Privacy policy

NIMM protects your privacy. Whether you are a prospective, current or former student, patient or employee at the college, you should feel secure when you entrust us with your personal data. That is why we have established this policy.

NIMM's handling of your personal data is in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Patientdatalagen (2008:355, "PDL"; Swedish Patient Data Act) for patient records at the student clinic. The PDL applies specifically to record keeping, while the GDPR applies to general principles of security, rights and responsibilities.

In order for us to offer our educational and clinical services, we need to process your personal data. We also need your personal data to provide you with good service, for example in terms of marketing, follow-up and information. We may also need your personal data to comply with laws and perform customer and market analyses. It is important to us that you understand and feel secure about how we process personal data. This personal data policy aims to inform you about what personal data we process about you, why and how we process it, what rights you have and what responsibility we have for your personal data. You are always welcome to contact us if you have any questions.

All information that can be directly or indirectly linked to you as a physical individual is considered personal data. When you apply for a course or book a treatment on our website, contact us, use our student web, register for a course, an event or one of our newsletters or information mailings, you provide us with your personal data. Personal data includes, for example, your name, personal identification number, email address, telephone number, and application documents such as grades, CV, certificates, billing and residential addresses. Examples of data that is processed include information about how you use NIMM's websites, student web, IP addresses and geographical information.

Nordiska Institutet för Manuell Medicin AB (“NIMM”), organisation number 556056-9880, is the data controller. NIMM is based at Kräftriket 23 A, 114 19 Stockholm. Our websites are naprapathogskolan.se, kiropraktorakademin.se and nimm.se. NIMM can be reached by telephone on 08-16 01 20 or by email at info@nimm.se. The student clinic can be reached at klinik@nimm.se.

Data protection officer/data protection contact: NIMM has assessed that its operations do not require a formal data protection officer in accordance with Article 37 of the GDPR. NIMM has appointed an internal data protection contact who coordinates data protection issues. Contact can be made via info@nimm.se (clinic-specific questions via klinik@nimm.se). If the assessment changes, NIMM will appoint a data protection officer and update this policy.

Depending on integration, we may in some cases be joint controllers together with the supplier (Article 26 of the GDPR).

NIMM assesses that the requirements in GDPR Article 37.1 a–c for a mandatory data protection officer are not met for our operations. We are therefore not appointing a DPO at this time, but have an appointed data protection contact and are reviewing the decision on an ongoing basis (at least annually or in the event of significant changes).

Reasons for the assessment (key arguments)

1. Primary activity is higher education
   NIMM is a private education provider, which is why Article 37.1(a) does not apply to us. Our core business is education and research, and the clinic is primarily an educational environment (VIL/VFU) that supports education. Thus, the processing of personal data in the clinic does not constitute our primary core business within the meaning of the guidance on DPOs.
2. No "regular and systematic monitoring on a large scale"
   We do not conduct such monitoring of data subjects as referred to in Art. 37.1(b) (e.g. large-scale platform monitoring/tracking). Our processing concerns scheduling and record-keeping related to the teaching clinic, not ongoing behavioural monitoring of a larger population.
3. No "large scale" of special categories under Art. 37.1(c)
   Although clinic records may contain sensitive information (Article 9), our processing is not on a large scale:
   — One (1) clinic in one location (limited geographical scope),
   — Education-related patient activities (VIL/VFU),
   — Limited medical area (musculoskeletal disorders),
   — Proportional number of patients in relation to the population.
   WP29/EDPB states that "large scale" is assessed based on the number of registered individuals, data volume/breadth, duration and geographical spread, and illustrates that hospitals typically have a DPO, while an individual (smaller) clinic typically does not reach "large scale".
4. Compliance is nevertheless ensured
   We maintain Article 30 registers, clear policies/procedures, training for staff/students and use a data protection contact for advice and internal control. This is in line with IMY's and EDPB's purpose with the DPO rules: to ensure compliance, even where a DPO is not mandatory.

Review clause
The decision not to appoint a DPO is reviewed annually and in the event of changes that may be "significant in scope", e.g. more clinics, a sharp increase in the patient base, expanded data collection (e.g. large-scale register research) or new forms of systematic monitoring. If such changes occur, NIMM will appoint a DPO without delay and notify IMY in accordance with Article 37.7.

