Privacy Policy

1. Data controller

Medvital Sverige AB, corporate reg. no. (org.nr) 559421-2093, Box 2420, 116 74 Stockholm, Sweden, is the data controller for the processing of your personal data in connection with the online store shop.medvital.se.

Contact for data protection matters: info@medvital.se, phone +46 31-78 131 55 (weekdays 10:00–12:00).

This privacy policy describes how we process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and supplementary Swedish data protection legislation.

2. What personal data we process

  • Contact and identity details: name, email address, phone number, delivery and billing address.
  • Order and subscription details: ordered products, order number, order history, subscription status, delivery information.
  • Payment details: payment is handled by our payment provider (Shopify Payments). We never access or store your full card details — we only see the payment status, the payment method and the last digits of the card number. For invoice purchases, we also process the invoice amount, due date and payment status.
  • Personal identity number (invoice purchases only): if you choose to pay by invoice, we process your Swedish personal identity number (personnummer) for identification, age verification and invoicing — see section 3.8.
  • Device and visit data: IP address, browser type, device information and data collected via cookies and similar technologies (see our cookie policy).
  • Customer service matters: the content of your communication with us by email and phone.
  • Reviews: name (or alias) and the content of product reviews that you voluntarily submit.

3. Purposes and legal basis

3.1 Managing purchases, subscriptions and deliveries

We process your contact, order and payment details to receive and process orders, administer subscriptions (including recurring charges and monthly deliveries), invoice you when you have chosen invoice as your payment method, deliver goods, handle returns, withdrawals and complaints, and provide customer service.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.2 Accounting and legal obligations

We process order and payment records to comply with the requirements of bokföringslagen (the Swedish Accounting Act) and other mandatory legislation.

Legal basis: legal obligation (Art. 6(1)(c) GDPR). Accounting records are kept for 7 years in accordance with the Swedish Accounting Act.

3.3 Marketing and newsletters

We send newsletters and offers by email if you have consented to this. You can unsubscribe at any time via the link in each mailing or by contacting us.

Legal basis: consent (Art. 6(1)(a) GDPR). Marketing of similar products to existing customers may also take place on the basis of legitimate interest (Art. 6(1)(f) GDPR), always with the option to opt out.

3.4 Ad measurement and audience targeting

With your consent via our cookie banner, we use the Meta pixel and the Meta Conversions API to measure the effectiveness of our advertising and to target ads to relevant audiences on Meta's platforms (Facebook and Instagram).

Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via "Cookie settings" in the footer.

3.5 Analytics and improvement of the online store

We use analytics tools to understand how the online store is used and to improve it. Non-essential analytics cookies are only set after consent.

Legal basis: consent (Art. 6(1)(a) GDPR) for cookie-based analytics; legitimate interest (Art. 6(1)(f) GDPR) for aggregated statistics not based on cookies.

3.6 Product reviews

We process the data you provide when you write a product review via our review service.

Legal basis: consent (Art. 6(1)(a) GDPR) and legitimate interest in displaying genuine customer reviews (Art. 6(1)(f) GDPR).

3.7 Preventing fraud and misuse

We may process order and device data to prevent and investigate fraud and misuse of the online store.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

3.8 Personal identity number for invoice purchases

If you choose to pay by invoice, we ask you to provide your Swedish personal identity number (personnummer). The personal identity number is only collected when you yourself choose invoice as your payment method – if you pay by card, Klarna or Swish, we do not process your personal identity number.

We process the personal identity number for secure identification of you as a customer, verification that you are 18 years or older (a legal requirement for credit purchases), invoicing, and the handling of payment reminders and any debt collection matters. The data is only shared with our finance and accounting systems and, in the event of non-payment, with debt collection agencies (see section 4).

Legal basis: the processing is necessary for the performance of the purchase contract (Art. 6(1)(b) GDPR), for compliance with legal obligations such as the Swedish Accounting Act (Art. 6(1)(c)), and on the basis of our legitimate interest in preventing fraud (Art. 6(1)(f)). The processing of the personal identity number specifically is carried out on the basis of Chapter 3, Section 10 of dataskyddslagen (2018:218) (the Swedish Data Protection Act), as it is clearly justified given the importance of secure identification for invoice purchases.

