Privacy Policy | Neko Health

Privacy Notice

Published on 1 June 2026

General information about our services

Neko Health UK Limited (registration no. 15233974) ("NHUK") and our wholly owned clinics in the UK (as detailed here) (each a "Neko Clinic") are committed to the protection of your personal data. NHUK is a subsidiary of Neko Health AB, a Swedish company with registration number 5591705396 ("Neko Health"). Neko Health, NHUK and their respective subsidiaries are collectively referred to as the "Neko Group", "we" and "us".

We value your privacy and are committed to keeping you informed and confident about how we process your personal data. This privacy notice explains what personal data we collect and process about you, why we do it, how we use the personal data, and the measures we take to ensure compliance with applicable laws. Please contact us if you have any questions about our data practices using the contact details provided in the "Contact" section at the end of this notice.

How we collect your personal data

General

Primarily, we collect your personal data from you directly when you seek proactive healthcare, for example when you book a medical examination in the patient application, provide information to a healthcare professional or undergo a medical examination or when you visit the website. We may also collect personal data from third parties like wearables, smart watches and health monitoring platforms (such as Apple Health) ("Third-Party Services") where you have chosen to connect and import data from such sources.

If referred to us by your employer (e.g. as a benefit included with your employment) or another third party, we collect your personal data from them, including your name, identification number, contact details, and a brief description of the referral purpose.

Communicating and coordinating with other healthcare providers

If you visit a Neko Clinic, we may need to communicate about your care with other healthcare providers outside of the Neko Group, such as your NHS GP. We will always seek your consent before doing this. Examples of where we may ask you for permission to communicate with other healthcare providers include where your Neko scan identifies a new diagnosis, or a known condition that needs more optimal treatment. With your consent, other healthcare providers may also share your personal data with us.

Personal data we use in our operations

We collect and use the following categories of personal data about you:

Audio: such as your voice in a voice recording.
Communication data: such as contact details e.g. email address, telephone number, country and region, your preferences for digital newsletters and other marketing communications, and, where applicable, communications made with you, including information provided by you in your contact with our customer support.
Chat history: Your questions to Neko's health chat, the responses it generates, and your ratings of the chat's responses.
Data on lifestyle: such as whether you smoke, use snus, drink alcohol, or other information related to your behaviour.
Demographic data: such as your age, gender, and heritage.
Health data: such as skin conditions, blood pressure, bloodworks, pulse wave data, biochemical data, medical history, medical condition, and medication.
Biometric data: such as physical characteristic (e.g. facial images taken by Neko Health's medical equipment), and physiological characteristics (e.g. data related to your body such as bone density and organ size) that allow for unique identification of you.
Identity data: such as name, personal identification number, claim number and consents given.
Patient records: such as notes and comments about your health status.
Payment information: such as bank and account details, payment details.
Physical characteristics: such as your height, weight, and skin type.
Picture material: such as images of you, taken by Neko Health's medical equipment.
Technical data: such as data about your use of the patient application, the type of device you have used, online identifiers such as IP, MAC addresses and cookies, login details, referral traffic, domain name and time or equivalent provided by you as a website visitor.
Transcripts and summaries: transcripts of your conversation with our medical professionals or support team and summaries of such information.
Third-Party Data: such as activity, steps, heart rate, heart rate variability, sleep, blood oxygen saturation, respiratory rate, body temperature and similar metrics, which you have chosen to import from Third-Party Services.

When and why we process your personal data

The Neko Clinic's use of your data

Health screening with equipment and tools provided by Neko Health

Who is responsible: Neko Clinic processes personal data to: (i) organise and present information for our staff for efficient care, (ii) conduct and administer booked examinations and communicate with you, including to send you post consultation surveys, via email, sms and notifications, (iii) prepare automatically generated summaries of your doctor consultations, (iv) displaying results and insights in the patient application.

If you have given your consent, the personal data will be shared with Neko Health for testing and tool and product development (see below and separate information here).

