Privacy policy

Privacy policy for X-Vision Ögon Center AB

At X-Vision we process your personal data under the General Data Protection Regulation (GDPR) and the Swedish Patient Data Act. This policy describes how we collect, use, store and protect your data when you are in contact with us.

Data controller

X-Vision Ögon Center AB
Company registration number: 559001-0178
Hyllie Stationstorg 2, 215 32 Malmö, Sweden
Clinics: Malmö (Hyllie), Lund and Hellerup.
Email: info@xvisionkliniken.se
Phone: +46 103001008

What data do we collect?

We collect the following types of personal data:

• Identity information: Name, personal identification number.

• Contact information: Address, phone number, email address.

• Health information: Information about your eye health and medical history needed for safe and effective treatment.

• Payment information: For payment handling and invoicing.

Why do we collect personal data?

We process your personal data in order to:

1. Carry out examinations and treatments.

2. Maintain secure and accurate patient records.

3. Manage bookings and communicate with you.

4. Send reminders about your healthcare visits.

5. Comply with legal requirements such as the Patient Data Act.

Legal basis for processing

We process your data based on:

• Consent: To perform specific examinations or treatments.

• Contract: To fulfil agreed services.

• Legal obligation: To comply with applicable laws and regulations.

Newsletter and marketing

If you sign up for our newsletter we process your email address to send you offers, based on your consent. You can unsubscribe using the link in the mailing. We never use information from your patient record for marketing.

Cookies, advertising and web analytics

We use Google Tag Manager to manage tags on the website. Marketing and statistics cookies, including the Meta pixel and Google Ads, are only activated if you give your consent in our cookie banner. You can change or withdraw your choice at any time. Details of the cookies we use can be found in our cookie policy: xvisionclinic.com/cookies.

Friends & Family – data about someone else

If you refer a friend, family member or colleague, we process that person's name and contact details so we can get in touch and register the discount. Please only give us details of someone who knows you are doing so. The person is informed at our first contact. Read more about Friends & Family.

Photos and videos

If you send us a photo, video or review, we use the material only to the extent you have consented to. You may withdraw your consent at any time, and we then stop using the material going forward.

Who can access your data?

Data is disclosed only where it is necessary for your care or payment, or where the law requires it. Recipients may be:

• Our booking and medical records system patient.nu, which acts as our data processor.

• Payment and instalment providers: Zaver (Frink AB) if you live in Sweden and Resurs Bank if you live in Denmark. They are independent controllers for the credit assessment and process the data under their own policies.

• IT and hosting suppliers that process data on our behalf under data processing agreements.

• Other healthcare providers, if you request or consent to it, for example for a referral.

• Your insurance company, if treatment is paid for wholly or partly through insurance.

• Public authorities, where the law requires it.

How do we protect your data?

Data is stored in our secure systems and is only accessible to authorised personnel. We use encryption, access logging and other security measures against unauthorised access.

How long do we retain your data?

Under the Swedish Patient Data Act, patient records are kept for at least ten years after the last entry, and accounting records as required by the Accounting Act. Record data therefore cannot be erased at your request – an entry is only removed by decision of IVO.

Your rights

You have the right to:

• Access your data and request a copy of it.

• Request correction of incorrect or incomplete data.

• Request erasure of your data in certain cases.

• Object to the processing.

• Request restriction of processing.

• Receive data you provided yourself in a machine-readable format (data portability).

• Withdraw a consent, for example for the newsletter or image material.

Complaints to the supervisory authority

If you are unhappy we would like you to contact us first. You also always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or with the supervisory authority in the EU country where you live.

Contact us

To exercise your rights or ask questions about this policy, please contact us using the details above.

We update this policy as necessary. The latest version is always available on our website.
Last updated: 30 September 2026.