Privacy Policy

The data controller is Biofly AB, Stockholm, Sweden.

For any privacy question or to exercise your rights, contact us at privacy@xertahealth.se. Our Data Protection Officer can be reached at dpo@xertahealth.se.

Account & identity data: your name, email, phone number, national identification (personal) number, date of birth, country of residence and, where required, identity-verification results.

Health data (special-category data under Article 9 GDPR): the symptoms, medical history, medications, allergies, messages, uploaded files, consultation records, clinical notes, diagnoses, prescriptions, lab orders and referrals you and your clinician create.

Technical data: device and browser information, IP address, and cookie identifiers described in our Cookie Policy.

To provide medical consultations and treatment — processing of health data is necessary for the provision of health care under Article 9(2)(h), and for the performance of our contract with you under Article 6(1)(b).

To confirm your identity and keep the service safe — legal obligation (Article 6(1)(c)) and our legitimate interest in preventing fraud and misuse (Article 6(1)(f)).

To send you service communications about your consultations — performance of our contract (Article 6(1)(b)).

To obtain and record your explicit consent for health-data processing at registration — Article 9(2)(a). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Licensed clinicians providing your care through Xerta.

Sub-processors that operate our infrastructure under data processing agreements: our cloud hosting and database provider (Vercel and Neon, EU region), our transactional email provider (Resend), and identity-verification providers where used. We do not sell your data.

Public authorities where we are legally required to disclose, and national e-prescription systems when your clinician issues a prescription.

We store personal data on servers located in the European Union. Where a sub-processor would transfer data outside the EU/EEA, we rely on an adequacy decision or EU Standard Contractual Clauses with appropriate safeguards.

We keep medical records for the period required by patient-records law (in Sweden, at least 10 years after the last entry). Account data is deleted or anonymized within 90 days of account closure, except where it forms part of a medical record subject to statutory retention. Full retention periods are published on our Compliance page.

When you ask us to erase your account, we anonymize your identity and close the account, but we retain the underlying clinical records in de-identified form where the law requires us to keep them.

You have the right to access your data, to receive a portable copy, to rectify inaccurate data, to erase your data (subject to legal retention), to restrict or object to processing, and to withdraw consent at any time.

You can exercise access, portability and erasure directly in the app under Account → Privacy and security. For any other request, contact us using the details above.

You also have the right to lodge a complaint with your supervisory authority — in Sweden, Integritetsskyddsmyndigheten (IMY), Sweden — imy.se.

Xerta uses AI-assisted intake to help structure your symptoms and support triage. These tools assist a licensed clinician and do not make final medical decisions about you without human involvement.

This version is dated 1 January 2026 (version 2026-01-01). If we make material changes we will notify you and, where required, ask for renewed consent.