What we do: Neko Clinic processes personal data from your booking and health examination to deliver, manage and ensure and improve quality of the healthcare services, generate statistics and to fulfil the obligation to keep records and other obligations under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.

Categories of personal data:

Audio
Communication data
Data on lifestyle
Demographic data
Health data
Biometric data
Identity data
Patient records
Physical characteristics
Picture material
Third-Party Data
Transcripts and summaries

Legal basis: Public interest (Article 6(1)(e) and, if special categories of data are processed, Article 9(2)(h)).

The obligation to keep records is based on a legal obligation (Article 6(1)(c) and Article 9.2(h) of the UK GDPR).

Retention period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, personal data is saved for this purpose for eight (8) years from the visit. The summaries in relation to your healthcare consultation are kept for as long as you have an account in the patient application or until you have requested that the data is deleted, whichever comes first.

Sharing your personal data with other healthcare providers on your request or in case of an in-depth health examination

Who is responsible: Neko Clinic is responsible for sharing your personal data for this purpose.

What we do: If you have given your explicit consent, Neko Clinic will share your personal data with the healthcare provider of your choice, for example to enable it to conduct an in-depth health examination and to display results and insights related to you in the patient application.

Neko Clinics may share your personal data with one another, for example if you book an appointment at one Neko Clinic but conduct the examination at another Neko Clinic. If these Neko Clinics are located in different countries, this will involve transferring your data across borders.

When you give your consent, you also authorise Neko Clinic to share your patient data in accordance with the rules on confidentiality under applicable law.

Categories of personal data:

Demographic data
Health data
Biometric data
Patient records
Physical characteristics
Picture material

Legal basis: Consent (Article 6(1)(a) of the UK GDPR): the use of your personal data for the above purposes is based on your consent or public interest (Article 6(1)(e) of the UK GDPR and, if special categories of data are processed, Article 9(2)(h)). Explicit consent (Article 9(2)(a) of the UK GDPR). Special categories of personal data (such as information about your health) will only be used for the above purposes based on your explicit consent.

Please note that where we rely on your consent as the lawful basis of the processing, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Retention period: Personal data is saved for this purpose until the disclosure to the other healthcare provider has been completed and as otherwise required by law or necessary for the establishment, exercise or defence of legal claims.

Share your personal data with Neko Health for Neko Health's testing and tool and product development and/or use of the AI Health Chat

Who is responsible: Neko Clinic is responsible for sharing your personal data for these purposes.

What we do: If you have given your explicit consent, Neko Clinic will share your personal data with Neko Health for it to (i) conduct tests, develop and improve healthcare equipment, and enhance the tool for generating automated summaries of your healthcare visits, and (ii) provide you with the AI Health Chat. For clarity, separate consents are obtained for each of the abovementioned purposes.

When you give your consent to the abovementioned purposes, you also authorise Neko Clinic to share your patient data in accordance with the rules on confidentiality under applicable law.

Categories of personal data:

Audio
Demographic data
Health data
Biometric data
Patient records
Physical characteristics
Picture material
Transcripts and summaries

Legal basis: Consent (Article 6(1)(a) of the UK GDPR): the use of your personal data for the above purposes is based on your consent that you provide separately in the patient application.

Explicit consent (Article 9(2)(a) of the UK GDPR). Special categories of personal data (such as information about your health) will only be used for the above purposes based on your explicit consent that you provide separately in the patient application.

Please note that you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Retention period: Personal data is saved for this purpose until the disclosure to Neko Health has been completed and as otherwise required by law or necessary for the establishment, exercise or defence of legal claims.

Neko Health's use of your data

Patient application

Who is responsible: Neko Health is the data controller for personal data processed in the patient application, including when you book a health examination. The Neko Clinic performing the health examination is responsible for processing of your personal data related to the visit.

