Privacy Policy

Norra Hamn Kliniken AB (org. no. 559249-4081), operating as Dibélle, is the data controller for personal data processed in connection with our operations.

Address: Kullagatan 40, 252 20 Helsingborg, Sweden

Phone: +46 76-209 34 43

Email: info@dibelle.se

Responsible person: Abir Mustafa, Licensed Nurse

We collect the following categories of personal data depending on how you interact with us:

Via the contact form:

• Name
• Email address
• Subject (optional)
• Message

Via the newsletter:

• Email address
• Date of consent

Via the AI chat (Dibélle AI, with your consent):

• Your messages and Dibélle AI's answers, with personal identity numbers, phone numbers and email addresses masked
• A shortened IP address, approximate country and region, device and browser
• A random chat key (not linked to identity)
• The page you are on

Via website visits (with analytics consent):

• IP address (anonymised by Google Analytics)
• Device and browser information
• Pages visited and interaction
• Approximate location (city level)
• A sessionStorage session key (deleted when the tab closes) used to group page views into a visit journey

With consent to marketing:

• The data sent to Meta, see the section on Meta

Via booking on Bokadirekt:

• Booking data is handled by Bokadirekt AB under their own privacy policy. We do not have access to your payment details.

For spam protection and rate limiting:

• Your IP address, when you submit a form, use a link in a text message or newsletter, or use the chat. It is stored in Upstash Redis (EU, Ireland) and deleted automatically about two hours after your latest request.
• When you search the site and in the visit statistics, the IP address is only counted in the server's working memory, in a window of at most one hour, and never stored in a database.

We process your personal data for the following purposes:

• Responding to enquiries (contact form). Legal basis: Legitimate interest in providing good customer service
• Managing bookings (via Bokadirekt). Legal basis: Performance of a contract
• Analysing website traffic (Google Analytics). Legal basis: Consent
• Improving website performance (Vercel Analytics). Legal basis: Legitimate interest (no cookies, no personal data)
• Answering questions in the AI chat and following up its quality (Dibélle AI). Legal basis: Consent
• Measuring and showing relevant ads on Facebook and Instagram (Meta). Legal basis: Consent
• Compliance with accounting law. Legal basis: Legal obligation

We never sell your personal data. Ad measurement with Meta only happens with your consent to marketing.

Providing personal data to us is voluntary. If you don't fill in the contact form or newsletter, you can still use the website and book via Bokadirekt. Contact form and newsletter are optional services.

To actually book a treatment, Bokadirekt (third party, separate data controller) needs certain data under contract.

Our website uses cookies and local storage (localStorage) in accordance with LEK (2022:482) Ch. 9 § 28 and the ePrivacy Directive (2002/58/EC) Art. 5(3). We divide them into four categories that you choose in our cookie banner:

Necessary (always active, no consent required):

• Consent setting: saves your cookie choice (localStorage, 6 months)
• Session data: AI chat during the current visit (sessionStorage, deleted when the tab is closed)
• AI chat consent: that you accepted the terms in the chat (localStorage, until you withdraw consent in the chat or clear your browser data)

Analytics (requires your consent):

• Google Analytics 4: measures website traffic and behaviour. Only activated after your consent via the cookie banner.

Functional (requires your consent):

• Chat history: saves your conversation with Dibélle AI for return visits (localStorage, 7 days)
• Treatment recommendations: aggregated anonymous data about which treatments visitors view is used to show recommendations

Marketing (requires your consent, off by default):

• Meta: measures our ads on Facebook and Instagram, see the section on Meta (cookies, 90 days)

You can change your choice at any time in the cookie settings, as easily as you gave it. The banner reappears after 6 months.

With analytics consent we use two tools:

Google Analytics 4 (Google Ireland Limited, processor):

• Measures page views, session length, device type, traffic source
• IP address is anonymised before reaching Google's servers
• Google Consent Mode v2: the service does not load at all until you give consent
• Data retention in GA4: up to 14 months

Microsoft Clarity (Microsoft Corporation, independent controller):

• Heatmaps and anonymised session recordings
• Microsoft acts as its own controller and may use the data for its own purposes per Microsoft's privacy statement (https://privacy.microsoft.com/privacystatement)
• Recordings automatically mask text and form fields
• Data retention: 30 days to 13 months depending on data type

Journey tracking: With analytics consent we pseudonymously log which pages you visit during the session and whether you click the booking button. Stored in Vercel logs per their default retention. Without consent the feature is fully disabled.

