Testing and Development Privacy Notice

We need your personal data for testing and product development

Neko Health AB (“Neko Health,” “we,” or “us”) — the Sweden-based parent company of the Neko Health group — and its affiliated professional entity Neko Health P.A. dba Neko Medical Health (“Neko Health Medical”) are committed to protecting your personal data. Neko Health Medical operates private healthcare clinics in the US (each a “Neko Clinic” and together the “Neko Clinics”).

What we collect and why

With your explicit consent, Neko Clinic shares your personal data — including identity data, demographic data, physical characteristics, picture material, health data, biometric data, patient records and Ask Neko AI chat data — with Neko Health so it can conduct tests and develop, improve and optimise the medical equipment and technology offered to you at the Neko Clinics.

Your rights

You can withdraw your consent at any time, and you have rights to access, rectify, erase, restrict, object to, and receive a copy of your personal data.

Contact

We need your personal data for testing and product development

Introduction

Neko Health AB (“Neko Health”, “we” or “us”) – the Sweden based parent company of the Neko Health group – and its affiliated professional entity Neko Health P.A. dba Neko Medical Health (“Neko Health Medical”) are committed to protecting your personal data. Neko Health Medical operates private healthcare clinics in the US (each a “Neko Clinic” and together the “Neko Clinics”). We take measures to ensure that your personal data is protected when we use your personal data and that the use of your personal data complies with applicable data protection laws and regulations, including the General Data Protection Regulation (“GDPR”).

We describe in this document how we collect, use and share your personal data for the purposes of product development. You also find information on which rights you have in relation to your personal data.

Personal data means any information that directly or indirectly identifies you, for example your name, a picture of you or other information about your health status.

Processing means any action taken (normally electronically) with regards to your personal data, for example collection, structuring, storage and disclosure.

Who is covered by this information

This information covers you as a patient who is visiting the Neko Clinics which, as part of providing you medical care, are each using equipment (such as scanners) provided by Neko Health.

Responsibility for the use of your personal data

Neko Clinic and Neko Health each act as separate data controllers

Neko Clinic and Neko Health are each responsible (as separate data controllers) for their own use of your personal data as described below, unless stated otherwise.

Personal data that we collect

We collect and use the following categories of personal data about you:

Identity data in order to document your given consent, which includes your name and personal identity number.
Demographic data, such as your age and sex.
Physical characteristics, such as your height, weight and skin type.
Picture material which includes pictures of you taken by Neko Health's medical equipment as part of you receiving medical care at Neko Clinic.
Health data relating to you, e.g. skin conditions, pulse wave data, blood pressure, biochemical data, medical history, medical condition and medication taken.
Biometric data such as physical characteristics like facial images taken by Neko Health's medical equipment, and physiological characteristics like data related to your body, e.g. bone density, that allow for unique identification of you.
Patient records concerning you, which may e.g. include notes and comments about your health status by healthcare professionals at Neko Clinic.
Third party patient records, such as second opinions and referral data received from third parties such as referral partners.
Ask Neko AI chat data, such as your input and output data, reviews and feedback and data about the performance of the Ask Neko AI chat.

Sources from which we collect personal data

Neko Clinic

Neko Clinic will collect your personal data directly from yourself when you seek medical care, e.g. when you disclose information to the healthcare professional (in writing or orally) or as a result of medical examinations (e.g. when using Neko Health's medical equipment). It may also include third party patient records.

Neko Health

Provided that you give your explicit consent (as further described below), Neko Health will receive your personal data as necessary from Neko Clinic, and will use it along with the data it already holds as a controller (e.g. the Ask Neko AI chat data) to carry out tests and product development.

Use of your personal data by each Neko Clinic

Neko Clinics each separately use your personal data for the following purposes.

Share your personal data with Neko Health for Neko Health's testing and product development

Who is responsible: Neko Clinic is responsible for sharing your personal data for this purpose.

What we do: If you have given your explicit consent, Neko Clinic will share your personal data with Neko Health for it to conduct tests, develop and improve healthcare equipment, and enhance the tool for generating automated summaries of your healthcare visits. When you give your consent, you also authorise Neko Clinic to share your patient data in accordance with the rules on confidentiality under applicable law.

