1. About BizMed and this Privacy Policy
 
BizMed Sverige AB (“BizMed”, “we”, “us”) provides healthcare, occupational health and preventive health services to individuals and employees of corporate clients.
BizMed Sverige AB is the data controller for personal data processed within BizMed’s healthcare operations and for other personal data processed as part of our own business activities.
 
Data Controller:
BizMed Sverige AB
Organisation number: 559425-5738
Malmskillnadsgatan 37
Stockholm, Sweden
Email: lova@bizmed.se
 
For questions regarding privacy or the processing of personal data, please contact us at lova@bizmed.se
 
Our processing of personal data is primarily governed by the EU General Data Protection Regulation (“GDPR”), the Swedish Patient Data Act (Patientdatalagen, 2008:355), and other applicable Swedish healthcare and data protection legislation.
 
BizMed’s healthcare operations are registered with the Swedish Health and Social Care Inspectorate (IVO).
 
2. Patients and Individuals Receiving Healthcare Services
 
2.1 What personal data do we process?
 
When you book, receive or communicate with us regarding a healthcare service, we may process personal data including:
 

• name

• Swedish personal identity number, coordination number or other identification information

• date of birth

• contact information

• booking and appointment information

• information provided through health declarations or medical questionnaires

• health information and medical history

• information regarding medications, allergies, vaccinations and previous treatment

• test results, laboratory results and examination results

• information documented by healthcare professionals

• information necessary for medical certificates or other medical documentation

• correspondence relating to your healthcare

• payment information where applicable

• other information necessary to provide safe and appropriate healthcare.
   

Health information constitutes a special category of personal data under the GDPR and is subject to additional protection.
 
2.2 How do we collect your information?
 
Personal data may be collected:
 

• directly from you

• when you make a booking

• through our digital booking or medical record system

• through health declarations or medical questionnaires

• during consultations, examinations, vaccinations or other healthcare encounters

• from healthcare professionals involved in your care

• from laboratories, radiology providers or other healthcare providers involved in providing the requested service

• from your employer where this is necessary for the administration of an employer-funded service, for example your name or eligibility to participate.
   

Where information is obtained from an employer, this does not give the employer access to your medical record or medical information.

3. Why We Process Patient Data

We process personal data where necessary to:
 

• administer bookings and appointments

• identify patients

• provide safe and appropriate healthcare

• perform vaccinations, health examinations, health checks and other medical services

• assess medical history and individual risk factors

• order, receive and review laboratory tests and other examinations

• document healthcare in accordance with applicable law

• issue medical certificates and other medical documentation where applicable

• communicate with patients before and after appointments

• manage referrals and coordination with other healthcare providers where necessary

• administer payment and invoicing

• fulfil legal obligations applicable to healthcare providers

• ensure quality and patient safety

• investigate incidents and complaints

• produce statistics and quality follow-up using aggregated or appropriately protected information where possible.
   

4. Legal Basis for Processing Patient Data

The processing of personal data within our healthcare operations is carried out in accordance with the GDPR, the Swedish Patient Data Act and other applicable healthcare legislation.
Depending on the processing activity, the legal basis under Article 6 GDPR may include:
 

• compliance with a legal obligation

• performance of a contract or steps taken at the request of the individual before entering into a contract

• legitimate interests, where applicable

• other legal grounds applicable to the provision and administration of healthcare.
   

Health data and other special categories of personal data are processed where permitted under Article 9 GDPR, including where processing is necessary for the purposes of medical diagnosis, provision of healthcare or treatment, management of healthcare services, or where another applicable legal basis exists.

Consent may be requested in specific situations where consent is legally required or appropriate. However, healthcare records and other processing that BizMed is legally required to perform are not generally based on consent and cannot necessarily be deleted or withdrawn at the patient's request.

5. Medical Records and Our Digital Healthcare Systems

BizMed uses secure digital systems for booking, healthcare administration and medical record keeping.

Our medical record and booking infrastructure may be provided by external healthcare IT providers acting on behalf of BizMed, including HLTHY / The Patient Company AB, where applicable.
Such providers may process personal data only in accordance with applicable data protection requirements, contractual obligations and BizMed’s instructions where they act as data processors.
Information submitted when booking an appointment may therefore be processed within the same or connected secure healthcare systems used to administer your care.

Access to medical information is restricted to authorised persons who require access for the performance of their healthcare-related duties.

A corporate client or employer does not receive access to BizMed’s medical record system or to an employee’s medical record simply because the employer has arranged or paid for the service.