Without analytics consent none of these services are activated and no data is collected.

If you allow marketing in the cookie banner, we use the Meta pixel through Meta's Conversions API to measure how our ads on Facebook and Instagram perform and to show relevant ads. The category is off until you turn it on yourself, and without that consent nothing is sent to Meta.

Meta's own script is not loaded on the website. Events are sent from our server to Meta, and the address of the page you visit is always cut to dibelle.se alone. Names of treatments and medicines, the content of your messages and product names are never sent.

What data:

• Cookies: _fbp (a random browser ID), _fbc (the ad's click ID, if you came from an ad) and _meta_xid (our own random visitor ID)
• IP address and browser
• That you visited dibelle.se, and events: that you viewed a treatment or product, clicked through to book on Bokadirekt, sent a form, added something to the cart, went to checkout or bought something in the shop (with the order value, but not what you bought)
• When you send the contact form: your email address. When you buy in the shop: your email address and phone number. Both in hashed form (turned into a code that cannot be read directly). They are still personal data: Meta can match them against its own data and link the event to an account

The booking itself happens on Bokadirekt and is not visible to us. What we send to Meta is that you clicked through to book.

Legal basis and responsibility: Consent (GDPR Art. 6(1)(a) and LEK Ch. 9 § 28). Dibélle and Meta Platforms Ireland Ltd are joint controllers for the collection and transfer of the data to Meta (Court of Justice of the EU, case C-40/17 Fashion ID). Meta is independently responsible for its own processing after that, see Meta's privacy policy. How responsibility is divided between us and Meta is set out in Meta's Controller Addendum.

Transfer to the USA: Meta Platforms Inc. is certified under the EU-US Data Privacy Framework.

How long: _fbp, _fbc and _meta_xid are kept for 90 days and your choice (meta_consent) for 180 days. Meta keeps the data according to its privacy policy.

Withdrawing consent: It is as easy as giving it. Open the cookie settings and turn off Marketing. We then stop sending events and delete the cookies above. Processing that has already taken place is not affected.

Forms in ads: Data you send in a form in one of our ads on Facebook or Instagram is received by us and used only to contact you. Legal basis: your request and your consent when you send the form. We keep the data while your matter is ongoing, for at most 12 months.

Among other things, you have the right of access, rectification, erasure, restriction of processing and data portability. How to use them, and how to complain to IMY, is described in the sections Your rights and Complaints.

We share personal data with the following third parties (processors or separate controllers), to deliver our services and, with your consent, to measure our ads:

• Bokadirekt AB (Sweden): Booking platform. Separate controller.
• Resend Inc. (USA): Email delivery. Certified under EU-US Data Privacy Framework (2025) + SCCs. Data deleted within 90 days of termination.
• Vercel Inc. (USA): Web hosting and server logs. Certified under EU-US Data Privacy Framework since 2019 (active, re-certification due 2026-04-29) + SCCs. Sub-processors: AWS, Microsoft Azure, Google Cloud. Runtime logs retained a few days by default.
• Upstash Inc. (EU region, Ireland): Redis database. GDPR-compliant, DPAs with sub-processors. No transfer outside the EU.
• Provider of AI language models (data processor, servers in Singapore): Produces Dibélle AI's answers in the chat. Receives the chat content and the system prompt, with personal identity numbers, phone numbers and email addresses masked, but never your IP address. The provider's terms allow the content to be used for model training. We will tell you which provider it is if you ask at info@dibelle.se. The provider's general terms apply; there is not yet a separate data processing agreement (DPA) with it.
• Google Ireland Limited (Google Analytics 4, Google Maps): Google LLC is certified under EU-US Data Privacy Framework + SCCs. Requires consent.
• Microsoft Corporation (Clarity): Certified under EU-US Data Privacy Framework + SCCs. Microsoft acts as an independent controller for Clarity data. Requires consent.
• Cloudflare Inc. (USA): DNS and CDN. Certified under EU-US Data Privacy Framework + SCCs. Access logs up to 12 months.
• Meta Platforms Ireland Ltd (Facebook and Instagram): Ad measurement. Joint controller for the collection, independent controller after that. Meta Platforms Inc. is certified under the EU-US Data Privacy Framework. Requires consent.

We never sell your data. DPAs are in place with all other processors.

When you send a message via the contact form, we collect your name, email address and message. The data is used solely to respond to your enquiry.

The message is sent via Resend to our email. We do not store your data in any database, it exists only in our inbox.