What we do: Neko Health's patient application enables registration of a user account, setting up a profile and the health examination bookings. We verify your identity via an ID verification service, create your profile for the examination, and manage your booking, payment and profile. Furthermore, we allow you to choose which Neko Clinic you wish to use and share this information with the Neko Clinic conducting your examination.

Categories of personal data:

Demographic data
Identity data
Payment information
Physical characteristics
Communication data

Legal basis: Fulfilling obligations under a contract with the data subject (Article 6(1)(b) of the UK GDPR). The use of your personal data for the above purposes is necessary to conclude the contract for provision of the health examination.

Retention period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, personal data is saved for this purpose for 24 months from your last visit to the Neko Clinic and/or use of the patient application (whichever is later) that can be attributed to the same case/care.

Third-Party Services

Who is responsible: Neko Health is the data controller for personal data processed as part of features allowing you to import data from Third-Party Services.

What we do: Neko Health's patient application enables you to import personal data from Third-Party Services for the purpose of displaying it alongside your Neko Body Scan results in the app and maintain and ensure the proper functioning of the feature, and to make it available to medical staff within the Neko Health group involved in your care.

Categories of personal data:

Activity
Steps
Heart rate and heart rate variability
Sleep
Blood oxygen saturation
Respiratory rate
Body temperature
Other data you have chosen to import

Legal basis: Consent (Article 6(1)(a) of the GDPR); the use of your personal data for this purpose is based on your consent that you provide separately through the patient app when connecting with the specific Third-Party Service.

Explicit consent (Article 9(2)(a) of the GDPR). Special categories of personal data (such as information about your health) will only be used for the above purposes based on your explicit consent that you provide separately in the patient application.

Please note that you have the right to withdraw your consent at any time.

Retention period: Personal data is saved for this purpose for as long as your account remains active or until you withdraw your consent.

AI Health Chat

Who is responsible: Neko Health is the data controller for personal data processed in connection with the AI Health Chat.

What we do: If you allow the AI Health Chat to access your information, the feature will process your personal data to respond to your questions and support your understanding of your health information. Moreover, your chats as well as reviews you may provide (thumbs up/thumbs down) will be processed to maintaining context within and across conversations (so the chat can refer to what has previously been discussed), to ensure the feature functions properly and to help us understanding how it can be improved. Note that the AI Health Chat is provided for informational and educational purposes only. It does not constitute medical advice, diagnosis, or treatment recommendations and is not a medical device under medical device law. It is not a substitute for a consultation with a qualified healthcare professional.

Categories of personal data:

Data on lifestyle
Demographic data
Health data
Identity data
Patient records
Physical characteristics
Picture material
Transcripts and summaries
Third-Party Data

Please note that you have the right to withdraw your consent at any time.

Retention period: Personal data is saved for this purpose for as long as your account remains active or until you withdraw your consent.

Testing and development of medical devices

Who is responsible: Neko Health is the data controller and is responsible for personal data processed for the testing and development of medical devices.

What we do: If you have given your explicit consent, Neko Health will use your personal data to conduct tests to develop, improve and optimise the medical equipment offered to you at the Neko Clinic.

Categories of personal data:

Data on lifestyle
Demographic data
Health data
Biometric data
Patient records
Physical characteristics
Picture material
Transcripts and summaries

Legal basis: Consent (Article 6(1)(a) of the UK GDPR): the use of your personal data for the above purposes is based on your consent that you provide separately through the patient app when activating AI Health Chat in the app.

Explicit consent (Article 9(2)(a) of the UK GDPR). Special categories of personal data (such as information about your health) will only be used for the above purposes based on your explicit consent.

Please note that you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Retention period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, personal data will be saved for this purpose during product testing and until the development related to such testing has been completed. In practice, this is normally for a period of 24 months from your last visit to the clinic and/or use of the patient application that can be attributed to the same matter/healthcare for which you provided your consent (whichever is later). At the end of the 24-month period, we will no longer use your personal data for this purpose, unless you provide a renewed consent following the same procedure as above.

