosting, email, secure document transfer or electronic signing.

Where a supplier acts as a processor, we use an applicable data processing agreement and require appropriate security. Information may also be disclosed to authorities where legally required. We do not sell personal data.

The stated document storage location is the Netherlands. This does not by itself mean that all access, support or other processing is confined to the EU/EEA.

If information is transferred or made accessible to recipients outside the EU/EEA, we ensure an appropriate GDPR transfer mechanism, such as an adequacy decision or standard contractual clauses with any necessary supplementary safeguards. Information about relevant transfers and safeguards is available on request.

We use appropriate technical and organisational measures, including encrypted website communications, access restrictions, protected document storage, security updates and procedures for deletion and incident response.

Security controls such as multi-factor authentication, logging, permission reviews and protection against unauthorised administrator access must be configured and verified in the actual technical environment. No digital processing is entirely risk-free.

Subject to the applicable conditions, you may request access, rectification, erasure, restriction and data portability, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it.

Contact info@nordicskinklinik.se. We respond without undue delay, normally within one month. We may need to verify your identity. Some information may or must be retained despite a deletion request.

You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY): https://www.imy.se/. You may also contact us directly.

The website may use strictly necessary cookies and technical logs. If analytics, statistics or marketing technologies are used, we provide separate information and obtain consent where required.

Read our cookie policy: https://www.malsverige.se/cookiepolicy/ (verify the link before publication).

We do not decide MAL applications solely by automated decision-making that produces legal or similarly significant effects. We may update this policy when our operations, systems or legal requirements change. The current version will be published on the website.