NIMM maintains a register in accordance with Article 30 of the GDPR covering all processing operations. The register includes categories of data and data subjects, purposes, legal basis, recipients/processors, storage periods and security measures. Requests regarding the register should be directed to info@nimm.se.

Central systems/processors (examples, complete list in the Article 30 register):
AD (Active Directory), BR (Brevo), CO (Cookiebot), KA (Kaddio), EQ (Equitrac), FN (Fortnox), FR (Physical paper register), ME (Meta – Facebook/Instagram), GO (Google Workspace for Education), GA (Google Ads/Display; possibly analysis from Google if activated), HD (Physical storage/hard drive), SC (Schoolity), SE (Securitas Direct), VI (Visma), VA (Vaka).

What is our purpose?
NIMM conducts clinical activities at NIMM Clinic. NIMM is a registered healthcare provider and applies Patientdatalagen (PDL). According to the PDL, you as a patient must identify yourself in order for us to treat you, and we are obliged to keep records of your treatments. The first time you visit us, you will also need to show identification.

What personal data is processed?

• Personal identity number
• First and last name
• Address
• Telephone number
• Email
• Health data in your medical records

NIMM applies integrated medical records within the student clinic, which means that students under supervision, supervisors, clinical teachers and administrative staff can only be given access when necessary. You have the right to access your medical records in accordance with the PDL. However, supervisors, clinical teachers or clinic managers always assess this before disclosure.

The student clinic uses Kaddio as its medical record system. Communication and storage are encrypted. The supplier complies with applicable legislation, including the GDPR and the PDL.

How do we collect the data?
Information is provided by you in connection with your booking and supplemented with information from the population register and the data you yourself provide in your meeting with your therapist.

How do we use the data?

• To provide you with safe and effective care. More information about how a visit works can be found on our websites.

Legal basis
Legal obligation under the PDL (record keeping, etc.). The GDPR also applies to principles, information obligations, security and rights, among other things.

Storage periods
According to the PDL, medical records are kept for at least ten (10) years from the last entry.

What is our purpose?
We need your personal data to process your application/registration and make an admission decision, as well as to communicate with you regarding the programme you have applied for. Sensitive data (e.g. certificates of special educational support) may be processed if necessary for the handling of your application.

What personal data is processed?

• Personal identity number
• First and last name
• Address
• Telephone number
• Email
• Application documents in the form of CV, grades, certificates, personal letter and other information required in accordance with the application/registration.
• Information about whether you were accepted or not.

How do we collect the data?
All data is provided by you in connection with the application/registration and is supplemented with information about eligibility, merit points, selection value and admission status from the admission process.

How do we use the data?

• The application documents are assessed by the university's admissions committee to determine whether you meet the eligibility requirements for the programme you have applied for. In connection with the assessment, the applicant is assigned a value as a basis for selection. This processing is done manually by administrators at NIMM. If you register for a course, your registration will not be assigned any selection points.
• We will notify you whether you have been admitted or not, and contact you if any additional information is required for your application documents.
• If you are accepted, we will also need to send you study-related information.
• Disclosure to cooperating authorities, e.g. CSN, Lånekassen, Kela, Socialstyrelsen or SCB (upon request for statistical data).
• Your data may be processed by personal data processors within the EU/EEA and, when necessary, outside the EU/EEA. For transfers outside the EU/EEA, we apply the European Commission's standard contractual clauses (SCC) and, where required, additional protective measures. See the section "International transfers".
• Your data may be shared with companies within the group.
• We will not transfer your data to any other third party unless we are required to do so by law or court order, or if it is necessary to fulfil an agreement with you or if it is in your interest.
• Any transfers outside the EU/EEA are made in accordance with the section "International transfers" (SCC and supplementary safeguards).

Legal basis
Measures prior to entering into an agreement/agreement (Art. 6.1 b) and legal obligation (Bokföringslagen, Swedish Accounting Act). It is in the applicant's interest that the data is processed, and the processing is necessary for us to be able to make an admission decision and enter into an agreement to grant the applicant access to the relevant programme. Processing is also necessary for NIMM to fulfil the legal obligation imposed by the accounting obligation and specified in Bokföringslagen. Any processing of special data (e.g. medical certificates for educational support) is carried out with consent (Art. 9.2 a).

Storage periods
Regardless of whether you are admitted to a programme or not, we will store your application details. We do this because we are required to retain documentation relating to the admissions process and be able to demonstrate how cases are handled, e.g. in connection with inquiries from supervisory authorities or if the applicant wishes to request a deferral. It is also in the applicant's interest that the information is retained, as it may provide merit points in a future application.