Furthermore, Neko Health will pseudonymise your personal data (i.e., your personal data will be replaced by a pseudonym or similar) to the extent possible during the test period and take measures to ensure that picture material are not displayed together with other information that can directly identify you.

Reports and statistics at aggregated level (which do not contain any personal data) will be kept indefinitely.

Testing and development of tools

Who is responsible: Neko Health is the data controller and is responsible for personal data processed for testing and development of tools.

What we do: If you have given your explicit consent, Neko Health uses your personal data to develop and improve tools, including AI-based ones, that enhance healthcare professionals' work and which adds value and insights for you. Such tools may fully or partially include elements of AI. For example, Neko Clinic provides automated summaries of your healthcare visits, generated by an AI model, the AI health chat and third-party integrations, delivered via the patient app.

Categories of personal data:

Audio
Data on lifestyle
Demographic data
Health data
Biometric data
Patient Records
Physical characteristics
Picture material
Transcripts and summaries
Third-Party Data
Chat history
And other information that you share during your healthcare consultation

Please note that you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Retention period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, personal data is saved for this purpose during the development process. In practice, this is normally for a period of three (3) months to three (3) years from your last visit to the clinic.

Furthermore, Neko Health will pseudonymise your personal data (i.e., your personal data will be replaced by a pseudonym or similar) to the extent possible during the development period, and take measures to ensure that picture material are not displayed together with other information that can identify you directly.

Reports and statistics at aggregated level (which do not contain any personal data) will be kept indefinitely.

Marketing of our services and other communications

Who is responsible: Neko Health is the data controller for the processing of your personal data for the purpose of marketing our services.

What we do: We may contact you via email, sms or notification to market our services if you have been in contact with us to enquire about our services via the patient application or Website (e.g., started but did not complete your booking) or you consent to us contacting you via email and text to market our services to you (e.g., if you join the waitlist on our Website). We may also follow up on your booking using customer surveys.

Categories of personal data:

Identity data
Technical data
Communication data

Legal basis: Legitimate interest (Article 6.1(f) of the UK GDPR and Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR)). The use of your personal data is necessary to fulfil Neko Health's legitimate interest in marketing our services and our business improvement purposes where you have used our services or have been in contact with us enquiring about our services. Neko Health considers that our legitimate interest outweighs your interest in not having your personal data processed for this purpose.

Consent (Article 6.1(a) of the UK GDPR and Regulation 20 of PECR). The use of your personal data for the above purposes is based on your consent where you agree to us contacting you via email and text to market our services to you (e.g., if you join the waitlist on our website).

Please note you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Retention period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, we keep your data for this purpose for up to twelve (12) months from your last visit to the Neko Clinic and/or use of the patient application (whichever is later).

Neko Health, NHUK's and the Neko Clinics use of your data

Internal development purposes

Who is responsible: Neko Health, NHUK and the Neko Clinic are respectively data controllers and are responsible for the processing of your personal data necessary for the development of our respective activities and services.

What we do: We use your personal data, if necessary, to develop our own businesses.

Categories of personal data:

Identity data
Technical data
Demographic data

In general, only aggregated and statistical information is used for this purpose.

Legal basis: Neko Health: Legitimate interest (Article 6(1)(f) of the UK GDPR): The use of your personal data is necessary to fulfil our legitimate interest in developing our activities and services. We consider our legitimate interest outweighs your interest in not having your personal data processed for this purpose.

Neko Clinic: Public interest (Article 6(1)(e) and, if special categories of data are processed, Article 9(2)(h)).

Retention period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, personal data is saved for this purpose until the personal data has been anonymised or aggregated.

Clinical studies

Who is responsible: Neko Health or NHUK (depending on the applicable entity that is sponsoring or conducting the clinical study) is the data controller for the processing of your personal data in connection with clinical studies in which you participate.

