This booking page is provided by Joy Solutions AB (reg. 559435-7971, Kostergränd 4A, 211 75 Malmö, Sweden — "Joy", "we") on behalf of the practice you are booking with (the Practice, shown on this page). This notice explains what we collect, who is responsible, and your rights.
Who is responsible for what
Your information is handled by two parties, each responsible for a different part:
- The Practice is the data controller for your booking and for any health information you choose to share. The Practice is your care provider and decides why your data is collected. Joy acts as the Practice's data processor for this data — we only handle it on the Practice's instructions, under a written data processing agreement.
- Joy is the data controller for operating, securing and maintaining the booking platform itself (technical and usage data only). We are not a healthcare provider and do not provide medical advice or care. The platform layer we control does not use or process the content of your free-text message or your reason for visit — that content is handled only for the Practice, as its processor.
You can contact the Practice using the details shown on this booking page, or Joy at dpo@joy.day. If you contact the wrong party, we'll route your request to the right one.
Who can book, and bookings for children
You must be 18 or older to make a booking. If you are booking an appointment for a child under 18, you confirm that you are their parent or legal guardian and that you have the authority to provide their information to the Practice — including, if you choose to share it, health information about the child. Where this notice refers to "your" information and consent, that includes information about, and consent given on behalf of, a child you are booking for.
What we collect
- Contact details you provide — name, email, phone.
- Appointment details — the time, service and practitioner you select.
- Anything you write in the free-text field. This field is optional. You do not need to share any health information or reason for visit to book. If you choose to write health-related details, we treat that as special-category data (see "Health information").
- Technical data — limited information (e.g. IP address, device/browser data) needed to run and secure the page. This booking page uses only essential cookies — no analytics or advertising cookies — so no cookie consent banner is shown.
Why, and the legal basis
Health information
Because the Practice is a healthcare provider, anything you write that reveals your health, condition or reason for visit is special-category data. It is only processed on the basis of your explicit consent, given at the point of booking, and only to handle your booking. You can withdraw consent at any time by contacting the Practice — withdrawal doesn't affect processing already done. Prefer not to share such details here? Leave the free-text field blank.
Who else sees your data
- The Practice's staff involved in your appointment.
- Joy's sub-processors (e.g. cloud hosting), solely to run the service, bound by data protection terms. Your booking data is stored and processed within the EU/EEA.
We do not sell your data or use it for advertising. Joy may produce aggregated statistics that cannot identify you — see "Aggregated statistics" below.
Aggregated statistics
Joy may combine data across many bookings and practices to produce aggregated statistics — for example, overall usage volumes or performance trends. These statistics are produced to a standard where you cannot reasonably be re-identified, and any group too small to protect an individual's identity is suppressed. Once data has been aggregated to this standard it is no longer personal data, and Joy may use it to operate, maintain, secure and improve the service. Joy does not use identifiable booking content for its own purposes.
How long it's kept
Your booking data is kept according to the Practice's instructions. When the Practice ends your patient relationship or closes your record, your booking data is deleted. If a booking does not lead to an appointment — for example, it is declined or never proceeds — it is deleted after a set period on the Practice's instruction, so your information is not kept indefinitely. Joy retains technical/usage data only for a short period for security and service operation. If you withdraw consent for health information, it is deleted unless the Practice is legally required to retain it.
International transfers
Your booking data is processed within the EU/EEA. If you are in the United Kingdom, the transfer of your data to the EEA is covered by UK adequacy regulations, so no additional transfer mechanism is required. In the event Joy ever needs to process booking data outside the EU/EEA, it will first put in place an appropriate safeguard required by GDPR or UK GDPR (such as the European Commission's Standard Contractual Clauses or the UK's transfer tools).
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and — where processing relies on consent — to withdraw consent at any time. For booking and health data, contact the Practice; for platform/technical data, contact Joy at dpo@joy.day. Either party will help route your request.
You can also complain to a data protection authority:
- EU: your national supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY).
- UK: the Information Commissioner's Office (ICO), ico.org.uk.
Changes
We may update this notice. The current version is always available on the booking page.