Privacy information
This page describes how personal data is processed when you visit the website, when you contact Polaris Psykoterapi through Kaddio’s secure contact form or by email, and when a care relationship begins.
Data controller and contact
Polaris Psykoterapi AB, company registration number 559579-1905, is the controller for the processing described on this page.
Visiting address: Stora Nygatan 40, first floor, 211 37 Malmö. Postal address: Stora Nygatan 40, 211 37 Malmö.
Enquiries about care and appointments are primarily sent through Kaddio’s secure contact form on the contact page. Questions about privacy and about your rights are sent to info@polarispsykoterapi.se. Ordinary email offers a lower level of protection and must not contain your personal identity number, medical records or other information about your health. Loopia provides the domain and ordinary email.
What is processed and why
When you visit the website. Necessary technical data is processed so that the website can be delivered and protected, for example IP address, browser and device information, time stamps and technical error logs, to the extent the hosting provider needs them for operation and security.
When you use the secure contact form. Kaddio processes the information you choose to provide in the form, for example your name, contact details and the content of your message. Your message may contain information about your health if you choose to provide it. A submitted enquiry creates a client record in Kaddio so that the enquiry can be received and administered. The information is sent directly to Polaris Psykoterapi’s protected environment in Kaddio. The content of the message is not sent to Lovable, to any Lovable backend or to any database belonging to the website.
When you make contact by ordinary email. The information you choose to provide is processed, for example your name, contact details and the content of your message, in order to answer and administer your enquiry. Ordinary email must not contain your personal identity number, medical records or other information about your health.
When a care relationship begins. Identity and contact details, patient records and treatment information are processed, together with the payment, invoicing and administrative data required.
Legal bases
General contact enquiries are processed on the basis of legitimate interests under Article 6(1)(f) GDPR. The legitimate interest is being able to answer and administer enquiries.
Processing within healthcare is based on a task carried out in the public interest under Article 6(1)(e) and on legal obligation under Article 6(1)(c), depending on the purpose of the processing.
Health data necessary for care and for keeping patient records is processed under Article 9(2)(h), subject to statutory professional secrecy. If an initial enquiry contains health information, and that information is necessary in order to assess or provide care, Article 9(2)(h) applies to that processing as well. Kaddio’s form contains a mandatory approval checkbox. The checkbox does not change the legal bases stated here; the processing does not rely on consent as a general legal basis.
Accounting and other statutory financial documentation is processed under Article 6(1)(c).
Recipients and processors
Loopia provides the domain and ordinary email. Lovable is the technical hosting platform for the website. Kaddio is the data processor for the contact form and, once a care relationship begins, also for patient records, secure communication, invoicing and patient administration.
Information may be disclosed to public authorities or other recipients where required by law or where necessary for the provision of care. Personal data is not sold.
Kaddio and subprocessors
Kaddio processes the information in the contact form as a data processor on behalf of Polaris Psykoterapi. When a care relationship begins, Kaddio is also used for patient records, secure communication, invoicing and patient administration. Kaddio may engage subprocessors for technical functions. Kaddio’s published list is available through the link below.
Retention and deletion
Contact enquiries that do not lead to care are kept in Kaddio’s active environment only for as long as needed to answer and administer the enquiry. They are then deleted. If a care relationship begins, only the information needed for care, patient records and patient administration is retained or carried forward.
Ordinary email messages are deleted from the active mailbox when they are no longer needed. Deletion from an active environment does not necessarily mean immediate erasure from the provider’s backups.
Patient records are kept for at least ten years after the last entry, as required by the Swedish Patient Data Act. Accounting and invoicing records are kept for as long as applicable law requires.
Security and website technology
The website uses no database of its own, no analytics tools, no pixels and no non-essential cookies, and Polaris’ own application stores no cookies, no localStorage and no sessionStorage beyond the necessary key the router uses for scroll restoration.
The website’s technical delivery layer sets the necessary __cf_bm security cookie. Cloudflare uses it to identify and mitigate automated traffic. The cookie is not associated with a user ID in Polaris’ own application and expires after 30 minutes of inactivity.
The contact pages embed Kaddio’s external contact form. When a contact page is opened, the browser connects to Kaddio. Kaddio and its technical suppliers may then process the technical data needed to deliver, protect and troubleshoot the form, for example IP address, browser and device information, time stamps and technical error logs. They may also load technical resources, such as fonts and scripts, and use browser storage where required for the form’s function and security. Other external links are loaded only after an active click.
Access to patient data is restricted through individual authorisations, and the data is protected in transit and at rest. Ordinary email offers a lower level of protection and should therefore only be used for questions that do not concern your health.
Your rights and complaints
Where the conditions are met, you have the right to receive information and a copy of your data, to request rectification, to request erasure or restriction of processing, and to object to processing based on legitimate interests or on a task carried out in the public interest.
Some rights may be limited. Information held in a patient record and other statutory retention cannot, for example, be erased on request.
Questions and requests are sent to info@polarispsykoterapi.se. If you consider that your personal data is being processed unlawfully, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection, imy.se.
Last updated
Last updated: 2 September 2026