What we do: Your personal data may be used in clinical studies as part of research projects aimed at promoting innovation. The studies are self-funded or funded partially or wholly by third parties and conducted by doctors in collaboration with other leading clinics and institutions. Your personal data used in the context of the clinical studies is pseudonymised, i.e., your name, personal identification number and other identifiable information will be replaced by a code number.

Categories of personal data:

Data on lifestyle
Demographic data
Health data
Biometric data
Patient records
Physical characteristics

Legal basis: Research task in the public interest (Article 6(1)(e) of the UK GDPR) with the underlying task defined in the relevant clinical study. The use of your personal data for the above purposes is based on the public interest of the studies.

General interest in the field of public health (Article 9(2)(i) of the UK GDPR). Special categories of personal data (such as information about your health) are used on the basis that the studies fulfil a general interest in the field of public health.

Retention period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, personal data is saved for this purpose for ten (10) years from the end of the study.

Transfers of shares and similar

Who is responsible: Neko Health, NHUK and the Neko Clinic may, in limited cases, transfer your personal data as described below. The recipient is the data controller for its own collection and use of personal data, unless otherwise specified.

What we do: In the event of a transfer of shares, business transfer, merger, capital raising or similar, we will, if necessary, transfer your personal data to buyers, potential buyers, investors and external advisors.

Categories of personal data:

Technical data
Demographic data
Relevant categories of personal data necessary to fulfil a share transfer or similar.

Legal basis: Legitimate interest (Article 6(1)(f) of the UK GDPR): The use of your personal data is necessary to fulfil our legitimate interest to sell shares/operations or merge operations. We consider that our legitimate interest outweighs your interest in not having your personal data processed for this purpose, if the buyer is engaged in the same or similar type of business.

Retention period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, personal data is saved for this purpose until the transfer of shares or similar has taken place.

Asserting and defending legal claims

Who is responsible: Neko Health, NHUK and the Neko Clinic are respectively data controllers and are responsible for the processing of your personal data that is necessary to assert and defend legal claims.

What we do: We use, if necessary, your personal data to manage, defend and exercise legal claims and rights, or in connection with, any legal proceedings (including prospective legal proceedings) e.g., in connection with a dispute or court proceedings. For this purpose, we may share your data with counterparties, external advisors and authorities.

Categories of personal data:

Health data
Biometric data
Payment information
And other information that you share during your healthcare consultation
Relevant categories of personal data necessary for the management, defence and exercise of legal claims or rights in the specific case.

Legal basis: Legitimate interest (Article 6(1)(f) of the UK GDPR): The use of your personal data is necessary for our legitimate interests in managing, defending and enforcing legal claims and rights. It is our assessment that our legitimate interest outweighs your interest in not having your personal data processed for this purpose.

Establishment, exercise and defence of legal claims (Article 9(2)(f) of the UK GDPR). Special categories of personal data (such as information about your health) will only be used for this purpose if it is necessary for the establishment, exercise and defence of legal claims or in connection with, any legal proceedings (including prospective legal proceedings) or for the purpose of obtaining legal advice.

Retention period: Personal data will be saved for this purpose until the completion of the product testing and development work (as further described in the testing and product development section above), or such longer period as necessary to manage and defend legal claims or disputes arising during such 24-month period.

Your documented consent, including your name, will be saved until the completion of the product testing and development, and thereafter for a further period of six (6) years to manage, defend and exercise legal claims and rights.

Regulatory compliance

Who is responsible: Neko Health, NHUK and the Neko Clinic are respectively data controllers and are responsible for the processing and is the data controller for your personal data that is necessary to fulfil our respective company's legal obligations.

What we do: We will, if necessary, use your personal data to fulfil our legal obligations, e.g., to comply with data protection obligations regarding data subjects' rights or to comply with accounting obligations.

Categories of personal data:

Relevant categories of personal data necessary to fulfil the legal obligation.

