Privacy Policy

Last updated: 31 August 2026. This page reproduces Evira's privacy policy in full. Download the policy as a PDF.

1. PURPOSE

1.1 Personal data means any information that can be directly or indirectly linked to a living natural person ("Personal Data"). This Policy describes how Personal Data and information about you may be used and disclosed, and how you may access this information when you use our Services.

2. INTRODUCTION

2.1 At Evira ("Evira", "we" or "us"), we value your privacy and are committed to processing your Personal Data securely and confidentially.

"Evira Group" means Evira AB together with the group companies listed in Section 5, "Legal entities and contact details")

2.2 We provide a website ("Website") containing public information about our services, Evira's mobile application for the treatment of patients with obesity ("App") and a care portal for use by healthcare professionals ("Care Portal").

Evira is the controller when Evira determines the purposes and essential means of the processing. For processing in the context of healthcare, the allocation of responsibilities in Section 2.3 applies.

The Website, App and Care Portal are collectively referred to as the "Services" or "Service".

"User" means a person who visits the Website or uses the App or Care Portal.

2.3 Evira's Services are used, among other things, to provide and support healthcare.

When healthcare is provided within the Evira Group in Sweden, the care is provided by For Life Academy AB ("FLA"), which is a registered healthcare provider and is subject to supervision by the Swedish Health and Social Care Inspectorate (Inspektionen för vård och omsorg, IVO). FLA provides healthcare only in Sweden. When the Services are used by an external healthcare provider, in Sweden or in other countries, the care is provided by that external healthcare provider.

"Healthcare Provider" means the legal entity that provides healthcare to you: FLA when the care is provided within the Evira Group in Sweden, and the external healthcare provider when the Services are used for care provided by an external healthcare provider.

The Healthcare Provider is the controller for processing carried out for the purposes of assessing, planning, providing, documenting and following up care. Evira processes Personal Data on behalf of the Healthcare Provider as a processor, in accordance with the Healthcare Provider's documented instructions and the applicable data processing agreement pursuant to Article 28 of the General Data Protection Regulation (GDPR).

2.3.1 Sensitive personal data means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and Personal Data concerning health or sex life ("Sensitive Personal Data"). Health data may, for example, include health status, medical appointments and treatments.

2.3.2 Information collected about the User's physical health may be analysed together with any additional information entered through forms or by clinical staff in order to create a more comprehensive picture of the User's health status. This may, for example, involve risk assessments relating to the development of different associated diseases or an assessment of which interventions are most likely to lead to sustainable long-term results.

This processing may be carried out by Evira on behalf of the Healthcare Provider and therefore in accordance with the Healthcare Provider's instructions to Evira.

2.4 This Privacy Policy ("Privacy Policy" or "Policy") describes how Personal Data is processed when you, as a User, visit the Website or use the App or Care Portal, as well as the rights that may apply to you. The scope of the Policy is set out in Section 3.

2.5 If you have any questions about our processing of your Personal Data, you can always contact us. Information about us and our contact details can be found in Section 5, "Legal entities and contact details" below.

3. SCOPE OF THE PRIVACY POLICY

3.1 The Privacy Policy describes the processing of Personal Data through the Services both when Evira is the controller and when Evira processes Personal Data on behalf of a Healthcare Provider. For processing in the context of healthcare, the

allocation of responsibilities in Section 2.3 applies.

The Privacy Policy does not replace the information about the Healthcare Provider's processing of Personal Data that the Healthcare Provider is responsible for providing.

3.2 This Privacy Policy applies to Users of the Services.

3.3 The App may contain links to other websites that are not operated by Evira. If you click on a third-party link, you will be directed to that third party's website or service. We strongly recommend that you review each link you visit to determine whether an applicable privacy policy is available. Evira has no control over, and is not responsible for, third-party links or services. This Privacy Policy does not apply to your use of or access to third-party services.

4. INFORMATION ABOUT THE PROCESSING OF PERSONAL DATA

4.1 This Privacy Policy is provided to inform you about how Personal Data is processed. The Privacy Policy does not in itself constitute consent to the processing of Personal Data and does not mean that processing based, for example, on a legal obligation, contract or legitimate interest is dependent on your acceptance of the Policy.

If a particular processing activity requires your consent, such consent will be obtained separately. You will then have the right to withdraw your consent in accordance with applicable data protection legislation.

5. LEGAL ENTITIES AND CONTACT DETAILS

5.1 If you have questions about this Privacy Policy or Evira's processing of Personal Data, you can contact us using the details below.

The following legal entities within the Evira Group may be involved in providing the Services:

Evira AB, company registration no. 559252-8995, provides Evira's technical platform and other services within the EU/EEA.

Evira Ltd, company registration no. 15159570, provides Evira's services in the United Kingdom.

Healthcare provider within the Evira Group in Sweden: For Life Academy AB, company registration no. 559088-7823,

Questions specifically concerning For Life Academy AB's processing of patient and healthcare data may be sent to info@forlifeacademy.com.