What is our purpose?
To be able to administer your studies and grades and to issue degree certificates, educational certificates, diplomas or licences after completion of your education or course.

What personal data is processed?

• Personal identity number
• First and last name
• Address
• Telephone number
• Email
• Account details for the IT systems used in the programme and to provide access to the university network
• Health data from the screening carried out prior to certain practical training elements
• Assessments and results for examined components
• Information that you yourself provide in your correspondence with university staff.

How do we collect the data?
All information is provided by you in connection with your application/registration or in your correspondence with university staff. The information is supplemented with information from university staff, teachers and examiners.

How do we use the information?

• To communicate course and education-related information to you.
• Your data is stored in our database.
• In conducting our educational activities, we engage IT subcontractors in Sweden and abroad. For any transfers outside the EU/EEA, the European Commission's standard contractual clauses (SCC) and, where required, additional safeguards are applied. See the section "International transfers".
• Our staff and the teachers and other educational staff that NIMM engages through consultancy and subcontractor agreements need access to your data in order to fulfil the purpose.
• Disclosure to cooperating authorities, e.g. Socialstyrelsen, CSN, Lånekassen, Kela and SCB (upon request for statistical data).
• Disclosure to relevant industry organisations, e.g. Europe Active, EREPS, Almega Vårdföretagen, Branschrådet Svensk Massage and the Nordic professional associations for naprapaths and chiropractors; Svenska Naprapatförbundet, Norges Naprapatförbund and Finska Naprapatförbundet, as well as Legitimerade Kiropraktorers Riksorganisation and Norsk Kiropraktorförening.
• Your data may be shared with companies within the group.
• We will not transfer your data to any other third party unless we are required to do so by law or court order, or if it is necessary to fulfil our agreement with you, or if it is in your interest.
• Your data will never be sold or transferred for direct marketing by third parties. Any transfers outside the EU/EEA are made in accordance with the section "International transfers" (SCC and supplementary safeguards).

Legal basis
We process your personal data in order to fulfil agreements on the provision of training and course activities. It is also in your interest that personal data is processed and necessary in order to administer your training or course with regard to scheduling, grades, diplomas/certificates and other documentation. It is also in your interest that information about degrees and/or licence-based education is provided to relevant industry organisations.

Processing is also necessary for NIMM to be able to fulfil the legal obligation of accounting as specified in Bokföringslagen and to be able to provide information about graduates to relevant authorities such as Socialstyrelsen, SCB, CSN, Lånekassen and FPA/Kela.

Storage periods
We store your personal data so that you can request certificates, grades or other information about your completed studies after you have completed your education or course. As no legal entity other than NIMM is responsible for keeping information about those who have completed education at the university, we believe that it is in the students' interest to store information about their educational results. The information is also stored in order to provide the relevant authorities with the documentation required for decisions on, for example, admission to licensing practice and the issuance of licences.

What is our purpose?
To ensure the quality of our educational, course and clinical activities, to inform you about the services we offer and to communicate other news to you. To be able to invoice you for the education or treatment you have undergone and for accounting purposes.

What personal data is processed?

• Personal identity number (in cases where the information is to be used for invoicing purposes)
• First and last name
• Address
• Telephone number
• Email
• Billing address
• What treatment, training or course you have undergone

How do we collect the information?
All information comes from the population register or the information you provided when you booked treatment or applied/registered for a course or training programme.

How do we use the information?

• NIMM uses your information to contact you regarding participation in surveys and studies related to your training or treatment.
• To contact you by email with information about your treatment, training, prices, opening hours, upcoming events and other news.
• To be able to invoice and manage our ongoing accounting.
• We share your personal data with our IT suppliers (personal data processors). We have written processing agreements with all processors in accordance with the GDPR, thereby ensuring a good level of security for your data.
• We will not transfer your data to any other third party unless we have a power of attorney or are required to do so by law or court order.
• Your data will never be sold or transferred for direct marketing by third parties.

Legal basis
The personal data processing that takes place to enable us to fulfil our accounting obligations is processed for up to seven years after the end of the financial year. We are therefore legally obliged to process your personal data during this period. NIMM also supports the processing of personal data on the basis of a balancing of interests, where we assess that we have legitimate interests in quality control, statistics and research data in order to be able to offer high-quality educational and clinical activities.