Providing your personal identity number is a prerequisite for being able to pay by invoice. If you do not wish to provide your personal identity number, you can pay by card, Klarna or Swish instead. We never expose your full personal identity number unnecessarily – it is not printed visibly on delivery notes in the parcel and is not sent by email.

4. Recipients of personal data

We share personal data with the following categories of recipients, to the extent required for each purpose:

  • Shopify (Shopify International Ltd. / Shopify Inc.) — operates our e-commerce platform and provides the payment solution Shopify Payments. Shopify processes customer, order and payment data on our behalf.
  • Meta Platforms Ireland Ltd. — receives data via the Meta pixel and the Conversions API (e.g. hashed contact details, events such as page views and purchases) for ad measurement and audience targeting, only after your consent.
  • Judge.me — handles product reviews (name/alias, email address, review content).
  • Appstle — handles subscriptions (subscription status, order information) on our behalf.
  • Shipping companies, e.g. PostNord — receive name, address, phone number and email in order to deliver your parcels and send delivery notifications.
  • Payment providers — handle payment transactions. Card details are provided directly to the payment provider and never pass through our systems.
  • Debt collection agencies — in the event of non-payment of an invoice, the claim may be transferred to debt collection. The debt collection agency then receives the data needed to collect the claim, such as name, address, personal identity number and invoice details.
  • Public authorities — where we are required to by law, e.g. the Swedish Tax Agency (Skatteverket).

Suppliers that process personal data on our behalf do so as data processors under data processing agreements in accordance with Art. 28 GDPR. We never sell your personal data.

5. Transfers to third countries

Some of our suppliers (including Shopify, Meta and Judge.me) may process personal data in countries outside the EU/EEA, for example the United States. Where this occurs, we ensure that the transfer is covered by appropriate safeguards under Chapter V of the GDPR, primarily the European Commission's standard contractual clauses supplemented by technical and organisational safeguards, or an adequacy decision (e.g. the EU–US Data Privacy Framework where the recipient is certified). Contact us if you would like to know more about the safeguards or obtain a copy of them.

6. Retention periods

  • Order and customer data: kept for as long as needed to perform the contract and thereafter for as long as complaint liability may be asserted (3 years under konsumentköplagen, the Swedish Consumer Sales Act).
  • Accounting records: 7 years under bokföringslagen (the Swedish Accounting Act).
  • Personal identity number (invoice purchases): data included in accounting records (e.g. invoices) is kept for 7 years after the end of the calendar year in which the financial year ended, in accordance with the Swedish Accounting Act. Thereafter, or when the data is no longer needed for the purposes in section 3.8, it is deleted.
  • Subscription data: for the duration of the subscription and thereafter according to the periods above.
  • Marketing data: until you withdraw your consent or unsubscribe.
  • Customer service matters: normally deleted no later than 24 months after the matter has been closed, unless longer retention is required for legal claims.
  • Cookies: according to the lifetimes stated in our cookie policy.

When the retention period has expired, the data is deleted or anonymised.

7. Your rights

Under the GDPR, you have the right to:

  • Access the personal data we process about you (a register extract).
  • Have inaccurate data corrected.
  • Have data erased (the "right to be forgotten") when it is no longer needed for the purpose and we have no legal obligation to keep it.
  • Request restriction of processing in certain situations.
  • Data portability — receive the data you have provided to us in a structured, commonly used and machine-readable format and have it transferred to another data controller.
  • Object to processing based on legitimate interest, including to direct marketing. If you object to direct marketing, we will always stop it.
  • Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Consent to cookies is withdrawn via "Cookie settings" in the footer.

To exercise your rights, contact us at info@medvital.se. We will respond to your request without undue delay and at the latest within one month.

8. Right to lodge a complaint with a supervisory authority

If you believe that we process your personal data in breach of the GDPR, you have the right to lodge a complaint with Integritetsskyddsmyndigheten (IMY, the Swedish Authority for Privacy Protection), Box 8114, 104 20 Stockholm, imy.se. You can also contact the supervisory authority in the country where you live or work.

9. Cookies

We use cookies and similar technologies in the online store. Non-essential cookies are only set after you have given your consent via our cookie banner. Read more about which cookies we use, their purpose and lifetime, and how to change your choice in our cookie policy.

10. Changes to this policy

We may update this privacy policy when necessary, for example due to changes in our business or in legislation. The latest version is always published at shop.medvital.se. In the event of material changes, we will inform you by email or in the online store.

This policy was last updated in July 2026.