Questions concerning the processing of patient and healthcare data should primarily be directed to the Healthcare Provider. The identity of the Healthcare Provider is described in Section 2.3.

Data Protection Officer: dataprotection@evira.se

Email: info@evira.se

6. UPDATES TO THE PRIVACY POLICY

6.1 Evira reserves the right to revise the data protection statement. The date of the most recent amendment is stated at the beginning of the Privacy Policy. If Evira makes material changes to the data protection statement, we will publish the changes at: https://www.evira.se/documents/integritet.

Users are encouraged to review the Privacy Policy regularly to remain informed of any changes.

6.2 We will notify you electronically of significant changes where appropriate or required by applicable law. The updated Privacy Policy applies from the date specified in the Policy. If a change to the processing requires renewed consent or another action from you, this will be handled separately before the relevant processing begins.

7. LANGUAGES OF THE PRIVACY POLICY

7.1 The Privacy Policy is available in English and other languages. For other languages, we use machine translation from Swedish. Machine translations may not always produce perfect results, so in the event of a dispute concerning interpretation, the Swedish source-language version shall prevail. Please note that no potential dispute regarding provisions will be interpreted to the detriment of the consumer within the meaning of applicable law.

8. GENERAL INFORMATION ABOUT PERSONAL DATA PROCESSED IN THE SERVICES

8.1 For clarity, we provide a summary of the Personal Data that Evira processes as controller and as processor. A detailed description of the different data categories follows in Section 9.

In the table, "Healthcare Provider" means For Life Academy AB when the care is provided within the Evira Group in Sweden, and the external healthcare provider when the care is provided externally, in accordance with Section 2.3.

Where the Healthcare Provider is the controller, the Healthcare Provider is responsible for determining the applicable legal basis and, in relation to Sensitive Personal Data, the applicable exception under Article 9 GDPR for the Healthcare Provider's processing.

9. CATEGORIES OF PERSONAL DATA PROCESSED IN THE SERVICES

We process different categories of Personal Data about you. Each category of data is explained below:

9.1 Integration Data: We may process data that you provide to us through integrations with our Services (e.g. Apple Health or similar services). If you allow it, we may, for example, track your daily number of steps in the App and make this information available to the Healthcare Provider.

Evira processes this data on the basis of instructions in a data processing agreement with the controller pursuant to Article 28 GDPR.

You can enable this data collection in the App. If you choose to do so, this data is collected in the App and made available to the Healthcare Provider.

9.2 Demographic Data: We may process demographic information that may include, but is not limited to, your name, telephone number and email address. The collection of this demographic data is primarily used to provide the Services to App users and Care Portal users.

Evira processes this data on the basis of instructions in a data processing agreement with the controller pursuant to Article 28 GDPR.

9.3 Medical Data: We may process information about your health status, including, but not limited to, age, sex, weight, height, medical history, symptoms and communication between patients and healthcare providers. We collect this information in order to provide you with the Services and to provide the Healthcare Provider with the information required to provide medical treatment through the Services.

Evira processes this data on the basis of instructions in a data processing agreement with the controller pursuant to Article 28 GDPR.

The Healthcare Provider determines how long patient and healthcare data is to be retained in accordance with applicable healthcare and patient data legislation. Evira stores and deletes such data in accordance with the Healthcare Provider's instructions and applicable legal requirements.

9.4 Website Data: When you visit our Website, we may process information about how you access the Website, including information about your operating system, IP address, network identifiers and website data. Personal Data is processed so that we can improve the user experience and analyse use of the Website. Please

see our Cookie Policy for information about how we use cookies.

The legal basis for Evira's processing is Article 6(1)(f) GDPR. The legitimate interest is to analyse use of the Website and develop it further.

9.5 Account Data: If you create an account in the Services, we may collect your email address and telephone number, as well as technical or other information from you through the Services. This information will be used to provide your account in the Services and will enable you to log in and customise settings for the Services.

The legal basis for Evira's processing is Article 6(1)(f) GDPR. The legitimate interest is to provide you with access to the Services and to communicate with you about news and updates relating to the Services.

The data is obtained directly from you when you create your account in the Services. The data is processed from the time you create your account until you delete your account.

9.6 Support Data: If you contact us for support or to submit a complaint, we may collect technical, troubleshooting or other information from you through log files and other technologies, some of which may qualify as Personal Data (e.g. IP address). This information will be used for troubleshooting and technical support in accordance with this Privacy Policy.

The legal basis for Evira's processing is Article 6(1)(f) GDPR. The legitimate interest is to provide you with assistance when you use the Service and to further improve the Services.

Data is obtained directly from you or in connection with your actions in the Services. We will never ask you for your login credentials, financial information or medical information. Never provide such information outside the Services.