Furthermore, we assess that, by being part of the activities, either as a student or a patient, you are interested in receiving information about prices and opening hours, upcoming events, other training courses and other news about the activities, which is why we assess that we have a legitimate interest in providing you with this information. After careful consideration, NIMM has found that your interests or fundamental rights or freedoms in this context do not outweigh the need for personal data protection, which is why NIMM can support processing based on the legitimate interests described above.

Storage periods
We will store your personal data for as long as necessary to fulfil the purposes of this Personal Data Policy. After that, we consider that we no longer have any interest in processing your data for the purpose in question.

If you do not wish to receive surveys, information or marketing, you can object to this at any time. If this concerns training and/or courses, please contact info@nimm.se or follow the link provided in each email. If it concerns one of our clinics, please contact klinik@nimm.se or follow the link provided in each email. In the event of such a request, NIMM will immediately cease processing your data for marketing purposes.

What is our purpose?
The purpose of processing personal data is for research or the completion of degree projects at NIMM.

What personal data is processed?
It depends on the nature of the study.

How do we collect the data?
It depends on the nature of the study.

How do we use the data?
It depends on the nature of the study.

Legal basis
Consent and/or task carried out in the public interest; for special categories, Article 9 of the GDPR applies.

Storage periods
Until the thesis or research project is completed and/or concluded.

What is our purpose?
To fulfil our obligations in the form of organising the event you have registered for, conducting surveys and providing information about upcoming events, courses, training programmes and other news.

What personal data is processed?

• First and last name
• Address
• Telephone number
• Email
• Information about which event(s) you have participated in

How do we collect the information?
All information is provided by you in connection with your registration.

How do we use the information?

• NIMM uses your information to organise the event.
• To contact you regarding the event, e.g. about changes or to send out other information related to the event.
• To contact you regarding participation in training surveys.
• To contact you with information about upcoming events and other news.
• Your personal data may be shared with companies within the group.
• We share your personal data with our IT suppliers (personal data processors). We have written processing agreements with all processors in accordance with the GDPR, thereby ensuring a good level of security for your data.
• We will not transfer your data to any other third party unless we are required to do so by law or court order.
• Your data will never be sold or transferred for direct marketing by third parties.

Legal basis
NIMM processes your personal data in order to fulfil the agreement entered into in connection with your registration. Any further processing of personal data is carried out on the basis of a balancing of interests. When you register for an event, you have shown an interest in our services, so we believe that you are also interested in our upcoming events and/or news about our business, which is why we consider that we have a legitimate interest in developing marketing materials and marketing our services to you. Furthermore, we have an interest in developing material for method and business development.

After careful consideration, NIMM has found that your interests or fundamental rights or freedoms in this context do not outweigh the need for protection of personal data, which is why NIMM can support processing based on the legitimate interests described above.

Storage periods
We will store your personal data for as long as necessary to fulfil the purposes of this privacy policy. After that, we assess that we no longer have any interest in processing your data for the purpose in question.

If you do not wish to receive our marketing communications, you can object to this at any time – either by emailing info@nimm.se or by following the link provided in each email. In the event of such a request, NIMM will immediately cease processing your data for marketing purposes.

What is our purpose?
To market services, treatments, events and other content.

What personal data is processed?

• Name
• Email
• Information about when, how and what you have signed up for.

How do we collect the data?
All information is provided by you in connection with your subscription registration, when you order information material, or when you register for an event, a course, or apply for training.

How do we use the information?

• The information is used to send direct marketing messages to you via the email address you have provided.
• Your personal data may be shared with companies within the group.
• We share your personal data with our IT suppliers (personal data processors). We have written processing agreements with all processors in accordance with the GDPR, thereby ensuring a good level of security for your data.
• We will not transfer your data to any other third party unless we are required to do so by law or court order.
• Your data will never be sold or transferred for direct marketing by third parties.

Legal basis
Your personal data is processed on the basis of your consent and in order to fulfil the agreement entered into with you when you sign up as a subscriber. In order for us to fulfil our obligations (i.e. send you the newsletter you have requested), we must process your personal data. You can withdraw your consent at any time via the unsubscribe link or by contacting info@nimm.se.

Storage periods
We process your personal data for as long as you are a subscriber to the newsletter. You can cancel your subscription at any time by either following the link in each newsletter or contacting info@nimm.se. When you cancel your subscription, we will stop processing your personal data.

