Skip to content
    TouristDr

    Privacy Policy

    Effective date: 01-04-2026 · Last updated: 15-11-2026 · Version 1.1 · English is the governing language

    Licensed healthcare provider

    Sculpté AB holds IVO authorisation Ve-VGR-2024-00268351 for the provision of private healthcare services at Kyrkogatan 42B, 411 15 Gothenburg, Sweden, including digital healthcare services.

    1. Introduction

    This Privacy Policy explains how Sculpté AB (org.nr 559335-3419), registered at Kyrkogatan 42B, 411 15, Gothenburg, Sweden, ("we", "us", "TouristDr") collects, processes, stores, and protects personal data when you use the TouristDr website and healthcare services (together, the "Services").

    Sculpté AB is the single legal entity responsible for both the TouristDr digital platform and the clinical healthcare services delivered through it. Sculpté AB holds IVO authorisation for the operation of the Mindr private clinic (Kyrkogatan 44, Gothenburg) and directly employs or contracts all physicians providing care via TouristDr. Sculpté AB is the sole data controller for all personal data processed in connection with the Services.

    TouristDr is a private-pay hybrid (digital + physical) healthcare service for tourists, expatriates, and individuals in Sweden without a Swedish personal identity number (personnummer). It forms no part of the Swedish public healthcare system. No subsidies, frikort, or högkostnadsskydd apply.

    2. Who is responsible for your personal data?

    Sculpté AB is the data controller for all personal data collected and processed through the Services — both data related to your use of the TouristDr platform and data related to your healthcare consultations. As both platform operator and licensed care provider, Sculpté AB processes your data under two distinct legal frameworks: GDPR for general data protection, and Swedish healthcare law (Patientdatalagen 2008:355) for clinical health records.

    • Privacy contact: privacy@mindr.se
    • Postal: Sculpté AB, Kyrkogatan 42B, 411 15, Gothenburg, Sweden
    • IVO authorisation: Ve-VGR-2024-00268351

    3. What personal data we collect

    3.1 Personal data collected

    • Nationality and country of residence
    • Passport or national identity document number (used for identity verification in the absence of a Swedish personnummer)
    • Email address and telephone number
    • Your current location
    • Device and browser information: IP address, browser type, operating system, screen settings, time zone
    • Usage data: pages visited, session duration, feature interactions, login events
    • Payment reference data transmitted to and processed by Stripe

    3.2 Clinical health data

    When you initiate a healthcare consultation, we collect:

    • Reason for consultation, symptom description, symptom duration and severity
    • Medical history, current medications, and known allergies as disclosed by you
    • AI-assisted medical history intake data, if you choose to activate the optional feature (see Section 5)
    • Clinical notes, diagnoses, prescriptions, referrals, and other records created by the physician
    • Consultation metadata: date, time, type (digital / physical escalation), wait time, outcome category
    • Support communications related to your consultation

    3.3 Consultations for minors

    TouristDr consultations for patients under 18 may only be booked by an adult guardian who holds the account and is co-present during the consultation. The same data categories above are collected in respect of the minor as patient. The guardian is responsible for the accuracy of all information provided and for all consent decisions on the minor's behalf.

    4. How and why we use your data

    Video consultations via Whereby are not recorded. No audio or video is retained after the session ends. Written chat exchanges within the consultation interface may be stored as part of your consultation record.

    Account management and identity verification

    Legal basisArt. 6.1(b) — contract performanceRetentionActive account + 3 months for secure deletion

    Platform security, stability, and technical support

    Legal basisArt. 6.1(b); Art. 6.1(f) legitimate interestRetention6 months (support/quality); 12 months (security logs)

    Payment processing via Stripe

    Legal basisArt. 6.1(b) — contract performanceRetention7 years (Bookkeeping Act); 10 years for disputes

    Healthcare delivery

    Legal basisArt. 6.1(e) public interest; Art. 9.2(h) + PatientdatalagenRetentionMinimum 10 years from last journal entry

    AI-assisted medical history intake (optional)

    Legal basisArt. 6.1(a); Art. 9.2(a) — explicit consentRetentionUntil consent withdrawn (max 30 days for deletion)

    Patient support

    Legal basisArt. 6.1(e); Art. 9.2(h) + PatientdatalagenRetention3 years (routine); 10 years (formal complaints)

    Healthcare quality assurance (pseudonymised)

    Legal basisArt. 6.1(e) public interestRetention5 years from collection

    Service communications

    Legal basisArt. 6.1(b) — contract performanceRetentionDuration of active account

    Marketing communications (opt-in only)

    Legal basisArt. 6.1(a) — consentRetentionUntil consent withdrawn

    Legal compliance and regulatory reporting

    Legal basisArt. 6.1(c) — legal obligationRetentionDuration of proceedings or statutory requirement

    5. AI-assisted medical history — specific disclosure

    TouristDr includes an optional feature that uses AI-assisted processing to collect and structure your medical history before a consultation. This feature is strictly opt-in. A clear consent request is presented before it activates, and you may proceed to a full consultation without it. Your choice has no effect on the quality of care you receive.

