This privacy policy describes how Portway (Solidary Solutions AB, "we") processes personal data: about you when you visit portway.se or contact us, and about the patients, participants and employees whose data a health or care provider handles in Portway.

Who is responsible for the data

For data a provider enters or collects through Portway (orders, bookings, health forms, sick leave), the provider is the data controller and Portway the data processor. Processing is governed by a data processing agreement between the provider and us, and the provider is your first point of contact about your data.

For data about you as a visitor to the website, a demo request or a message to us, Portway is the controller.

Information We Collect

We collect several types of information from and about users of our Services:

Personal data: name, e-mail address, phone number and, where a service requires it, personal identity number.
Health data: answers in health forms, test values the provider records, sick-leave information and the orders and bookings that concern you. These are processed only on behalf of your provider.
Technical data: IP address, browser and device in server logs, and cookie-free visit statistics. We use no tracking cookies.

How We Use Your Information

We may use the information we collect for various purposes, including:

To provide, maintain, and improve our Services.
To process and manage your bookings and appointments.
To communicate with you about your use of our Services, updates, and other information.
To improve our website, services, and user experience.
For security purposes and to detect fraud or illegal activities.

Data Sharing and Disclosure

We may share your personal information in the following situations:

With healthcare providers to facilitate your appointments and services.
With the providers (sub-processors) listed below, who process the data on our behalf and not for their own purposes.
To comply with applicable laws, regulations, or legal processes.
In connection with a business transaction such as a merger, acquisition, or sale of assets.

Sub-processors

Data is stored and processed within the EU. We use the following providers:

Vercel: the website and the app's interface, Stockholm.
Railway: API, database and uploaded files, within the EU.
Resend: e-mail delivery, such as booking confirmations and form invitations.
46elks: SMS reminders and invitations, Sweden.
Sentry: error reporting, EU (Germany). Personal data is masked before a report is sent.
Vercel Analytics: cookie-free visit statistics for the public website.

Data Security

All transmission is encrypted. Data is stored on encrypted disks at our providers, personal identity numbers are additionally encrypted at field level in the database, and access to health data is role-based and logged. No method of transmission or storage is entirely secure, but this is what we do and can show.

How long data is kept

Data a provider handles in Portway is kept for as long as the data processing agreement with that provider says, and is deleted or anonymised at the provider's request. In addition, fixed retention periods apply:

In-app notifications: 90 days after they are read, otherwise 365 days.
Form invitations that expired unanswered: recipient name and e-mail removed 90 days after the deadline.
Contact-form messages: 365 days.
Log of platform administrators' actions: 24 months.
Login links: 7 days after expiry.

Your Rights Under GDPR

You have the right to:

The right to access, update, or delete your personal information.
The right to rectification if your information is inaccurate or incomplete.
The right to object to our processing of your personal data.
The right to restriction of processing of your personal information.
The right to data portability.
The right to withdraw consent.

How to exercise your rights

Contact the provider that processes your data in Portway, or us at hej@portway.se. We can produce a complete copy of everything stored about an e-mail address, and delete or anonymise it, normally within 30 days. Form answers that are part of de-identified group statistics are kept without any link to you.

Cookies

The website sets no tracking cookies. The app uses the cookies needed to keep you signed in.

For more information about cookies, please see our Cookie Policy.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this Privacy Policy.

Contact Us

If you have questions about this privacy policy, contact us at hej@portway.se.