What is our purpose?
To provide and improve our services on the domains: naprapathogskolan.se, kiropraktorakademin.se, nimm.se and, with your consent, for statistics and marketing.

What personal data is processed?

• IP address
• Language settings
• Geographical location
• Information about how you interact with our website in the form of information about how you access and leave the service.

How do we collect the data?
The data is collected via cookies and similar technologies. See the section on NIMM's use of cookies.

How do we use the data?

• To improve our technical solutions.
• In the course of our business, we engage IT subcontractors in Sweden and abroad who process your personal data in connection with the provision of services relating to our website, storage and IT environment. We have written data processing agreements with all data processors in accordance with the GDPR, thereby ensuring a high level of security for your data.
• Google's statistics tool is only used to measure traffic on the website after consent has been given via Cookiebot.

Legal basis
Legitimate interest for necessary/operational and security cookies. Consent for non-necessary cookies (statistics/marketing).

Storage periods
According to the respective cookie and your consent choices; see the cookie declaration in our consent solution.

Advertising, measurement and use of first-party data
We use Cookiebot to manage consent. You can change your choices at any time via "Cookie settings" on the website.

With your consent via our cookie banner, we may enrich conversion data in advertising platforms (e.g. Google Enhanced Conversions and Meta Advanced Matching). To do this, we minimise data (usually email) and hash it with SHA-256 in your browser before sending it to the recipient. The purpose is attribution and optimisation of ads. Processing is done with consent (GDPR Art. 6.1 a) and no non-essential tags are activated before consent. Recipients may include Google, Meta, Microsoft, LinkedIn and TikTok (depending on active campaigns). International transfers are only made to recipients who are certified under the EU-US Data Privacy Framework or with standard contractual clauses (SCC) and, where necessary, additional safeguards in accordance with TIA. For certain integrations, we may be joint controllers together with the platform (Art. 26); in this case, we will provide a summary of the division of responsibilities upon request. You can revoke your consent at any time via the "Cookie settings" link in the footer.

FUNCTIONAL COOKIES (necessary)
These cookies are necessary to ensure the optimal functioning of the website and cannot be adjusted via the consent tool. They enable, for example, language selection, screen resolution, access to account/shopping cart/login, security/fraud protection and operation. Some functional trackers may be set by NIMM or our service providers to verify user data, payment and delivery methods.

PERFORMANCE COOKIES (statistics/analysis) – require consent
Used to measure and analyse visits (number of visits, pages viewed, average time spent, etc.) to improve the website. Typical storage time: up to 13–14 months.

MARKETING COOKIES – require consent
Used to personalise and measure advertisements in third-party channels (including social media). If you do not accept these, advertisements will still be displayed, but they will not be tailored to your preferences. Typical storage period: up to 13 months.

Suppliers and detailed storage times are listed in our cookie declaration in Cookiebot (e.g. Google Analytics/Ads and Meta Pixel if activated). You can withdraw/change your consent at any time via Cookie Settings.

What is our purpose?
To deliver educational content and enable communication between students, participants and teachers.

What personal data is processed?

• Name
• Email
• Information needed for teaching and examination.

How do we collect the data?
The information is entered by the student themselves or by the university's education coordinator when you are admitted to a course or programme.

How do we use the information?

• For administration of courses/programmes and access to learning platforms/IT environments. Personal data may be shared with our IT suppliers (personal data processors) within the EU/EEA and, when necessary, outside the EU/EEA in accordance with processing agreements. For transfers outside the EU/EEA, the provisions of the section "International transfers" (SCC, etc.) apply.
• We will not transfer your data to any other third party unless we are required to do so by law or court order.
• Your data will never be sold or transferred for direct marketing by third parties. Any transfers outside the EU/EEA are subject to the provisions of the section "International transfers" (SCC and supplementary safeguards).

Legal basis
Agreement (necessary for providing training and course administration).

Storage periods
We store your personal data so that you can request certificates, grades or other information about your completed studies after completing your education or course. As no legal entity other than NIMM is responsible for keeping information about those who have completed education at the university, we consider it to be in the students' interest to store information about their educational results for an indefinite period. The information is also stored in order to be able to provide the relevant authorities with the documentation required for, for example, decisions on admission to licensing practice and the issuance of licences.

