Your privacy is important to us. This Privacy Policy explains how Oncoly AB collects, uses, and protects your personal data in compliance with the General Data Protection Regulation (GDPR).

1. Who We Are (Controller)

Oncoly AB (org. no. 559548-6423), Jönköping, Sweden, is the data controller for the Oncoly app and website.

Privacy contact: dev@oncoly.se

2. What Data We Process

• Account: name, email, age; optional profile fields (e.g., gender).
• Technical/usage: device info, IP (security), app events (non-PHI analytics).
• Wellness indicators: Oncoly enables users to voluntarily record wellness indicators such as mood, sleep, or symptoms to support personal awareness. These features are self-reflection tools and are not intended for medical diagnosis or treatment. As no sensitive health data is analyzed or interpreted by Oncoly, and no intervention is made based on the data, the app does not qualify as a medical device and does not require ethical board approval under current EU guidelines.
• Access Sharing: If you choose to invite a relative or trusted supporter to view your information, we will process the data necessary to provide this feature. This may include your logs, timeline entries, appointment details, and uploaded documents. Sharing occurs only after your explicit consent and only with the specific individual you invite.

3. Why We Process (Purposes & Legal Bases)

• Provide the service (accounts, secure access, reminders): Art. 6(1)(b) GDPR (contract).
• Health features (you log and view your own entries, trends): Art. 6(1)(b) + Art. 9(2)(a) GDPR (explicit consent).
• Security & integrity (fraud/abuse prevention, access logging): Art. 6(1)(f) GDPR (legitimate interests).
• At this MVP stage, Oncoly does not process health or other special-category data. When these features are activated in future, explicit consent under Article 9 GDPR will be requested in-app.
• Support & communications (when you contact us): Art. 6(1)(b)/(f) GDPR.
• Anonymised analytics/quality improvement: Art. 6(1)(f) GDPR; we do not re-identify you.

We rely on explicit consent to process health data. You can withdraw consent at any time in‑app or by emailing dev@oncoly.se. Withdrawal does not affect past lawful processing.

When you activate the Access Sharing feature and choose to share health-related data with a relative or supporter, the legal basis is your explicit consent under GDPR Art. 6(1)(a) and Art. 9(2)(a). You may withdraw this consent at any time in-app. Revocation immediately stops all access.

4. Where Data Is Stored and How It's Transferred

• Location: EU/Sweden. We host with EU-region services (e.g., Supabase in EU).
• Processors: database/storage, infrastructure, email/SMS, and analytics (EU, non-PHI). We sign DPAs with all processors and keep an updated list on our site.
• International transfers (if any): protected by EU Standard Contractual Clauses and supplementary measures (e.g., encryption).

5. Security (Art. 32 GDPR)

• Encryption in transit (TLS) and at rest.
• Row‑Level Security and least‑privilege access in our database.
• We are preparing Data Processing Agreements (DPAs) with all future processors; for the MVP test, no third-party processors handle health data.
• Audit logs: we record who/when/why for any staff access to health data (immutable).
• Admin safeguards: multi‑factor auth, key rotation, secure backups, and regular vulnerability testing.

Relative Accounts: Relatives receive a restricted-view account allowing them to access only the specific information you choose to share. They cannot edit or add medical information, cannot view data of other users, and cannot access any insights or interpretations.

We apply strict Role-Based Access Control (RBAC) to ensure that relatives may only access the information you have chosen to share. All access attempts are verified on the backend. We maintain audit logs of access events as required by GDPR Art. 32.

6. Sharing and Revoking Access

You can grant, manage, and revoke access to your information at any time. Once access is revoked, the relative immediately loses the ability to view your data. All access events are logged for security and audit purposes.

7. Retention & Deletion (MVP)

We keep personal data only as long as needed for each purpose, then delete or anonymise. Sharing your data with a relative does not change the retention period of your health data. Relatives' accounts store only their login credentials and access permissions.

Default periods (from last activity):

• Account & identity: 12 months after account deletion (fraud/security).
• Health logs (symptoms/mood/treatment): 5 years.
• For the MVP test version, no health data is retained beyond technical logs or analytics necessary to ensure functionality.
• Uploaded medical documents: 5 years.
• Access/audit logs: 6 years.
• Support tickets: 3 years.
• Backups: 30–90 days rolling.

8. Medical Disclaimer

Oncoly is a wellness companion and self-organization tool. It is not intended to diagnose, treat, cure, or prevent any disease or health condition. The application does not offer medical advice and should not be used as a substitute for professional healthcare. Always consult qualified medical professionals for any medical concerns. Use of Oncoly is at your own discretion and risk.

9. Your Rights

You can access, rectify, erase, restrict, port, and object, and withdraw consent for health data.

How: in‑app or dev@oncoly.se. We reply within 1 month (extendable by 2 months for complex requests). We may verify identity.

10. Data Breaches

We assess incidents promptly and, when required, notify IMY within 72 hours and inform affected users without undue delay. We maintain an incident log.

11. Eligibility & Geography (MVP)

Oncoly is for users 16+ and currently available to residents of Sweden only.

12. Changes to This Policy

We notify material changes 30 days in advance in‑app/website. If a change requires renewed consent, we will ask you to opt in again.

13. Contact & Complaints

Questions/requests: dev@oncoly.se.

You may lodge a complaint with Integritetsskyddsmyndigheten (IMY) in Sweden.