Categories of personal data:

Audio
Demographic data
Health data
Biometric data
Patient records
Physical characteristics
Picture material
Third party patient data

Legal basis: Consent (Article 6.1 (a) of the GDPR). The use of your personal data for the above purpose is based on your given consent. Explicit consent (Article 9.2 (a) of the GDPR). Any special categories of personal data (such as information relating to your health) will only be used for the above purpose based on your explicit consent. Please note that where we rely on your consent as the lawful basis of the processing, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Retention period: Personal data is saved for this purpose until the disclosure to Neko Health has been completed and as otherwise required by law or necessary for the establishment, exercise or defence of legal claims.

Neko Health's use of your personal data

Testing and development of medical devices

Who is responsible: Neko Health is the data controller and is responsible for personal data processed for the testing and development of medical devices.

What we do: If you have given your explicit consent, Neko Health will use your personal data to conduct tests to develop, improve and optimise the medical equipment offered to you at the Neko Clinic.

Categories of personal data:

Data on lifestyle
Demographic data
Health data
Biometric data
Patient records
Physical characteristics
Picture material
Third party patient data
Ask Neko AI chat data

Storage period: Unless necessary for the establishment, exercise or defence of legal claims or required by law, personal data is stored for this purpose until the development work relating to the technology and equipment has ended. In practice, this normally is for a period of 24 months from your last visit to the relevant Clinic and/or use of the patient application (whichever is later) relating to the same matter/care as when you provided your consent. At the end of the 24-month period, we will no longer use your personal data for this purpose, unless you provide a new consent in the same manner.

Furthermore, Neko Health will pseudonymise your personal data (i.e., your personal data will be replaced by a pseudonym or similar) to the extent possible during the test period and take measures to ensure that picture material is not displayed together with other information that can directly identify you.

Reports and statistics on an aggregated level (which do not contain any personal data) will be stored until further notice.

Asserting and defending legal claims

Who is responsible: Neko Health is the data controller and is responsible for the processing of your personal data that is necessary to assert and defend legal claims.

What we do: Neko Health uses, when needed, your personal data to manage, defend and exercise legal claims and rights, or in connection with any legal proceedings (including prospective legal proceedings) or for the purpose of obtaining legal advice, e.g. in connection with a dispute or court proceeding. For this purpose, Neko Health will also store your documented consent allowing Neko Health to use your personal data for testing and development, as further described above.

Categories of personal data:

Health data
Biometric data
Payment information
And other information that you share during your healthcare consultation

Relevant categories of personal data that are necessary to manage, defend or exercise the legal claim or right in the specific case.

Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy Neko Health's legitimate interest of managing, defending and exercising legal claims and rights. It is our assessment that Neko Health's legitimate interest outweighs your interest of not having your personal data processed for this purpose. Contact us if you want to know more about how we have balanced your interests against ours. Establish, exercise and defend legal claims (Article 9.2 (f) of the GDPR). Any special categories of personal data (such as information relating to your health) will only be used for this purpose where necessary to establish, exercise and defend legal claims or in connection with any legal proceedings (including prospective legal proceedings) or for the purpose of obtaining legal advice.

Retention period: Personal data will be saved for this purpose until the completion of the product testing and development work (as further described in the testing and product development section above), or such longer period as necessary to manage and defend legal claims or disputes arising during such 24-month period. Your documented consent, including your name, will be stored until the development work is finished, and thereafter for an additional period of six (6) years to manage, defend and exercise legal claims and rights under the GDPR.

Regulatory compliance

What we do: Neko Health will, if necessary, use your personal data to fulfil its legal obligations, e.g. to comply with data protection obligations regarding data subjects' rights or to comply with accounting obligations.

Categories of personal data: Relevant categories of personal data that are necessary to fulfil the specific legal obligation.

Legal basis: Fulfil legal obligation (Article 6.1 (c) of the GDPR). The use of your personal data is necessary to fulfil Neko Health's legal obligations.

Retention/storage period: Personal data will be saved for this purpose until the completion of the product testing and development work (as further described in the testing and product development section above), or such longer period as necessary to manage and defend legal claims or disputes arising during such 24-month period. Personal data is otherwise stored for such period that is necessary for us to fulfil the specific legal obligation.