What is our purpose?
To administer and fulfil employment/assignments and labour law obligations, including recruitment and induction, authorisation and account management, scheduling and absence, salary and benefits, pensions and insurance, work environment and rehabilitation, training/skills development, licence and equipment management, physical security/access passes, IT and information security (e.g. logging and incident management), auditing and reporting to authorities.

What personal data is processed?
Identity and contact details (name, personal identity number, address, telephone number, email address), employment and assignment details (type of employment, title, organisational affiliation, schedule/absence), salary and benefit information (salary category, account number, tax and benefit documentation), education/qualifications (CV, grades/certificates, certificates), authorisations and IT accounts (user ID, roles, access rights), security and usage logs (logins, email/cloud service metadata, print logs), access card information (card ID, access events), ID card photo. Sensitive data may be included to a limited extent, e.g. medical certificates in connection with absence/rehabilitation or information about union membership for leave/deductions – only to the extent required or permitted by law.

How do we collect the data?
From you in connection with recruitment, employment and ongoing administration; from internal systems (e.g. scheduling, access and IT logs); from public sources and authorities (e.g. Skatteverket, Försäkringskassan) and from our personal data processors in accordance with agreements.

How do we use the data?
To administer employment/assignments, provide IT resources and local access, manage salaries, taxes, pensions and insurance, fulfil work environment and rehabilitation obligations, plan skills development, ensure operational and information security (including troubleshooting and incident management), comply with legal requirements and report to the relevant authorities and auditors. Personal data is shared as necessary with our IT suppliers (personal data processors) and with authorities, banks, auditors and insurance/pension providers. We never sell personal data. Any transfers outside the EU/EEA are made in accordance with the section "International transfers".

Legal basis
Contract (Art. 6.1 b) to fulfil employment/assignment; legal obligation (Art. 6.1 c) under, for example, labour law, accounting law, tax and social security regulations; legitimate interest (Art. 6.1 f) for necessary IT/information security, logging, access and equipment management, and physical security/access passes – with the right to object where applicable. Processing of special categories of data (e.g. health data in medical certificates or information about trade union membership) only takes place when necessary and permitted under Art. 9.2 b/h GDPR and applicable Swedish legislation (e.g. work environment and social security regulations).

Storage periods
During ongoing employment/assignment and thereafter for as long as required by law or to establish, assert or defend legal claims. Accounting and payroll records are retained for up to seven (7) years after the end of the financial year in accordance with Bokföringslagen. Authorisation, security and access logs, as well as backup copies, are retained in accordance with NIMM's deletion procedures (normally for shorter periods unless longer retention is required for troubleshooting, security or ongoing investigations). Any archiving in accordance with agreements and legal requirements is specified in NIMM's Article 30 register.

NIMM does not have the right to use your personal data for purposes other than those stated above without first informing you.

You can contact NIMM at any time if you have questions about how we process your personal data. You have the right to request a register extract free of charge, i.e. access to your stored personal data. The register extract will be sent to your registered address.

Furthermore, you have the right to make the following requests:

1) if you believe that your personal data registered with us is incorrect or incomplete, you have the right to request correction 2) the right to request deletion of your data 3) the right to request that we restrict our processing of your personal data 4) the right to request the transfer of your personal data (data portability) to another service provider in a commonly used machine-readable format.

You also have the right to object to processing based on legitimate interest (including direct marketing) and the right to withdraw your consent at any time when the processing is based on consent.

Your request will be reviewed and, if the matter is deemed justified, we will then carry out the action you have requested, to the extent and within the time frame that we are able to do so.

Requests should be made in writing to:

Data Controller
Nordiska Institutet för Manuell Medicin AB
Kräftriket 23A
114 19 Stockholm

If you are dissatisfied and have a complaint about any part of NIMM's processing of your personal data, you can submit a complaint to NIMM. You also have the right to submit a complaint to the supervisory authority, Integritetsskyddsmyndigheten (IMY) (www.imy.se, imy@imy.se, telephone number: 08 657 61 00).

When selecting computer programs, cloud services, storage methods and other IT systems, NIMM has taken into account the principles of built-in data protection and data protection by default to a large extent.

The university strives to prevent unauthorised use or disclosure, both technically and administratively, through measures such as access control, logging, encryption in transit and, where possible, at rest, backups, policies/training and auditing of personal data processors.