6. Employer-Funded Healthcare and Occupational Health Services

BizMed frequently provides healthcare and occupational health services that are arranged or paid for by an employer.

In these situations, it is important to distinguish between:
 

1. the contractual relationship between BizMed and the employer; and

2. the healthcare relationship between BizMed and the individual patient.

Where BizMed provides healthcare to an employee, BizMed is responsible for the medical information processed as part of that healthcare relationship.
The employer does not receive access to the employee’s medical record, test results, health declaration, medical history or other confidential medical information unless there is a specific lawful basis for such disclosure.

Where individual medical information is intended to be provided to an employer, for example as part of a specific occupational health assessment or medical certificate, the individual will be informed about the purpose and intended recipient in accordance with applicable law.

7. Information That May Be Shared With an Employer

Where an employer arranges or pays for a service, BizMed may process or provide limited administrative information where necessary for administration of the service.

Depending on the arrangement, this may include information necessary to:
 

• verify eligibility for an employer-funded service

• administer bookings

• coordinate on-site healthcare delivery

• administer invoicing and payment

• confirm the number of services delivered

• fulfil agreed administrative requirements.
   

BizMed does not provide employers with an employee’s medical record, diagnosis, health declaration, laboratory results or other confidential medical information merely because the employer pays for the service.

Where possible, employer reporting regarding health checks or preventive health initiatives is provided on an aggregated and anonymised basis so that individual employees cannot reasonably be identified.

8. Corporate Health Reports and Statistics

For certain corporate health services, BizMed may provide the employer with an aggregated report regarding health trends within the participating group.

Such reporting may include aggregated information relating to areas such as:
 

• blood pressure

• metabolic health markers

• stress

• sleep

• physical activity

• lifestyle factors

• work environment

• other relevant population-level health indicators.
   

Reports are designed to provide organisations with an overview of health trends without disclosing individual medical information.

BizMed applies appropriate minimum group sizes and other safeguards where necessary to reduce the risk of individuals being identified from aggregated data.

9. Vaccination Services

When you book a vaccination through BizMed, we process the information necessary to:
 

• administer your booking

• assess whether the vaccination is medically appropriate

• document the vaccination

• provide the vaccination safely

• fulfil applicable healthcare documentation requirements.
   

Where your employer pays for the vaccination, the employer does not receive access to your medical record or medical questionnaire.

Administrative information may be processed where necessary to administer the employer-funded vaccination service.

10. Health Checks and Medical Examinations

For health checks, occupational health examinations, visa medical examinations and other medical examinations, we may process health declarations, medical history, examination findings, laboratory results and other information necessary for the relevant service.

The exact information processed depends on the nature and purpose of the examination.

Where an examination is performed for a specific third-party purpose, such as a visa application, regulatory requirement or occupational medical certificate, relevant information may be disclosed to the designated recipient where required for that service and in accordance with applicable law.
The individual will be informed where the purpose of the service requires medical information or a medical conclusion to be provided to a third party.

11. Laboratories, Radiology and Other Healthcare Providers

BizMed works with external healthcare providers where necessary to provide certain services.
This may include, for example:

• accredited laboratories

• radiology providers

• specialist healthcare providers

• healthcare professionals

• other providers involved in the patient’s examination or treatment.
   

Relevant personal and medical information may be shared with these providers where necessary for the requested healthcare service and where permitted by applicable law.

Each healthcare provider may be independently responsible for its own processing of personal data where it acts as a separate healthcare provider and data controller.

12. Other Service Providers

BizMed may use suppliers that provide services such as:
 

• medical record and booking systems

• secure IT infrastructure and hosting

• payment services

• accounting and invoicing systems

• communications services

• technical support

• other administrative systems.
   

These suppliers may process personal data only to the extent necessary to provide their services.
Where a supplier processes personal data on behalf of BizMed, we require appropriate contractual and security safeguards in accordance with applicable data protection law.

13. International Transfers of Personal Data

For healthcare services provided in Sweden, including vaccination services, BizMed aims to ensure that personal data is processed within the EU/EEA and does not transfer patient data outside the EU/EEA unless this is necessary for the specific service requested by the patient.
 

For standard vaccination services provided in Sweden, patient data is not transferred by BizMed outside the EU/EEA.
 

Certain services, in particular international immigration and visa medical examinations, may require personal data to be transferred to authorities or designated systems outside the EU/EEA. Where such a transfer is necessary, BizMed will ensure that it is carried out in accordance with applicable data protection legislation and that an appropriate legal basis and, where required, safeguards for the transfer are in place.
 