    The AI system collects only what you type in response to structured prompts. It does not access external data sources, verify your identity, or consult any third-party database. It organises your input into a summary for the physician.

    The AI feature has no clinical function. It does not diagnose, prescribe, recommend treatment, or make any clinical decision. All medical decisions are made by the licensed physician, who reviews the AI-structured summary independently before and during the consultation.

    Your data entered through this feature is not used to train AI models, improve third-party AI products, or for any purpose beyond the specific consultation for which you consented. Vendor agreements include explicit contractual prohibitions on secondary use.

    This feature operates in compliance with the EU AI Act (Regulation (EU) 2024/1689) and, where applicable, EU Medical Device Regulation (MDR) obligations. You will always be informed when you are interacting with an automated system.

    6. How long we retain your data

    • Patient medical records: minimum 10 years from the last journal entry, as required by Patientdatalagen 2008:355, ch. 3 s. 17.
    • Payment and accounting records: 7 years from the end of the financial year of the transaction, per the Swedish Bookkeeping Act (Bokföringslagen 1999:1078). 10 years for disputed transactions.
    • Account and platform data: duration of active account plus up to 3 months for secure deletion.
    • Security logs: 12 months.
    • AI-assisted intake session data: deleted within 30 days of consent withdrawal.
    • Legal and compliance records: duration of proceedings or applicable statutory limitation period.

    7. Third parties we share your data with

    7.1 Technology and infrastructure processors

    • Stripe Inc. (payment processing) — US-based. Subject to the EU-US Data Privacy Framework adequacy decision.
    • Whereby AS (video consultation infrastructure) — Norwegian/EU-based. Video sessions are not recorded.
    • Bahnhof AB — EU/EEA-based infrastructure. Patient medical records stored exclusively within EU/EEA.
    • Webdoc (electronic health record system) — cloud-based EHR used by Sculpté AB physicians for clinical documentation.
    • Cloudflare, Inc. (website analytics for TouristDr.se) — counts page views and visits in aggregate, without cookies and without identifying individual visitors. No health data is shared. US-based. Subject to the EU-US Data Privacy Framework adequacy decision.

    7.2 Healthcare continuity referrals

    If a physician refers you to another healthcare provider for follow-up care, relevant clinical information will be shared as necessary. You will be informed before any referral is made. TouristDr does not connect to Swedish national health record-sharing systems (NPÖ, NLL).

    7.3 Regulatory and legal disclosure

    We may disclose your data to IVO, Socialstyrelsen, law enforcement, or courts where required by law, court order, or to protect patient safety.

    7.4 Business restructuring

    In the event of a merger, acquisition, or restructuring, your data will transfer to the succeeding entity under this Privacy Policy. You will be notified in advance.

    8. International data transfers

    Patient medical records and clinical data are stored exclusively within the EU/EEA. Non-clinical operational data may involve processors with operations in the United States. All such transfers are conducted under EU Commission adequacy decisions or Standard Contractual Clauses (SCCs).

    9. Your rights

    Under GDPR and Swedish law, you have the following rights. Contact us at privacy@mindr.se to exercise them. We will respond within one calendar month.

    • Right of access (Art. 15 GDPR): request a copy of all personal data we hold about you.
    • Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
    • Right to erasure (Art. 17): request deletion of your data. Note: medical records cannot be erased during the 10-year statutory retention period.
    • Right to restrict processing (Art. 18): request that we limit processing while a dispute is pending.
    • Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
    • Right to object (Art. 21): object to processing based on legitimate or public interest.
    • Right to withdraw consent (Art. 7.3): withdraw consent at any time where processing is consent-based.
    • Right to lodge a complaint: with the Swedish Authority for Privacy Protection (IMY) at www.imy.se.

    10. Security

    • Strong encryption of all data in transit (TLS) and at rest
    • Role-based access controls limiting data access to authorised personnel only
    • Continuous security monitoring and intrusion detection
    • Regular security assessments and third-party vendor due diligence
    • All clinical staff bound by statutory professional confidentiality
    • Patient medical records stored on EU/EEA-certified infrastructure

    11. Cookies

    We use cookies and similar technologies on TouristDr.se. Full details are set out in our Cookie Policy. We never use health data for advertising or cookie-based profiling.

    12. Updates to this policy

    We may update this Privacy Policy to reflect changes in our practices, technology, or legal obligations. Material changes will be communicated by email or by prominent notice on TouristDr.se at least 30 days before taking effect.

    13. Contact