Privacy policy

Data controller

Psykolog Lundin (sole trader), Andreas Lundin. Contact: andreas@psykologlundin.se.

Contact and booking

On the contact page, you choose how to get in touch and the level of protection. If you ask me to contact you, the website form collects only your name, chosen contact method and the email address or phone number needed. There is no field for a message in your own words.

Your contact request passes through the website’s hosting provider Vercel and the email service Resend to my One.com inbox. The website does not create a separate database record. The subject line does not contain your name, and only the contact detail needed for your choice is sent. Read more in Resend’s privacy policy ↗.

Resend states that customer data, including message content and delivery logs, is stored in the USA. The domain’s sending region is Ireland. This means that emails are sent from there, not that the data is stored within the EU. According to Resend, transfers to the USA are covered by the EU–US Data Privacy Framework and the EU’s standard contractual clauses in its data processing agreement. Resend specifies a retention period of 30 days for email and log data on the Free plan used here.

If you would like to write in your own words, you can open Kaddio’s own contact form. No login is required, and the information goes directly from your browser to Kaddio without passing through the website’s server or Resend. When you submit the form, Kaddio creates a client record and a shared chat for the contact. This is not the same as being logged in or having a clinical note created. If I reply before you have received a Kaddio invitation, the entire reply goes to your ordinary email inbox. For continued communication in Kaddio’s protected chat, you receive a separate invitation. Kaddio states on the form that it is sent encrypted and can only be read by the authorised recipient. Ordinary email is also available as a less protected option; avoid Swedish personal identity numbers (personnummer) and sensitive health or personal information there.

Online booking on the Book an appointment page takes place in Kaddio’s own interface, embedded in the website. The information you enter there goes directly to Kaddio. When a new person books, Kaddio creates a client record containing their name, contact details and booking, among other information. This does not mean that the person has already logged in. For clients receiving ongoing treatment, clinical records are stored in Kaddio in accordance with the Swedish Patient Data Act (patientdatalagen).

Kaddio states that clinical record and communication data is stored within the EU/EEA. Some supporting services, such as text messages, BankID, booking payments and automated emails, may use subcontractors outside the EU/EEA. Kaddio states that the EU’s standard contractual clauses are used for these transfers. Read more in Kaddio’s privacy policy ↗.

Consultancy work

If the contact concerns consultancy work that is not healthcare, I do not keep a patient record. Personal data needed for contact, agreements, booking, invoicing and carrying out the work is processed to administer and fulfil what we have agreed and to meet legal obligations, such as bookkeeping.

If an employer or an organisation pays, the payer normally receives only the administrative information needed for the work and invoicing. If any other information is to be reported back, this is agreed in advance and you are told exactly what it covers.

Information about consultancy work is kept no longer than it is needed for the work or must be retained under the applicable rules, for example for bookkeeping.

The AI assistant

On the homepage, you can write a question in your own words or choose a suggested question. Only the question you are sending now passes through the website’s server function at Vercel in Washington, D.C., USA, to Groq in the USA, where a language model formulates the answer. Previous questions and other conversation history are not included. The website has no database of its own in which questions or answers are stored.

The assistant is for general questions about the website’s content, practical arrangements and how I work. You can ask in your own words, but do not include names, Swedish personal identity numbers (personnummer), contact details or information that identifies you or describes your own or someone else’s health. If you would like to describe your situation, you can use Kaddio’s protected form instead.

Before a question in your own words is sent, your browser runs a local check that may detect personal identity numbers, contact details or a personal description of health. The check can miss information and is therefore not complete protection. If a warning appears, you can edit your question, choose Kaddio or explicitly choose to send it anyway. If you send it anyway, that text is passed on to Vercel and Groq. Wording that appears to describe an urgent situation receives a fixed response with urgent contact options instead and is not sent to Groq.

The Groq account has Zero Data Retention enabled. According to Groq, questions and answers are then not kept in persistent storage for service reliability or abuse monitoring. Groq nevertheless uses an automatic prompt cache in volatile memory. It expires after two hours of inactivity, cannot be disabled and, according to Groq, is not shared between organisations. Technical usage metadata is always collected but, according to Groq, does not include the question or answer. Groq’s data processing agreement includes the EU’s standard contractual clauses for transfers to the USA.

The remaining problem lies in the part of the process handled by Vercel. The current Hobby plan is not covered by Vercel’s data processing agreement. That agreement, which applies to Pro and Enterprise, also prohibits sensitive personal data in customer data. The current AI process therefore does not have the contractual framework needed for personal health information. The local warning, the exclusion of conversation history and Groq’s Zero Data Retention reduce exposure but do not resolve the contractual issue.

Technical operation and protection against abuse

To protect the forms and AI assistant against automated requests, the website temporarily processes an IP address and timestamps. The information is held in memory in an active server function, normally for no more than an hour, and is not transferred to a separate database. Vercel may also process technical operational data in its US hosting environment.

Feedback on the assistant’s answers

Below each answer, you can give a thumbs up or down and, for a thumbs down, choose a predefined reason. Only the rating, a fixed response context and the chosen reason are then sent to me through Resend. Your question and the AI answer are not included in the feedback.

Labbet

In Labbet, you can leave structured feedback on an experiment. The experiment’s ID, a predefined rating and a predefined focus choice are then sent through Vercel and Resend to my inbox. The form does not ask for your name, email address or a comment in your own words.

Visitor statistics

The website uses Vercel Web Analytics for aggregated visitor statistics, such as page views, country and browser type. The service is cookieless, and the website does not place analytics cookies on your device.

Legal basis

Contact requests containing only ordinary contact details and other initial administration that does not concern healthcare, general questions to the AI assistant without sensitive personal data, technical operation, cookieless visitor statistics and structured website feedback are processed on the basis of legitimate interests. Those interests are to answer enquiries, manage initial contact, operate and protect the website and improve its content. Data is limited to what is needed for each purpose.

When a booking or contact concerns healthcare, the personal data needed for the contact, booking, patient administration and care is processed as a task carried out in the public interest under Article 6(1)(e) GDPR. Health data is processed under Article 9(2)(h) (IMY page in Swedish) and subject to professional confidentiality. Clinical record-keeping is also based on a legal obligation under Article 6(1)(c) GDPR and the Swedish Patient Data Act (SFS 2008:355).

The AI assistant is not intended for personal health information. If you send such information despite the warning, choosing to send it anyway does not in itself provide the basis required by Article 9 GDPR or resolve the contractual issue. This is the remaining gap in the AI process. Use Kaddio’s protected form if you would like to describe your own situation.

How long information is kept

A contact enquiry that does not lead to care is kept for up to twelve months after our last contact. The purpose is to follow up your enquiry and make it easier for you to get back in touch. The data is deleted earlier if it is no longer needed or if you request this, unless it must be retained for legal reasons.

Structured feedback from the AI assistant and Labbet is kept for up to twelve months to evaluate the website. The feedback message is then deleted.

If the contact leads to care, the twelve-month period does not apply. Information needed for patient administration, secure access and clinical record management may remain in Kaddio for as long as it is needed for those purposes. Clinical records are retained for at least ten years after the last entry. This also makes it possible to handle a previous care contact correctly if you choose to return.

Your rights

You can request access to, correction of or deletion of personal data, and object to certain processing. The rights that apply depend on the data and the legal basis. The possibility of deleting clinical records is limited by the Swedish Patient Data Act. Contact me at andreas@psykologlundin.se.

You can also lodge a complaint with the Swedish Authority for Privacy Protection, IMY (in Swedish) ↗.