From the time you contact us about a support matter until the matter is resolved, the primary purpose of the data processing is to provide you with support. Once the issue has been resolved or archived, the data is processed for secondary archiving purposes. The secondary purposes are to verify the quality of the services provided to you and to investigate, establish or resolve legal claims. After the account has been deleted, we process this information for up to 24 months for these purposes. The recipients of this data may only be authorised employees or contractors providing services to us who are subject to strict confidentiality obligations.

9.7 Service Data: When you use the Services, we may process service data including, but not limited to, your IP address, device information, location, browser type, internet service provider, system configuration information, and date and time stamps for your actions in the Services. This information is used to provide the Services to you, analyse overall trends in use of the Services, help resolve technical issues and improve the Services over time. Without this data, we cannot fulfil our obligations and cannot provide the Services.

We do not monitor the activity of specific users of the Services, except for technical support as described above. Service Data is based on statistical patterns that do not depend on the activities of individual users.

The legal basis for Evira's processing is Article 6(1)(f) GDPR. The legitimate interest is to process data containing logs that may later be used to provide technical support, inform decisions about service design and software development.

The data is obtained directly from you when you use the Services. The data is processed for the period during which we provide the Services to you and for 36 months thereafter in order to handle any complaint and warranty matters.

9.8 Legal Data: We also process Personal Data in order to comply with our legal obligations when providing the Service. This includes processing that is necessary for us to fulfil our legal obligations under statutory requirements, judgments or authority decisions (e.g. accounting legislation).

The legal basis for Evira's processing is Article 6(1)(c) GDPR. We may retain Personal Data for this purpose for a period of up to seven years.

9.9 Information Data: We may collect your email address, name and other relevant contact details in order to send general news, updates and information about Evira, including new features, services or events that we believe may be of interest to you.

The legal basis for Evira's processing is Article 6(1)(a) GDPR, i.e. your consent. You have the right to withdraw your consent at any time, which you can do by changing your account settings or clicking an unsubscribe link in our communications.

9.9.1 Statistical Data: Evira processes aggregated data about Users' use of the Services. This data does not constitute Personal Data because it is anonymised, meaning that we do not process any data that can link the readings we collect to you or any other User. This data enables us to carry out analyses and, on that basis, create

statistics that allow us to group information and use it for various purposes, such as the development of services, materials and publications.

10. RECIPIENTS OF PERSONAL DATA AND TRANSFERS OUTSIDE THE EU/EEA

10.1 Evira engages IT service providers within the EU/EEA to maintain the Service and store Personal Data. When Personal Data is transferred to a third country (i.e. a country outside the EU/EEA), Evira takes appropriate measures to ensure that the transfer is carried out in accordance with applicable data protection legislation. This includes approved transfer mechanisms under Chapter V GDPR, such as standard contractual clauses, adequacy decisions and supplementary safeguards.

11. RIGHTS OF REGISTERED USERS

11.1 As a User, you have the right to:

(i) request information about which Personal Data we process about you and request a copy of that data (right of access);

(ii) have inaccurate Personal Data corrected and, in certain cases, ask us to erase Personal Data;

(iii) object to certain processing of Personal Data and request restriction of the processing of Personal Data;

(iv) receive the Personal Data that you have provided to us and have it transferred to another controller (right to data portability), and

(v) If you are dissatisfied with how we process your Personal Data, you may lodge a complaint with the relevant data protection supervisory authority.

11.2 Users may request access to, erasure of, or restriction of the processing of Personal Data for which Evira is the controller by sending a support message through the Service or using the contact details in Section 5.

Where your request concerns patient or healthcare data, it should primarily be directed to the Healthcare Provider; the identity of the Healthcare Provider is described in Section 2.3. Evira assists the Healthcare Provider in accordance with the applicable data processing agreement and may forward a request received by Evira.

Certain patient and medical record data must be retained under applicable healthcare legislation. A request for erasure therefore does not automatically mean that such data can or must be erased.

If the processing of Personal Data is restricted, or data that is necessary to provide a Service is erased, this may mean that the Service can no longer be provided in whole or in part.

12. SECURITY

12.1 Evira has implemented appropriate technical and organisational measures to protect Personal Data against loss, misuse, unauthorised access, disclosure, alteration and destruction. To ensure that Personal Data is processed securely and confidentially, we use industry-standard technology, including TLS and token-based authorisation, to restrict access to data and protect against intrusion.

All access to administrative and clinical accounts with access to user data requires two-factor authentication (BankID or equivalent solutions). More information about Evira's security measures for the processing of Personal Data is available in Evira's Data Security Standards Policy.

When Evira acts as a processor, Evira also implements the technical and organisational security measures required by the applicable data processing agreement with the Healthcare Provider.

12.2 Because access to Personal Data is provided after login, it is important that Users choose a secure password so that no one else can access the information. Because the email address is used for communication, it is important that the User protects it with a secure password and informs us immediately if the User loses control of it.

Also read our Cookie Policy, about Evira or contact us via our contact page.