Further information about international transfers relating to Australian and New Zealand immigration medical examinations is provided in the relevant section of this Privacy Policy.

14. How Long Do We Keep Personal Data?

We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as required under applicable law.

Medical records

Patient records are retained for at least 10 years after the last entry in the medical record, in accordance with the Swedish Patient Data Act. Certain information may be retained for longer where required or permitted by law.

Booking and administrative information

Information that forms part of the patient record is retained according to the rules applicable to medical records.

Other administrative information is retained only for as long as necessary for the relevant administrative purpose or as required by law.

Accounting information

Information that forms part of accounting records is retained in accordance with applicable Swedish accounting legislation.

Corporate and supplier contacts

Business contact information is retained for as long as necessary to manage the relevant business relationship, fulfil contractual or legal obligations, or maintain appropriate business records.

15. Confidentiality and Access to Medical Information

BizMed applies confidentiality and access controls to protect patient information.

Healthcare professionals and other persons working within BizMed may access documented patient information only where they participate in the patient’s care or otherwise require the information to perform their duties within the healthcare operations.

Access to medical record systems is personal and restricted.

BizMed applies technical and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

16. Contacts at Client Companies

When you act as a contact person for a company or organisation that is a current or prospective BizMed client, we may process:

• name

• job title

• employer

• business email address

• business telephone number

• correspondence

• information relating to the business relationship.
   

We process this information for purposes including:
 

• communicating regarding our services

• administering contracts

• managing ongoing customer relationships

• responding to enquiries

• invoicing and administration

• providing relevant information about BizMed’s services

• business-to-business marketing where permitted by applicable law.
   

The legal basis may include performance of a contract, steps taken in connection with a potential contract and BizMed’s legitimate interest in managing and developing its business relationships.

17. Contacts at Suppliers and Business Partners

We may process names, professional contact details, job titles and correspondence relating to individuals working for suppliers, healthcare partners and other organisations with which BizMed has a business relationship.

This information is processed for contract administration, communication, service delivery, compliance and management of the business relationship.

The legal basis may include contractual necessity, legal obligations and BizMed’s legitimate interests.
18. Your Rights

Subject to the conditions and limitations set out in applicable law, you may have the right to:
 

• receive information about how your personal data is processed

• request access to your personal data

• request correction of inaccurate or incomplete personal data

• request deletion of personal data in certain circumstances

• request restriction of processing in certain circumstances

• object to certain processing based on legitimate interests

• receive certain personal data in a portable format where the right to data portability applies

• withdraw consent where processing is based on consent

• lodge a complaint with a supervisory authority.
   

These rights are not absolute.

In particular, the right to deletion does not mean that BizMed can delete medical records or other information that we are legally required to retain.

Requests concerning medical records may also be subject to specific provisions under Swedish healthcare legislation.

To exercise your rights, please contact support@bizmed.se.

We may need to verify your identity before providing access to personal or medical information.
19. Complaints
If you have questions or concerns about how BizMed processes your personal data, we encourage you to contact us first:
support@bizmed.se

You also have the right to lodge a complaint with the Swedish supervisory authority:

Integritetsskyddsmyndigheten (IMY)

Swedish Authority for Privacy Protection
Information about complaints and data protection rights is available through IMY.

20. Security

BizMed takes appropriate technical and organisational measures to protect personal data.
The measures applied depend on the nature and sensitivity of the information and may include:
 

• access controls

• individual user authentication

• secure healthcare IT systems

• logging and monitoring of access where applicable

• encryption and secure communications where appropriate

• confidentiality obligations

• procedures for managing personal data incidents

• supplier and data processor requirements

• internal procedures governing access to patient information.
   

No information system can be guaranteed to be completely secure, but BizMed continuously works to maintain safeguards appropriate to the sensitivity of the information we process.

21. Changes to this Privacy Policy

We may update this Privacy Policy when our services, systems or legal obligations change.
The latest version will always be published on BizMed’s website together with the date of the latest update.

Where a change materially affects how we process personal data, we will provide additional information where required by law.

22. Contact

For questions regarding this Privacy Policy, the processing of your personal data or your data protection rights, please contact:

BizMed Sverige AB
Organisation number: 559425-5738
Malmskillnadsgatan 37
Stockholm, Sweden
Privacy enquiries: support@bizmed.se
General enquiries: kontakt@bizmed.se
BizMed Sverige AB’s healthcare operations are registered with the Swedish Health and Social Care Inspectorate (IVO).