Privacy notice

1. Who we are

Go North Medical AB (company registration number 556957-8312), Sotenäsvägen 47, 433 64 Sävedalen, Sweden, is the controller for the personal data described in this notice. We represent medical device manufacturers in the Nordic countries as their authorised agent.

Questions about this notice or about your data: privacy@gonorthmedical.com. We have not appointed a data protection officer; see section 11 for why.

2. Who this notice is for

• Anyone who visits this website.
• Healthcare professionals who register for our events, register a device exchange, file a complaint, ask for access to the GNM Hub, or write to us.
• Patients and other people mentioned in something a healthcare professional sends us through those channels. Section 6 explains what we do with information about you.
• Candidates in our recruitment processes.

3. What we collect and why

3.1 Visiting the website

Our web server logs the IP address, time, requested page and browser type for every request. We keep these logs for up to 30 days for security and fault-finding. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR). The website sets no cookies and uses no analytics or advertising services. Videos are loaded from Vimeo only when you press play.

3.2 Event registration

Name, email, mobile number, hospital, profession, and the answers you give on the registration form (patient group, experience, meals, hotel, invoicing details). We use them to run the event, send confirmations and practical information, invoice where a fee applies, and keep the records required for accounting and for the rules on cooperation between industry and healthcare. Legal basis: performance of the agreement you enter into when you register (Article 6(1)(b)); bookkeeping law for invoicing records (Article 6(1)(c)). We share your contact details with the other participants only if you say yes to that question on the form (consent, Article 6(1)(a), withdrawable by emailing us). Retention: 7 years after the event, as required by the Swedish Bookkeeping Act.

3.3 Reporting a problem with a device

If you report a problem with a device to us by email, by phone or with the complaint form on this website, we record what you tell us about the event and the device (model, serial number), the clinical details needed to understand the event, and your name, role, hospital and contact details. We do not ask for anything that identifies the patient. We forward the report to the manufacturer under the manufacturer's complaint-handling procedure and keep a record. Legal basis: our obligations under the EU Medical Devices Regulation 2017/745 and our agreement with the manufacturer, which implements them (Article 6(1)(c) and 6(1)(f)); for the patient's health information, Article 9(2)(i), which allows processing in the public interest in the area of public health to ensure high standards of quality and safety of medical devices. Retention: 15 years after the last device of that model was placed on the market, in line with the record-keeping obligation for implantable devices.

3.4 Email and other correspondence

When you write to us, we keep the correspondence with our record of you as a professional contact. Correspondence about a device problem follows the retention period in section 3.3. Other correspondence is reviewed 5 years after last contact. Legal basis: our legitimate interest in keeping a record of our dealings with the hospitals we work with (Article 6(1)(f)).

3.5 Recruitment

Name, contact details, what you send us, and interview arrangements. Legal basis: our legitimate interest in running a recruitment process (Article 6(1)(f)). Retention: 2 years after the recruitment process ends, the limitation period under the Swedish Discrimination Act.

3.6 Requesting access to the GNM Hub

Your name, email address and mobile number. We use them to decide on your request and, if it is approved, to send you an invitation by email and a text message telling you it is on its way. Legal basis: steps taken at your request before entering into an agreement (Article 6(1)(b)). Requests are deleted after 90 days, whatever the outcome.

3.7 Using the website forms without an account

Until 31 December 2026 you can register an exchange of an implanted device, or file a complaint about a device, on this website without an account.

For an exchange you give us the hospital, city and clinic, the old and new serial numbers, the reason for the exchange, and your name and email address. We use the information to keep the device record correct, to tell the manufacturer about the exchange, and to send you a confirmation by email. Legal basis: our legitimate interest in supporting the products we represent and our obligations as the manufacturer's agent (Article 6(1)(f)). Retention: 15 years, in line with the record-keeping obligation for implantable devices.

For a complaint you give us what section 3.3 describes: your name, title, hospital, department and contact details, the product and its serial numbers, what happened, and any pictures or documents you attach (up to five files). We use it as set out in section 3.3, including the legal basis and the 15-year retention, and we send you a confirmation by email.

We ask for nothing that identifies the patient, and we ask you not to include it, in the text or in a picture. We keep your email address with the registration. If you later create a GNM Hub account with the same address, the exchanges and complaints you sent from the website appear in your history there, because we match the two addresses. Nobody else sees them. We also keep the time of the submission, your email address and your IP address in a security log for 12 months, to deal with misuse of the form.

From 1 January 2027 exchanges and complaints are filed in the GNM Hub only, and the website forms are closed. The Hub has its own privacy notice for account holders.

4. Where the data is stored

Data is stored on servers we rent from Hetzner Online GmbH in Helsinki, Finland, under a data processing agreement, on encrypted disks that only we hold the keys to. Our email and internal collaboration run on Google Workspace (Google Ireland Limited) under Google's data processing terms. Text messages are sent through an SMS provider in Sweden under a data processing agreement. None of these providers may use your data for its own purposes.

5. Who receives the data

• The manufacturer of the device receives reports of device problems and device exchanges, so that it can meet its obligations under the EU Medical Devices Regulation. Where that regulation or our agreement with the manufacturer requires it, the manufacturer may also receive the records we keep on its behalf. The manufacturer is a separate controller for what it receives and has its own privacy notice.
• Competent authorities (for example Läkemedelsverket in Sweden) if a report has to be made to them or they ask for it.
• Our staff, by role.
• Our processors, listed in section 4, who act only on our instructions.

We do not sell personal data and we do not share it with anyone else.

6. If you are a patient mentioned in something a clinician sent us

Your clinician may have reported a problem with a device. We ask clinicians not to send names or personal identity numbers. Where a report describes a device problem, we keep the clinical details needed to understand the event, because the law on medical device safety requires it, and we forward it to the manufacturer for the same reason. You have the rights in section 8. Because we rarely know who you are, you may need to go through your clinic, who can identify the record for us.

7. Transfers outside the EU and EEA

We do not transfer personal data outside the EU/EEA. Our hosting is in Finland. Google Workspace uses sub-processors in other countries under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses; the details are in Google's Workspace data processing terms. The manufacturer receives reports through its European entities.

8. Your rights

You can ask us to tell you what data we hold about you, correct it, delete it, restrict its use, give you a copy in a common format, and you can object to processing based on our legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting what was done before. Write to privacy@gonorthmedical.com. We answer within one month.

Some records cannot be deleted on request because we are legally required to keep them: records of device problems and device exchanges under the Medical Devices Regulation, and invoicing records under the Bookkeeping Act. We will tell you when that applies.

You have the right to complain to a supervisory authority. In Sweden this is Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy@imy.se. You can also complain to the authority in the country where you live or work: Datatilsynet (Norway), Datatilsynet (Denmark) or Persónuvernd (Iceland).

9. Security

Data is stored encrypted in the EU, sent over encrypted connections, and accessible only to the staff who need it.

10. Automated decisions

We do not make automated decisions about you and we do not profile you.

11. Data protection officer

We have assessed that we are not required to appoint a data protection officer under Article 37 GDPR: we are a small company, and processing health data is not our core activity or done on a large scale. Data protection matters are handled by company management, reachable at privacy@gonorthmedical.com.

12. Changes to this notice

We publish changes here with a new version number and date. Earlier versions are available on request.

Version history: 1.0, 2026-10-13.