Your IP address is stored in Upstash Redis (EU, Ireland) to prevent abuse (spam) and is deleted automatically about two hours after your latest request.

If you have allowed marketing, your email address is sent to Meta in hashed form, see the section on Meta. The message itself is never sent there.

We offer a voluntary newsletter via Resend. We use double opt-in: after signup we send a confirmation email you must click before being added. This fulfils the explicit consent requirement in the Swedish Marketing Act (2008:486).

• Legal basis: Consent (GDPR art. 6.1.a)
• What we store: Your email address and the date of consent (held by Resend as our processor)
• Unsubscribe: A one-click unsubscribe link appears at the bottom of every newsletter (RFC 8058). You can also email info@dibelle.se.
• Provider: Resend Inc. Data may be transferred to the USA under standard contractual clauses

If you have allowed marketing, Meta is told that someone signed up, but not your email address, see the section on Meta.

After a visit we may send you one text message with a link where you can leave a review on Google. We never send more than one message per number per day, and the message contains neither your name, the name of the treatment, nor anything else about your visit.

• Legal basis: Consent (GDPR art. 6.1.a and art. 9.2.a). You give it on the consent form at the clinic, and you may withdraw it at any time.
• Where the number comes from: Your mobile number is taken from our booking system Bokadirekt, where you entered it yourself when booking.
• What we store: Your mobile number, when a message was last sent, whether you followed the link, and whether you have unsubscribed. The data is stored with Upstash. We do not store which treatment you had alongside the number.
• If you follow the link: We can see that it was used, never what you write. A review on Google is yours alone and we can neither see nor influence it before it is published. Once you have followed it, we never ask you again.
• Unsubscribing: Every message carries a link that stops the messages immediately. You can also email info@dibelle.se. The number is then kept on a suppression list. That is the only way for us to know you must not be contacted.
• How long: The link in the message stops working after 180 days. The record of when we last messaged you is deleted after 90 days. The suppression is kept until you ask us to remove it.
• Provider: 46elks AB sends the message. They are a Swedish operator under the Electronic Communications Act (2022:482) and process the data in their own right, not as our processor. We ask them not to store the content of the message.
• No automated decisions: We ask everyone the same way. We never select who to ask based on how satisfied we think you are, and we offer nothing in return for a review.

Dibélle AI is the clinic's AI assistant. It answers questions about our treatments, prices and booking. It is not a human and never replaces a consultation. Before you can type in the chat, we ask for your consent.

Where your messages go: What you write is sent to a provider of AI language models (data processor) with servers in Singapore, which produces the answer. Personal identity numbers, phone numbers and email addresses are masked before the provider sees the text. The provider's terms allow the content to be used to improve their models. Singapore is outside the EU/EEA, and data protection there has not been assessed as equivalent to the EU's. See International data transfers.

What we store:

• Your messages and Dibélle AI's answers. Personal identity numbers, phone numbers and email addresses are masked before they are stored.
• The page you chatted from and its language
• A shortened IP address (IPv4 to /24, IPv6 to /48), approximate country and region, device type, browser and operating system, and the website you came from
• A random chat key in sessionStorage, which limits how many messages a session can send and is deleted when you close the tab
• The fact that you accepted the chat terms, in your browser's localStorage, so the box does not appear on every visit

The chat is stored in Upstash Redis (EU, Ireland) for up to 12 months for quality follow-up, troubleshooting and abuse detection, and is then deleted automatically. If you have accepted analytics cookies, questions and answers also go into a list that we use to improve our answers and treatment descriptions. The list keeps only the latest 500 questions, none of them for longer than 12 months; older ones are removed automatically.

Legal basis: Your consent (GDPR art. 6.1 a). Health details you choose to write in the chat are processed with your explicit consent (art. 9.2 a). We still ask you not to write personal identity numbers or health details. Your in-clinic consultation is covered by entirely separate confidentiality rules (Swedish Patient Data Act).

Withdrawal, access or deletion: You withdraw your consent with one click on Withdraw consent below the chat field. The chat is then deleted from your browser and the field is hidden until you accept the terms again. What you already wrote we delete on our side when you ask: email info@dibelle.se and say roughly when you chatted, so we can find the conversation. You can get a copy of it the same way. At the same address we will tell you which provider receives the chat messages.

Chat history in your browser (with functional consent): If you allow functional cookies, a copy of the conversation is stored in your browser's localStorage for up to 7 days so you can pick up where you left off. That copy exists only in your browser.

