Privacy Policy

1. Introduction

This Privacy Policy explains how Standard Medicine AB processes your personal data, what rights you have, and how you may exercise them under the General Data Protection Regulation (GDPR).

"Process" means any operation performed on personal data, such as collection, storage, organisation, transmission, or deletion. "Your data" means any information that directly or indirectly identifies you (e.g., name, profession, telephone number, email address).

Please read this Privacy Policy when you use our services or visit our website. For information about our services, see our Terms of Use.

2. We are responsible for your personal data

Standard Medicine AB (organisation number 559549-3403) is the controller of your personal data. Our registered office is located in Stockholm, Sweden.

3. Questions? We are here to help

If you have questions about how we process your personal data, please contact us at [email protected] or by post to Standard Medicine AB, Skeppargatan 5, 114 52 Stockholm, Sweden.

Please direct any privacy questions or rights requests to [email protected].

To ensure that we comply with the GDPR and protect your data, we have appointed a Data Protection Officer (DPO). If you have any concerns or questions about how we handle your data, or if you wish to exercise your rights under the GDPR, please contact our DPO by sending an email to: [email protected].

4. Why and how do we use your personal data?

We process certain personal data to operate our business and to provide and improve our services. Below is an overview of what data we process, where it comes from, why we process it, how long we keep it (or the criteria used to determine that period), and the lawful basis relied upon.

Our service is not intended to process special categories of personal data (Article 9 GDPR). Users are instructed not to enter patient-identifiable information, and we employ measures designed to detect and reduce such data. As queries are free-text, we cannot fully prevent it.

5. Our use of your data

5.1 To operate the search service

Data processed:

• Submitted search queries and generated results

Note: Queries must be anonymous and devoid of patient identifiers (see sections 4 and 8).

Source: You.

Legal basis:

• Performance of a contract (Article 6(1)(b) GDPR).
• Legitimate interests (Article 6(1)(f) GDPR): to secure and optimise the service.

Storage period: Queries are held in pseudonymised form and retained only as long as necessary to operate and improve the service.

5.2 To provide our service to you

Data processed:

• Name
• Contact information (e.g., email, phone number)
• Usage data related to your use of our service (including technical/device information)
• Profession/confirmation of professional/student status
• Place of work

Source: You; technical service partners.

Legal basis:

• Performance of a contract with you (Article 6(1)(b) GDPR).
• Legitimate interests (Article 6(1)(f) GDPR): to maintain, secure, and improve our service. You may contact us to obtain a copy of our balancing test.
• Consent (Article 6(1)(a) GDPR), where applicable.

Storage period: For as long as necessary to deliver the service to you. For service development, for as long as necessary to obtain the information needed; we pseudonymise or anonymise the data as soon as practicable. For newsletters, until you withdraw your consent.

5.3 To market our services to you based on your interests

Data processed:

• Name
• Profession
• Place of work
• Contact information (e.g., email, phone number)

Source: You; analysis of user activity.

Legal basis: Consent (Article 6(1)(a) GDPR).

Storage period: For as long as necessary to provide the service and/or until you withdraw your consent.

5.4 To provide customer support

Data processed:

• Your queries and our responses regarding the service
• Contact information

Source: You; technical service partners.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Storage period: Until your request has been resolved.

6. Your rights

You may exercise any of your rights by emailing [email protected]. We strive to enable you to exercise your rights efficiently.

Right to information (Art. 13)

Know how and why we process your data. This Privacy Policy fulfils that obligation.

Right of access (Art. 15)

Request a copy of the personal data we hold about you.

Right to rectification (Art. 16)

Have inaccurate or incomplete data corrected.

Right to erasure (Art. 17)

Request deletion where the data is no longer needed for its original purpose or another legal ground applies.

Right to restriction (Art. 18)

Ask us to restrict processing in certain circumstances.

Right to data portability (Art. 20)

Receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to withdraw consent (Art. 7(3))

Withdraw consent at any time. Withdrawal affects future processing only.

Right to object (Art. 21)

Object to processing based on legitimate interests; we will stop unless we demonstrate compelling grounds. You always have the right to object to marketing.