Processing of health data in scientific research

With your consent, Neko Health will use your personal data to conduct tests aimed at developing, improving, and optimizing the technology and medical equipment which you are offered at the Neko Clinics. The processing of your personal data for this purpose may in some cases be considered as research, in which case Neko Health will ensure that the applicable requirements are complied with.

Other transfers of personal data by Neko Health

Transfers of personal data to service providers

Neko Health will transfer your personal data to recipients that provide services to Neko Health and that need access to your personal data to provide such services. These service providers provide, inter alia, IT services (e.g. support and data storage services). Those service providers process personal data on Neko Health's behalf as processors for Neko Health and Neko Health is responsible for the processing of your personal data as described above. They must not use your personal data for their own purposes and are contractually and legally obliged to protect your personal data and are bound by confidentiality obligations.

Transfers of personal data to other data controllers

Neko Health may, under limited circumstances, disclose your personal data as stated below. The recipient is responsible (controller) for its own collection and use of personal data, unless otherwise stated.

Manage a sale or merger of Neko Health. Recipients: buyers, potential buyers, external advisors. Categories of personal data: technical data, demographic data (and other relevant categories of personal data that are necessary to manage the sale or merger). Legal basis for the transfer: legitimate interest (Article 6.1 (f) of the GDPR) — the use of your personal data is necessary to satisfy Neko Health's legitimate interest of selling or merging the business, which we assess outweighs your interest of not having your personal data processed for this purpose if the buyer carries out the same or similar type of business; and, where applicable, to establish, exercise and defend legal claims (Article 9.2 (f) of the GDPR) for any special categories of personal data.

Manage, defend and exercise legal claims and rights. Recipients: opposing party, external advisors, public authorities, law enforcement. Categories of personal data: health data, biometric data, payment information, and other information that you share during your healthcare consultation (relevant categories of personal data that are necessary to manage, defend or exercise the legal claim or right in the specific case). Legal basis for the transfer: legitimate interest (Article 6.1 (f) of the GDPR) — the use of your personal data is necessary to satisfy Neko Health's legitimate interest of managing, defending and exercising legal claims and rights, which we assess outweighs your interest of not having your personal data processed for this purpose; and to establish, exercise and defend legal claims (Article 9.2 (f) of the GDPR) for any special categories of personal data.

Where we process your data

We will not transfer or process personal data outside the EU or EEA, nor will we permit personal data to be transferred or processed outside the EU or EEA, unless it is under one or more of the following conditions:

the territory into which the data are being transferred is covered by EU Commission adequacy decisions or a mechanism such as the EU-US Data Privacy Framework;
the transfer is made under the standard contractual clauses issued by the EU Commission, which is a standard contract that safeguards transfers of personal data from the EU/EEA to a recipient in a third country; and
the transfer is made under the provision of binding corporate rules; and
the transfer is made in accordance with one of the derogations set out in the GDPR and applicable national law.

For more information on these safeguards or to obtain a copy of such safeguards, please contact us.

Your rights

You have certain rights in relation to your personal data. If you wish to exercise your rights, please contact us by e-mail at dpo@nekohealth.com.

We normally respond to your request within one month following the date we received your request. However, if your request is complicated or if you have submitted several requests, we may need additional time to handle your request. We will in such a case notify you and the reasons for the delay. If we cannot, wholly or in part, comply with your request we will notify you and the reasons for this.

When you submit a request to exercise your rights, we need to confirm your identity to ensure that you are not somebody else than who you claim to be. This is to avoid that we e.g. disclose personal data to an unauthorised person or in error delete personal data. If we do not have sufficient information to confirm your identity, we can request that you provide supplementary information about yourself needed to confirm your identity. We only request such information that is reasonable and necessary to confirm your identity. The time to respond to your requests starts when we have confirmed your identity.

Below we describe the rights that you have in relation to your personal data. For further information on your rights, please see the website of your supervisory authority. In Sweden (which is the country in which Neko Health is based), the supervisory authority is the Integritetskyddsmyndigheten (IMY).

Right to access (Article 15 of the GDPR)

You have the right to request confirmation from us as to whether we process your personal data and in such a case receive a copy of your personal data together with additional information on our use of your personal data. Please note that the right to a copy of your personal data may not adversely affect the rights of others.

