Privacy Policy

1. Introduction

This Privacy Policy explains how Standard Medicine AB processes your personal data, what rights you have, and how you may exercise them under the General Data Protection Regulation (GDPR).

"Process" means any operation performed on personal data, such as collection, storage, organisation, transmission, or deletion. "Your data" means any information that directly or indirectly identifies you (e.g., name, profession, telephone number, email address).

Please read this Privacy Policy when you use our services or visit our website. For information about our services, see our Terms of Use.

2. We are responsible for your personal data

Standard Medicine AB (organisation number 559549-3403) is the controller of your personal data. Our registered office is located in Stockholm, Sweden.

3. Questions? We are here to help

If you have questions about how we process your personal data, please contact us at privacy@standardmedicine.com or by post to Standard Medicine AB, Skeppargatan 5, 114 52 Stockholm, Sweden.

Please direct any privacy questions or rights requests to privacy@standardmedicine.com.

To ensure that we comply with the GDPR and protect your data, we have appointed a Data Protection Officer (DPO). If you have any concerns or questions about how we handle your data, or if you wish to exercise your rights under the GDPR, please contact our DPO by sending an email to: privacy@standardmedicine.com.

4. Why and how do we use your personal data?

We process certain personal data to operate our business and to provide and improve our services. Below is an overview of what data we process, where it comes from, why we process it, how long we keep it (or the criteria used to determine that period), and the lawful basis relied upon.

Our service is not intended to process special categories of personal data (Article 9 GDPR). Users are instructed not to enter patient-identifiable information, and we employ measures designed to detect and reduce such data. As queries are free-text, we cannot fully prevent it.

5. Our use of your data

5.1 To operate the search service

Data processed:

• Submitted search queries and generated results

Note: Queries must be anonymous and devoid of patient identifiers (see sections 4 and 8).

Source: You.

Legal basis:

• Performance of a contract (Article 6(1)(b) GDPR).
• Legitimate interests (Article 6(1)(f) GDPR): to secure and optimise the service.

Storage period: Queries are held in pseudonymised form and retained only as long as necessary to operate and improve the service.

5.2 To provide our service to you

Data processed:

• Name
• Contact information (e.g., email, phone number)
• Usage data related to your use of our service (including technical/device information)
• Profession/confirmation of professional/student status
• Place of work

Source: You; technical service partners.

Legal basis:

• Performance of a contract with you (Article 6(1)(b) GDPR).
• Legitimate interests (Article 6(1)(f) GDPR): to maintain, secure, and improve our service. You may contact us to obtain a copy of our balancing test.
• Consent (Article 6(1)(a) GDPR), where applicable.

Storage period: For as long as necessary to deliver the service to you. For service development, for as long as necessary to obtain the information needed; we pseudonymise or anonymise the data as soon as practicable. For newsletters, until you withdraw your consent.

5.3 To market our services to you based on your interests

Data processed:

• Name
• Profession
• Place of work
• Contact information (e.g., email, phone number)

Source: You; analysis of user activity.

Legal basis: Consent (Article 6(1)(a) GDPR).

Storage period: For as long as necessary to provide the service and/or until you withdraw your consent.

5.4 To provide customer support

Data processed:

• Your queries and our responses regarding the service
• Contact information

Source: You; technical service partners.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Storage period: Until your request has been resolved.

6. Your rights

You may exercise any of your rights by emailing privacy@standardmedicine.com. We strive to enable you to exercise your rights efficiently.

Right to information (Art. 13)

Know how and why we process your data. This Privacy Policy fulfils that obligation.

Right of access (Art. 15)

Request a copy of the personal data we hold about you.

Right to rectification (Art. 16)

Have inaccurate or incomplete data corrected.

Right to erasure (Art. 17)

Request deletion where the data is no longer needed for its original purpose or another legal ground applies.

Right to restriction (Art. 18)

Ask us to restrict processing in certain circumstances.

Right to data portability (Art. 20)

Receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller.

Right to withdraw consent (Art. 7(3))

Withdraw consent at any time. Withdrawal affects future processing only.

Right to object (Art. 21)

Object to processing based on legitimate interests; we will stop unless we demonstrate compelling grounds. You always have the right to object to marketing.

No solely automated decision-making (Art. 22)

Not be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

7. Sharing your personal data

We share data with external partners acting as processors or controllers; a current list is available on request.

Newsletters

An EU email provider receives your name, email, profession, and workplace. Basis: consent.

AI and search

Language-model and ranking providers process your queries and chat history to generate results. Some processing occurs outside the EEA under Standard Contractual Clauses.

Hosting

Cloud and database providers store account details and chat history; the search index stays in the EU, and any transfers outside the EEA use Standard Contractual Clauses.

Statistics

PostHog (EU Cloud) receives usage data about how the service is used. Basis: legitimate interest, with a right to object (see section 9). Data is held in the EU.

Advertising

Where you consent to marketing cookies, Google Ireland Limited, Meta Platforms Ireland Limited, and LinkedIn Ireland Unlimited Company receive data about your visit, so we can measure our advertising and reach clinicians who may find the service useful. They act as independent or joint controllers for their own purposes, so their own privacy policies apply to what they do with it. Some processing occurs outside the EEA under Standard Contractual Clauses. Basis: consent. If you do not consent, no advertising provider receives anything.

8. Our security measures

We are committed to protecting your personal data and have implemented appropriate technical and organisational measures to safeguard it. Please also keep your password confidential and secure, and protect your devices.

Our service is intended for clinical questions only. Guidance at the query interface instructs users not to enter patient-identifiable information, and we employ filtering measures designed to detect and reduce such data.

9. Cookies and similar technologies

Cookies are small text files stored in your browser. We may also use similar technologies (e.g., local storage and pixels).

Cookies

Some cookies are needed for the service to work at all, and these are always on: signing you in, keeping your session secure, protecting against abuse, and remembering your language and display theme.

Statistics

We measure how Standard Medicine is used so we can improve it, using PostHog (EU Cloud). We ask before we store anything on your device for this.

If you accept, we set a statistics cookie so we can recognise your browser between visits. If you decline, or before you have answered, we measure without storing anything on your device. You can change your choice at any time under "Privacy settings" in the page footer, and we also honour the Global Privacy Control browser signal.

Marketing

We advertise Standard Medicine to clinicians, and we measure whether that advertising works. We ask before we store anything on your device for this.

If you accept, our advertising partners set cookies that let them recognise your browser, so we can see which ads led to a visit. If you decline, no advertising tag loads at all. Unlike statistics, there is no version of this that works without storing something, which is why declining here means off rather than reduced.

You can change your choice at any time under "Privacy settings" in the page footer, and we also honour the Global Privacy Control browser signal. Turning marketing off deletes the advertising cookies your browser lets us reach.

Security

Cloudflare Turnstile tells humans apart from bots. It is a security measure and runs whether or not you accept anything else.

Cookie register

Marketing tags are managed in a tag container rather than written into the site's code, so this register is reviewed whenever that container changes. You can also block or delete cookies via your browser settings, though this may affect how the service works.

10. If we do not keep our promise

If you have concerns about how we process your data, please contact privacy@standardmedicine.com. You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): imy@imy.se, or Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm. Further information: https://www.imy.se/

11. Changes to this Privacy Policy

We may update this Policy from time to time. Where changes affect our obligations or your rights, we will inform you in advance.

Last updated: 15 September 2026

Standard Medicine AB · Org. nr 559549-3403 · Stockholm, Sweden