Privacy Policy

Background

This Privacy Policy ("Policy") describes how Vilya Health AB ("Vilya Health", "we", "us"), corporate registration number 559593-5296, processes personal data. The Policy explains how we ensure that your personal data is collected, used, stored, protected and otherwise processed securely and in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable supplementary Swedish legislation (together, the "Data Protection Rules"). Vilya Health is the controller of the personal data processing described in this Policy.

Vilya Health treats all your personal data confidentially. Our licensed staff are bound by a statutory duty of confidentiality under the Patient Safety Act (2010:659).

Blood tests and other sampling are carried out by an external testing provider. Vilya Health receives your test results and uses them to provide individualized dietary and nutrition advice.

Definitions

In this Policy, "Personal Data" means any information relating to an identified or identifiable natural person, for example name, address, personal identity number, date of birth, payment card number, email address and telephone number.

"Special Categories of Personal Data" means Personal Data of a particularly sensitive nature, including data concerning health, such as blood test results and information about illness or dietary conditions related to health.

"Processing" means any operation performed on Personal Data, such as collection, recording, storage, use, transmission or erasure, in the manner described in this Policy.

Purposes of the Processing

Vilya Health processes Personal Data only for the specific purposes stated below. The overall purpose is to enable Vilya Health to offer its clients dietary and testing services. Personal Data is mainly processed in order:

  • to provide personalized services;

  • to communicate with customers;

  • to ensure and develop our service to customers;

  • to handle booking requests;

  • to administer customer activities and events;

  • to market our services and, where permitted, those of our partners;

  • for statistical purposes; and

  • to develop our business operations.

Categories of Personal Data we Process

‍Vilya Health processes Personal Data relating to our customers, prospective customers and partners. The Personal Data we may process includes:

  • name;

  • date of birth and personal identity number;

  • address;

  • telephone number;

  • email address;

  • customer number;

  • information concerning health, including blood test results and information about illness; and

  • information about special diets.

Personal Data may be provided to us directly by you when you interact with us or visit our website www.vilyahealth.com. Test results are received from the external testing provider that carries out and analyses your samples.

How Long is your Personal Data Stored?

Personal Data is stored only for as long as necessary to fulfil the purposes for which it was collected under this Policy.

  • Patient records: information covered by the record-keeping requirement in the Patient Data Act (2008:355), including health data and test results, is retained for at least 10 years after the last entry, as required by that Act.

  • Accounting records: information required under the Accounting Act (1999:1078) is retained for 7 years.

  • Other customer data: as a general rule, other Personal Data is not stored for more than 12 months after the end of the customer relationship.

Where necessary to comply with legal obligations or to establish, exercise or defend legal claims, we may retain Personal Data for a longer period. Personal Data is never stored for longer than is necessary or required by law for each purpose.

How do we Protect your Personal Data?

To protect your privacy and to detect, prevent and limit the risk of unauthorized access, misuse, disclosure, alteration and destruction, Vilya Health implements appropriate technical and organizational security measures, including access controls and secure storage of patient records in accordance with applicable healthcare legislation.

Your Rights

You have the right to receive information about our Processing of your Personal Data. Below is a summary of the rights you can exercise by contacting us. Contact details are provided at the end of this Policy. We will respond to your request without undue delay and at the latest within one month.

Right of Access

You have the right to request, free of charge, information about the Processing we carry out concerning your Personal Data and to receive a copy of the Personal Data we process about you. Please submit such a request in writing, specifying what information you wish to receive.

Right to Rectification

‍You have the right to have inaccurate Personal Data concerning you corrected without undue delay, and to have incomplete Personal Data completed. If you notify us that Personal Data you have provided is no longer correct, we will rectify it as soon as possible.

Right to Erasure

‍You have the right to request that Vilya Health erase your Personal Data without undue delay. Personal Data shall be erased in the following cases:

if the Personal Data is no longer necessary for the purposes for which it was collected;

  • if you withdraw your consent and the Processing is based solely on consent;

  • if the Processing is carried out for direct marketing and you object to it;

  • if you object to Processing based on a balancing of interests and your interests override ours;

  • if the Personal Data has not been processed in accordance with the Data Protection Rules; or

  • if erasure is required to fulfil a legal obligation.

Certain legal obligations may prevent us from immediately erasing all of your Personal Data. In particular, patient records must be retained under the Patient Data Act (2008:355), and accounting material under the Accounting Act (1999:1078). Where Personal Data cannot be erased for such reasons, we ensure that it is used only to comply with the relevant legal obligation and not for any other purpose.

Right to Restriction

‍You have the right to request that Vilya Health temporarily restrict the Processing of your Personal Data:

  • while we verify the accuracy of Personal Data that you consider inaccurate;

  • if the Processing is unlawful but you request restriction instead of erasure; and

  • if we no longer need the Personal Data for the purposes of the Processing, but you need it to establish, exercise or defend legal claims.

Right to Data Portability

Where we process your Personal Data on the basis of your consent or to perform a contract with you, and the Processing is carried out by automated means, you have the right to receive the Personal Data concerning you in a structured, commonly used and machine-readable format. Where technically feasible, you also have the right to have the Personal Data transmitted directly to another controller.

‍Right to Object

‍You have the right to object to Processing based on Vilya Health's legitimate interests. If you object, we will only continue the Processing if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. If you object to Processing for direct marketing, we will always cease such Processing without exception.

Right to Withdraw Consent

Where Processing is based on your consent, you have the right to withdraw that consent at any time by contacting us.

Right to Lodge a Complaint

You have the right to lodge a complaint concerning our Processing of your Personal Data with the Swedish supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). Read more at www.imy.se.

Sharing of Personal Data

To fulfil our obligations to you and to provide our services, Vilya Health shares your Personal Data with certain selected recipients, such as:

  • our external testing provider, which carries out sampling and analysis of blood and other samples;

  • suppliers of IT, hosting and journal-system services;

  • payment and accounting service providers; and

  • public authorities, where required by law.

Where a recipient processes Personal Data on our behalf, we enter into a data processing agreement in accordance with Article 28 GDPR and take technical and organizational measures to ensure that the Personal Data is handled securely and in accordance with this Policy. We do not sell your Personal Data.

Transfers Outside the EU/EEA

Vilya Health processes and stores all Personal Data within the EU/EEA, and no Personal Data is transferred to countries outside the EU/EEA. Should this change in the future, we will ensure that an adequate level of protection is guaranteed, for example through an adequacy decision by the European Commission or the European Commission's standard contractual clauses, and we will update this Policy accordingly.

Cookies

Our website www.vilyahealth.com uses cookies and similar technologies. Information about which cookies we use, their purposes and how you can manage them is provided in our separate cookie notice on the website.

Amendments to this Policy

Vilya Health may update or amend this Policy from time to time. The latest version is always available on our website. In the event of material changes that affect you, we will inform you, for example by email or through a notice on the website.

‍How to Contact Us

If you have any questions regarding this Policy or our Processing of your Personal Data, or wish to exercise your rights, please contact us at gayanenutrition@gmail.com. Our mailing address is Bodalsvägen 12, 181 36 Lidingö, Sweden.

Last updated: July 20th, 2026