Right to rectification (Article 16 of the GDPR)

You have the right to request that we rectify or supplement your personal data if you consider that your personal data is incorrect, incomplete, or misleading.

Right to withdraw your consent (Article 7 of the GDPR)

Where we use consent as our lawful basis, you have the right to at any time withdraw your consent to our processing of your personal data by changing your account settings on our platform or contacting us on the contact details below. When you have withdrawn your consent, we will not continue to use your personal data based on the consent previously provided.

Right to erasure (Article 17 of the GDPR)

You have in certain situations the right to request erasure of your personal data (“the right to be forgotten”). By way of example, the right to erasure applies if we still process your personal data but no longer need the personal data for the purposes for which it was collected, or if you object to our use of your personal data under Article 21 of the GDPR and we cannot show a compelling reason to further use your personal data notwithstanding your objection.

There are also several exemptions from the right to erasure, including if we are obligated under law to keep your personal data or if the personal data is needed to exercise, manage, and defend legal claims.

Right to object to our use of personal data (Article 21 of the GDPR)

In certain situations, you have the right to object to our use of your personal data. Where we rely on a legitimate interest for the use of your personal data under Article 6.1 (f) of the GDPR, you have the right to object to the use for reasons which relate to your particular situation. If we cannot show a compelling reason to continue to use your personal data, we will stop using your personal data for the relevant purpose. Moreover, despite an objection we have the right to continue our processing if needed to establish, exercise or defend legal claims.

Right to request restriction of your personal data (Article 18 of the GDPR)

In certain situations, you have the right to request restriction of your personal data, which means that you can, at least for a certain period, stop us from using your personal data. The right to request restriction of your personal data applies if you consider that the personal data about you is incorrect and during the period that we verify this, if the use of your personal data is unlawful and if you wish that we continue to store your personal data instead of deleting it, and if we no longer need your personal data for the purposes for which we collected it, but you need the personal data to establish, exercise and defend legal claims and rights.

You also have the right to request restriction of your personal data if you have objected to our use of your personal data under Article 21 of the GDPR and during the period we verify whether we have a compelling reason to continue to use your personal data.

If the use of your personal data has been restricted, we are normally only allowed to store your personal data and not use it for any other purpose than to establish, exercise and defend legal claims and rights.

Right to copy of certain personal data and transfer of the personal data to an external recipient (data portability) (Article 20 of the GDPR)

The right to data portability means that in certain situations, you have a right to receive a copy of the personal data that you yourself have provided to us in a structured, commonly used format. Moreover, where it is technically feasible, you also have the right to request that the copy of your personal data is transferred directly to an external recipient.

The right to data portability under this information notice only applies to personal data that we process based on your consent.

Specific rights under the applicable law

If you object to your personal data being made available by electronic access to the staff of another healthcare provider or with another healthcare process within the Neko Group, you have the right to request blocking of your data in certain cases.

You also have the right to receive information from us about the direct access and electronic access about you that has taken place.

For further information, please refer to the specific information provided by each Clinic.

Right to lodge a complaint

You have the right to lodge a complaint with your supervisory authority. In Sweden (which is the country in which Neko Health is based), the supervisory authority is the Integritetskyddsmyndigheten (IMY).

Automated individual decision-making

We do not carry out any automated individual decision-making which has legal effects or similar significant effects on you.

Updates to this information

We regularly update this information. Our use of personal data may change, for example we may collect personal data for new purposes, collect additional categories of personal data or share your personal data with other recipients than outlined in this information. If our use of personal data changes, we will update this information to reflect such changes. At the top of this page, you can see when this information was last updated. If we make material changes that are not only editorial to this information, we will notify you of any such changes and what they mean to you in advance.

If you have questions

If you have questions about this information, our use of your personal data or if you wish to exercise your rights, please contact us by e-mail at dpo@nekohealth.com or by post at the following address:

Neko Health AB
Postal address: Svärdvägen 19, 182 33 Danderyd, Sweden

The Neko Clinics
Postal address: c/o Neko Health Inc., 111 Broadway, 19th Floor, 10006, New York

Last Updated: 22 September 2026