Aggregate analysis: The number of times a treatment is mentioned is aggregated in Upstash Redis to identify trending treatments, with no link to an individual user.

On our contact page, we display a Google Maps map to help you find the clinic. When the map loads, Google may collect your IP address and set cookies.

Read Google's privacy policy for more information: https://policies.google.com/privacy

Dibélle displays before and after photos on the website to illustrate treatment results. These images constitute special categories of personal data (health data) under GDPR art. 9.

• Legal basis: Explicit written consent (GDPR art. 9.2.a), collected separately from each patient on a dedicated consent form before publication
• Scope of consent: Each patient receives specific information about how, where and for how long the images are published
• Right to withdraw: You can request image removal at any time by emailing info@dibelle.se. Images are removed as soon as possible, within 14 days at the latest
• Storage: Original images are stored encrypted and are not shared with third parties beyond web publication

If you recognise yourself in a published image and have not consented, contact us immediately. This should not happen and we will fix it the same day.

When you actually receive a treatment from us, the Patient Data Act (2008:355) and the Aesthetic Surgery and Injection Treatments Act (2021:363) apply. We are then the controller of your patient record.

• Legal basis: Legal obligation (GDPR art. 6.1.c) and healthcare (art. 9.2.h)
• Record content: Anamnesis, treatment documentation, products and doses, follow-up
• Retention: 10 years from the last entry (Patient Data Act ch. 3 § 17)
• Confidentiality: Only licensed staff have access. Professional secrecy under the Patient Safety Act (2010:659)
• Supervision: The Health and Social Care Inspectorate (IVO)

This processing is fully separate from the website's data processing. The record is not handled via dibelle.se.

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you (GDPR art. 22).

Treatment recommendations shown in the AI chat are informational and never replace a personal consultation. No booking or treatment is approved automatically. Everything requires personal assessment by licensed staff.

• Contact form: Until your enquiry has been answered, plus 12 months for follow-up
• AI chat (Dibélle AI): Up to 12 months
• Booking details: Handled by Bokadirekt according to their policy
• Accounting records: 7 years under Swedish accounting law
• Google Analytics data: Maximum 14 months
• Forms in ads on Facebook and Instagram: While your matter is ongoing, at most 12 months
• Meta cookies (_fbp, _fbc, _meta_xid): 90 days
• Consent setting: 6 months (then the cookie banner reappears)

When the storage period expires, the data is deleted or anonymised.

Under GDPR, you have the following rights:

• Right of access: You can request to know what data we hold about you.
• Right to rectification: You can request that incorrect data be corrected.
• Right to erasure: You can request that your data be deleted, unless legal requirements prevent it.
• Right to restriction: You can request that we restrict the processing of your data.
• Right to data portability: You can request to receive your data in a machine-readable format.
• Right to object: You can object to processing based on legitimate interest.
• Right to withdraw consent: You can withdraw consent at any time without affecting the lawfulness of prior processing.

Contact us at info@dibelle.se to exercise your rights. We will respond to your request within 30 days.

Some service providers process data outside the EU/EEA:

• USA (Google, Vercel, Resend, Microsoft, Cloudflare, Meta): All are certified under the EU-US Data Privacy Framework, an EU Commission adequacy decision (July 2023) that makes the transfer safe without additional safeguards. We also have SCCs as a backup.
• Singapore (the AI language model provider behind Dibélle AI): No adequacy decision. The transfer takes place with your explicit consent in the chat (GDPR art. 49.1 a). Data protection there has not been assessed as equivalent to the EU's, and the chat's consent box links to this privacy policy before you accept. Personal identity numbers, phone numbers and email addresses are masked before the transfer.

If you don't want your chat sent to Singapore, use the contact form, phone or email instead.

We take appropriate technical and organisational measures to protect your personal data. All data traffic is encrypted with SSL/TLS. Access to personal data is limited to authorised personnel.

In the event of a personal data breach that poses a risk to your rights, we will notify you and the Swedish Authority for Privacy Protection (IMY) within 72 hours.

Dibélle does not perform treatments on persons under 18 years of age. We do not knowingly collect personal data from minors. If you are under 18, please do not submit personal information through our website.

If you believe that we are processing your personal data incorrectly, you have the right to file a complaint with:

The Swedish Authority for Privacy Protection (IMY)

Box 8114, 104 20 Stockholm, Sweden

Phone: +46 8-657 61 00

Email: imy@imy.se

Website: www.imy.se

We may update this privacy policy. In the event of material changes, we will inform you via the website. The date of the latest update is always stated at the top of the page.