Privacy Policy
Data controller
Lunda Psykologi · Louise Björnestrand
Östra Mårtensgatan 19, Lund
lundapsykologi@gmail.com
1. Data controller
Lunda Psykologi, org. no. 559565-2610, registered in Södra Sandby, is the data controller for the processing of your personal data. The responsible person is Louise Björnestrand, licensed psychologist. Contact: lundapsykologi@gmail.com, +46 76-020 35 77.
2. Personal data we process
We process the following categories of personal data: Contact details (name, email, phone number, address), Personal identity number (for medical record-keeping as required by law), Health and treatment data (history, assessments, treatment plans, session notes), Booking and payment data (session times, invoicing details), and Technical data via the website (IP address and browser type, processed by our hosting provider to operate and secure the site).
3. Purpose and legal basis
We process your personal data for the following purposes: Providing psychological treatment — legal basis: contract and legal obligation under healthcare legislation. Medical record-keeping — legal basis: legal obligation under the Swedish Patient Data Act (2008:355). Processing of health data — legal basis: GDPR Art. 9.2(h), the exception for healthcare. Booking and scheduling via Kaddio — legal basis: contract. Invoicing — legal basis: legal obligation (Swedish Bookkeeping Act).
4. How we share personal data
We share your personal data with the following recipients when necessary: Kaddio AB (booking platform and medical records system, acting as data processor under a data processing agreement), Invoicing service (for payment handling), and Netlify (our hosting provider, which processes technical data in order to deliver the website). We do not transfer personal data to countries outside the EU/EEA without appropriate safeguards. We never sell your personal data to third parties.
5. Professional secrecy
As a licensed psychologist, Louise Björnestrand is bound by healthcare confidentiality under the Swedish Public Access to Information and Secrecy Act (2009:400) and the Patient Safety Act (2010:659). This means that what you share in therapy is protected by confidentiality and will not be disclosed to outside parties, except in situations regulated by law (for example, serious risk to life or health, or mandatory reporting obligations regarding children at risk).
6. Retention and deletion
Medical records are retained for a minimum of ten years after the last entry, in accordance with the Patient Data Act (2008:355) Chapter 3, Section 17. Accounting records are retained for seven years under the Swedish Bookkeeping Act (1999:1078). Contact details not linked to medical records are deleted when no longer needed for their purpose. The site’s single cookie is deleted according to the retention period specified in section 8.
7. Your rights
Under the GDPR, you have the right to: Request access to your personal data (data subject access request). Request rectification of inaccurate data. Request erasure of personal data (does not apply to medical records covered by the Patient Data Act). Request restriction of processing. Object to processing. Request data portability. Withdraw consent (without affecting the lawfulness of processing carried out before withdrawal). You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy.se.
8. Cookies
The website uses a single cookie: lp_consent, which records only that you have seen our cookie notice so it is not shown again. It is stored for twelve months and is strictly necessary for the site to function, which means it does not require consent. We use no analytics, tracking, or marketing cookies. The map on the contact page loads from Google Maps only when you click to display it — if you choose to, Google may set its own cookies under its own terms. You can delete cookies at any time through your browser settings.
9. Security measures
We implement technical and organisational measures to protect your personal data against unauthorised access, loss, and destruction. Medical records are kept in Kaddio, a system that meets the requirements of the Patient Data Act. All communication with the booking system is encrypted.
10. Changes to this policy
We may update this privacy policy from time to time. The latest version is always available on this page. In the event of material changes, we will inform you by email or via the website.
11. Contact
Questions about how we process your personal data, or want to exercise any of your rights? Contact us at lundapsykologi@gmail.com or call +46 76-020 35 77.
Last updated: March 2026