No solely automated decision-making (Art. 22)

Not be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

7. Sharing your personal data

We share data with external partners acting as processors or controllers; a current list is available on request.

Newsletters

An EU email provider receives your name, email, profession, and workplace. Basis: consent.

AI and search

Language-model and ranking providers process your queries and chat history to generate results. Some processing occurs outside the EEA under Standard Contractual Clauses.

Hosting

Cloud and database providers store account details and chat history; the search index stays in the EU, and any transfers outside the EEA use Standard Contractual Clauses.

Analytics

PostHog (EU Cloud) receives usage data about how the service is used. Basis: consent. Data is held in the EU.

Advertising

Where you consent to marketing cookies, Google Ireland Limited, Meta Platforms Ireland Limited, and LinkedIn Ireland Unlimited Company receive data about your visit so we can measure our advertising and reach clinicians who may find the service useful. These providers act as independent or joint controllers for their own purposes; see their own privacy policies. Some processing occurs outside the EEA under Standard Contractual Clauses. Basis: consent. If you do not consent, no advertising provider receives anything.

8. Our security measures

We are committed to protecting your personal data and have implemented appropriate technical and organisational measures to safeguard it. Please also keep your password confidential and secure, and protect your devices.

Our service is intended for clinical questions only. Guidance at the query interface instructs users not to enter patient-identifiable information, and we employ filtering measures designed to detect and reduce such data.

9. Cookies and similar technologies

Cookies are small text files stored in your browser. We may also use similar technologies (e.g., local storage and pixels).

Categories

• Necessary: required for the service to work. Signing you in, keeping your session secure, protecting against abuse, and remembering the choices you have made about how the service looks and what language it speaks.
• Statistics: measure how the service is used so we can improve it.
• Marketing: measure our advertising and reach people who may find the service useful.

Legal basis and consent

Necessary cookies are permitted without consent under the EU ePrivacy rules. Statistics and Marketing cookies are used only with your consent (Article 6(1)(a) GDPR). We do not set them until you have made a choice, and you may withdraw consent at any time without affecting the lawfulness of processing before you did.

We treat your language, display theme, and sidebar state as Necessary rather than optional. They are set by us alone, contain no identifier, cannot be used to recognise you, and exist only so the interface behaves the way you left it.

Consent management

We display a cookie banner on your first visit offering "Accept all", "Reject all", and "Customise". Accept and reject are given equal prominence and take the same single click. Nothing in the Statistics or Marketing categories loads until you choose, and choosing "Reject all" means none of it ever loads.

A "Cookie settings" link is available at any time from the sidebar menu, the page footers, and your account preferences. It lets you change or withdraw consent per category. We also honour the Global Privacy Control browser signal: if your browser sends it, we record a rejection and do not show you the banner.

We keep a record of the consent decisions made, so that we can demonstrate consent as required by Article 7(1) GDPR. That record stores the categories chosen, when, which version of this policy was shown, and the device or account it applies to. It does not store your IP address.

Third parties

Statistics. We use PostHog (EU Cloud) to measure product usage. Data is held in the EU and reaches PostHog through our own domain. Privacy policy: https://posthog.com/privacy

Marketing. Where you consent, we use Google Ads, Meta, and LinkedIn to measure our advertising and build audiences. These providers may transfer data outside the EEA under Standard Contractual Clauses, and act for their own purposes as well as ours. Privacy policies: Google, Meta, LinkedIn

We also use Cloudflare Turnstile to tell humans from bots. It is a security measure, is classed as Necessary, and runs whether or not you consent to anything else.

Cookie register

We also store the following in your browser's local storage. None of it is sent to anyone, and all of it is Necessary in the sense above: it only remembers choices you have made in the interface.

We keep this register updated as our use of cookies changes. You can also block or delete cookies via your browser settings, though this may affect how the service works.

10. If we do not keep our promise

If you have concerns about how we process your data, please contact [email protected]. You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): [email protected], or Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm. Further information: https://www.imy.se/

11. Changes to this Privacy Policy

We may update this Policy from time to time. Where changes affect our obligations or your rights, we will inform you in advance.

Last updated: 9 September 2026

Standard Medicine AB · Org. nr 559549-3403 · Stockholm, Sweden