Personal data may be transferred outside the EU/EEA if necessary (e.g. to suppliers such as Google or Meta). Such transfers are protected by the European Commission's Standard Contractual Clauses (SCC) and, where required, additional safeguards. Transfers are documented in NIMM's Article 30 register.

We use Google Workspace for Education for email and collaboration. Google processes personal data as our data processor in accordance with the Google Cloud Data Processing Addendum (ÄADC/CDPA) and we have specified that EU data protection laws (GDPR) apply. Any transfers outside the EU/EEA are protected by SCC and additional safeguards. For supported services, we use Data Regions (EU).

This Privacy Policy is subject to change. Changes to this policy will take effect when the revised policy is published on our websites. Significant changes will be communicated separately where necessary.

This policy describes NIMM's view on camera surveillance in our training premises.

The decision to use camera surveillance is intended to prevent, investigate and detect crime, prevent accidents or other comparable purposes. This purpose shall be achieved while protecting those under surveillance from undue intrusion into their personal privacy. NIMM considers that surveillance is particularly important in its activities.

Legal basis for camera surveillance
NIMM complies with the provisions governing camera surveillance under Kamerabevakningslagen (Swedish Camera Surveillance Act). The aim is to meet the need for camera surveillance for legitimate purposes while protecting individuals against undue infringements of their personal privacy. Therefore, camera surveillance is only carried out for specific and legitimate purposes which, according to the law, outweigh the right to personal privacy of employees, students and patients. The processing of personal data obtained through camera surveillance is based on legitimate interest (Art. 6.1 f GDPR).

Principles for camera surveillance
Camera surveillance is carried out on the following three grounds:

1. surveillance is only carried out for specific and legitimate purposes,
2. the purposes of the surveillance are documented, and
3. surveillance is not carried out to a greater extent than is necessary to fulfil the purposes of the surveillance.

Interest in and purpose of surveillance
NIMM considers camera surveillance to be justified because the interest in surveillance outweighs the individual's interest in not being monitored. With regard to individual privacy, camera surveillance is not the first choice for the university. We have investigated whether other measures that are less intrusive than camera surveillance could be used in our operations. We have concluded that, despite this balancing of interests, there is a need for camera surveillance. This is because both the university and its clinics are particularly vulnerable to crime. This has been documented through crime reports and other information. We have looked for alternatives to camera surveillance, but have not found any other means that are adequate for achieving the desired purpose of camera surveillance.

In order to minimise the impact on the personal privacy of the university's patients, students and staff, camera surveillance is limited to the corridors and entrances required to access the university's premises. The exception is NIMM's gym and the FSTT/simulation laboratory room, where the entire premises are monitored.

The decision on camera surveillance also aims to meet students' wishes for good access to the university's premises on both weekdays and weekends. The matter has been raised in the university's study social committee, where an agreement on the matter has been reached between the university, the student union and class representatives. Camera surveillance also aims to deter unauthorised persons from entering the university's premises, thereby increasing safety for patients, students and staff.

Individuals' right to information
NIMM has an obligation to inform those who are monitored or may be monitored about the surveillance on its own initiative. This is done through clear signage in the areas where camera surveillance takes place.

NIMM informs those who are monitored or may be monitored about the purposes of the surveillance if information about this is requested. Employers also have an obligation to document the purposes to be achieved through camera surveillance.

Employer's duty of confidentiality
NIMM has a duty of confidentiality regarding the material generated by camera surveillance. We do not disclose material from surveillance in cases other than to law enforcement authorities or a municipality or authority responsible for emergency services, provided that there is a need for the information on the part of the recipient.

Retention of material
NIMM does not store material from camera surveillance for longer than is necessary for the purpose of the surveillance. Normally, this means a maximum of two months. After that, the collected material will be automatically destroyed. Only those responsible for the alarm system have access to the material.

Responsibility
NIMM is responsible for ensuring that everyone who is monitored and may be monitored is made aware of this policy. NIMM is also responsible for ensuring that camera surveillance is conducted lawfully and in accordance with good practice.

Contact
Employees or students who have questions about this policy should first contact info@nimm.se. Patients who have questions about this policy should first contact klinik@nimm.se. If necessary, one of the following persons may be contacted.

Head of Administration
Simon Berg
08-16 01 20
simon.berg@nimm.se

Clinic Manager
Patrik Otteberg
08-16 01 20
patrik.otteberg@nimm.se