Legal basis: Legal obligation (Article 6(1)(c) of the UK GDPR). Your personal data is used for the above purposes to fulfil a legal obligation.

Establishment, exercise and defence of legal claims (Article 9(2)(f) of the GDPR) if special categories of personal data are processed.

Retention period: Personal data is saved for such period that is necessary for us to fulfil the specific legal obligation.

Who we share your data with

We only share your data if it is necessary for us to provide our services or as otherwise explained in this privacy notice. We do not share or sell your personal data for commercial purposes.

Other healthcare providers

If you visit a Neko Clinic, we share your personal data through our system with other healthcare providers with your explicit consent or as otherwise required by law.

Within the Neko Group

We may share your personal data within the Neko Group. How and why we share your data is explained above.

Suppliers

We share your personal data with suppliers who process it on our behalf as data processors to provide services to us. We remain responsible for the processing of your personal data. Suppliers are not allowed to use your personal data for their own purposes, and they are contractually and legally obliged to protect it and are bound by confidentiality.

We transfer personal data to the following categories of providers: (1) Customer support platform providers (2) Identification services (3) IT service providers (4) Providers of marketing communications (5) External advisors such as law firms. In addition, we work with the payment service provider Stripe, who primarily process personal data on our behalf as a data processor but which also processes personal data for certain purposes, including regulatory compliance purposes as a data controller. Learn more in the Stripe Privacy Center.

Co-operation partners

Neko Health and NHUK may from time-to-time conduct or participate in clinical studies (for example, if a medical device is not yet medically authorised). In such cases, if you wish to participate in such clinical studies, you will be asked whether you wish to provide your informed consent. In such cases, this means that your data will be shared with the parties conducting the studies together with us (i.e., other leading clinics and institutions).

Other disclosures

We may share your personal data to meet legal obligations on the Neko Clinic as a healthcare provider. For instance, we may need to provide patient records to the Care Quality Commission (CQC) or other authorised bodies for supervision purposes or other regulatory bodies or to our insurance company if you report an injury directly to them.

If you have been referred to us by your employer (e.g. as a benefit included with your employment), or another third party, we may share anonymised and aggregated data with the relevant third party to enable them to understand the population-level health of the people who have had a Neko scan, without allowing them to identify individual people from the results. For example, we may disclose the percentage of people with high blood pressure from a sufficiently large enough cohort of people, but we would not tell them who has high blood pressure.

If you are prescribed medicines in connection with your visit to us, information about the prescription is transferred to our electronic prescription provider so that they may either dispense medication to you, or facilitate the dispensing of medication at a pharmacy of your choice.

Where we process your data

Your personal data may be transferred to and processed in countries outside the UK (third countries), including to the countries where Neko Group operates. In such cases we will not transfer or process personal data outside the United Kingdom, nor will we permit personal data to be transferred or processed outside the United Kingdom, unless it is under one or more of the following conditions:

the territory into which the data are being transferred is covered by UK adequacy decisions or a mechanism such as the UK extension to the EU-US Data Privacy Framework;
the transfer is made under the standard contractual clauses issued by the Information Commissioner under section 119A(1) Data Protection Act 2018 for example, the International Data Transfer Agreement (IDTA) which is a standard contract that safeguards transfers of personal data from the UK to a third country and / or the International Data Transfer Addendum (Addendum) which is an addendum to the new standard contractual clauses issued by the European Commission;
the transfer is made under the provision of binding corporate rules; and
the transfer is made in accordance with one of the derogations set out in the UK GDPR and Data Protection Act 2018.

We also implement additional technical and organisational security measures where necessary.

For more information on these safeguards or to obtain a copy of such safeguards, please contact us.

Your rights

You have specific rights regarding your personal data. We aim to respond to your request within one month of receipt. For complex or multiple requests, we may need extra time and will inform you of the reasons for any delay. If we cannot fulfil your request, we will inform you and explain why.

To process your request, we must verify your identity to, for example, prevent unauthorized access or incorrect data erasure. If needed, we may request additional, reasonable information to confirm your identity. The response period begins once your identity is verified.

For more details on your rights, visit the relevant supervisory authority's website such as the United Kingdom's Information Commissioner's Office (ICO) at www.ico.org.uk.

Right of access ("Data subject access")

You have the right to receive confirmation whether we process your personal data and, if so, to receive a copy of it along with details on how we use it, provided this does not harm others' rights and freedoms. In your request, please specify if you want particular data, such as a specific type or from a certain period.

Right to rectification

You have the right to request correction or completion of inaccurate, incomplete, or misleading personal data. After updating your data, we will notify recipients we have shared it with, unless this is impractical or overly burdensome. Upon request, we will inform you about who received your data.

Right to withdraw your consent

You have the right to withdraw your consent for us to process your personal data at any time by changing your account settings in the patient application or contacting us by using the contact details below. This will not affect processing already done based on your prior consent.

Right to erasure ("Right to be forgotten")

You can request the erasure of your personal data in certain cases. For example, when we no longer need it for its original purpose, or if you object to its use of your personal data under Article 21 of the UK GDPR, and we lack compelling reasons to continue processing. However, there are exceptions to this right, for example if we are legally required to retain your data or need it for legal claims.

Right to object to our use of your personal data

In certain situations, you have the right to object to our use of your personal data. When we rely on legitimate interest (Article 6(1)(f) of the UK GDPR) you have the right to object to the use for reasons relating to your specific situation. If we cannot justify continued use, we will stop processing your data for that purpose. However, we may still use it if needed for legal claims.

Right to request the restriction of your personal data

In certain situations, you can request restriction of your personal data, which means that you can, at least for a certain period, request that we limit our use of it. This right applies in the following cases: (a) when you believe your data is inaccurate and while we verify this; (b) its use is unauthorized, but you prefer we store it rather than erase it; (c) if we no longer need it for the purpose for which we collected it, but you require it for legal claims; or (d) where you have objected under Article 21 of the UK GDPR while we evaluate our reasons. If restricted, we may only store your data and use it for legal claims.

Data portability

You have the right to data portability, allowing you to receive a copy of personal data you provided us in a structured, common format. If technically feasible, you can request direct transfer to another recipient. This right applies only to data processed based on your consent or a contract.

Automated individual decision-making

We do not carry out automated individual decision-making that has legal consequences for you or similarly affects you.

Right to lodge a complaint

If you are unhappy or have questions about how we handle your personal data, please contact us to resolve the issue together. You can also file a complaint with the ICO (website www.ico.org.uk/make-a-complaint, address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF and Helpline number: 0303 123 1113) or the supervisory authority in your country of residence, workplace, or where you believe a data protection violation occurred.

Right to compensation

If you have suffered material or immaterial damage because we have processed your personal data in breach of the UK GDPR, you have the right to claim damages.

Specific rights under applicable law

If you object to your personal data being made available by electronic access to the staff of another healthcare provider or with another healthcare process within the Neko Group, you have the right to request blocking of your data in certain cases.

You also have the right to receive information from us about the direct access and electronic access about you that has taken place.

For further information, please refer to the specific information provided by each Neko Clinic.

Contact us

If you have any questions about this information, our use of your personal data or if you wish to exercise your rights, please contact us by email at dpo@nekohealth.com or by post at the following addresses:

The Neko Clinics

Please refer to the list of the Neko Clinics and their contact details here.

Neko Health AB

Postal address: Svärdvägen 19, 182 33 Danderyd, Sweden

Neko Health UK Limited

Postal address: 44 Whitfield Street, London, United Kingdom, W1T 2RH

Notice updates

We periodically update this privacy notice to reflect changes in how we use personal data, such as collecting new data, using data for different purposes, or sharing it with additional recipients. The date of the last update to this notice is shown at the top of the privacy notice. For substantive changes, we will notify you in advance and explain the impact.