Privacy & Cookie Policy
Last updated: 21 October 2026
This policy explains how GB Obesitas Skåne AB collects and uses your personal data when you visit info.gbobesitas.com, contact us, request a discovery call or guide, or become a patient. It applies to visitors and patients in Ireland, the United Kingdom and elsewhere.
1. Who we are
The data controller is:
GB Obesitas Skåne AB
Skeppsbron 11, 211 20 Malmö, Sweden
Company registration no.: 559178-1728
Email: info@gbobesitas.com
Data Protection Officer, info@gbobesitas.com
2. The information we collect
Information you give us
- Contact details: name, email address, phone number, postcode/Eircode or county.
- Enquiry details: your preferred callback time, how you heard about us, and messages you send us.
- Health information: for example, whether you have used weight-loss medication, your weight-loss history, and other details you choose to share about your health. This is “special category” data and we only process it with your explicit consent (see section 4).
- Patient information: if you go ahead with treatment, we collect medical history, test results, consultation notes, identification, travel and payment details needed to provide your care.
Information collected automatically
- IP address, device and browser type, pages viewed, and referring website.
- Cookie and similar technology data, only where you have consented (see section 9).
Information from others
- Your GP or other healthcare providers, where you ask them to share records with us.
- Advertising platforms, which may tell us an enquiry came from an ad. They do not share your health information with us.
3. How we use your information
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and arranging your discovery call | Steps at your request before entering a contract (Art. 6(1)(b)); explicit consent for any health data (Art. 9(2)(a)) |
| Assessing whether surgery may be suitable for you | Explicit consent (Art. 9(2)(a)) |
| Providing surgery, aftercare, dietitian support and supplements | Contract (Art. 6(1)(b)); provision of healthcare (Art. 9(2)(h)) |
| Keeping patient records as required by Swedish law | Legal obligation (Art. 6(1)(c)); healthcare (Art. 9(2)(h)) |
| Sending you marketing emails or messages | Consent (Art. 6(1)(a)). You can withdraw it at any time. |
| Website analytics and advertising measurement | Consent via our cookie banner (Art. 6(1)(a)) |
| Website security, fraud and spam prevention | Legitimate interests (Art. 6(1)(f)) |
| Handling complaints and legal claims | Legitimate interests (Art. 6(1)(f)); legal claims (Art. 9(2)(f)) |
4. Your health information
When you submit a form that asks about your health, we ask for your explicit consent. We use this information only to understand your situation, assess suitability and prepare for your call. We never use your health information for advertising, and we do not share it with advertising platforms.
You can withdraw consent at any time by emailing info@gbobesitas.com. This does not affect processing already carried out, and we may still need to keep records we are legally required to retain.
5. Who we share your information with
We do not sell your personal data. We share it only where necessary with:
- Our clinical team in Malmö, including surgeons, physicians, nurses and dietitians.
- Fitforme, for supplements and dietitian support, if you become a patient.
- Service providers who process data on our behalf under contract:
- website hosting: Vultr.com
- CRM and email: WordPress.com and Mailgun
- phone and messaging: Meta / Facebook Messenger
- Google and Meta, only for analytics and ad measurement where you have accepted cookies. We do not send them form contents or health data.
- Meta (Facebook Messenger), if you choose to contact us that way. Those messages are also subject to Meta’s own privacy policy.
- Your GP or other healthcare providers, with your agreement, for continuity of care.
- Authorities, regulators or advisers, where required by law.
6. International transfers
We are based in Sweden (EU). The UK and EU recognise each other’s data protection standards, so transfers between Ireland, the UK and Sweden are covered.
Some providers, such as Google and Meta, may process data in the United States. Where this happens, we rely on the EU–US Data Privacy Framework (and the UK Extension) or Standard Contractual Clauses. You can contact us for a copy of the relevant safeguards.
7. How long we keep your information
- Enquiries that do not lead to treatment: 24 months from your last contact, then deleted.
- Patient records: at least 10 years after the last entry, as required by the Swedish Patient Data Act (Patientdatalagen).
- Marketing consent records: until you unsubscribe, plus the period needed to prove consent.
- Cookie data: see section 9.
8. Your rights
Under the GDPR and UK GDPR you have the right to:
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted, where we are not legally required to keep it;
- restrict or object to our processing;
- receive your data in a portable format;
- withdraw consent at any time;
- not be subject to decisions based solely on automated processing. We do not make such decisions.
To exercise any right, email info@gbobesitas.com. We will respond within one month.
Complaints. You can complain to a data protection authority. Our lead authority is in Sweden, but you can also contact your local one:
- Sweden: Integritetsskyddsmyndigheten (IMY), imy.se
- Ireland: Data Protection Commission, dataprotection.ie
- UK: Information Commissioner’s Office, ico.org.uk
We would appreciate the chance to resolve your concern first.
9. Cookies
Cookies are small files stored on your device. We use strictly necessary cookies without consent. We only use analytics and marketing cookies if you accept them.
You can change your choice at any time via Cookie settings.
| Category | Provider | Purpose | Duration |
|---|---|---|---|
| Strictly necessary | GB Obesitas | Security, form submission, remembering your cookie choice | Session – 12 months |
| Analytics | Google Analytics (_ga, _ga_*) | Understanding how visitors use the site | Up to 2 years |
| Marketing | Google Ads (_gcl_au) | Measuring ad conversions | 90 days |
| Marketing | Meta Pixel (_fbp, _fbc) | Measuring Facebook/Instagram ads and showing relevant ads | 90 days |
You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site working.
10. Security
We protect your data with appropriate technical and organisational measures, including encrypted (HTTPS) connections, access controls and staff confidentiality obligations. Health information is accessible only to staff who need it to provide your care.
11. Children
Our services and this website are intended for adults aged 18 and over. We do not knowingly collect data from children.
12. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top shows when it was last changed. Significant changes will be highlighted on this page.
13. Contact us
GB Obesitas Skåne AB
Skeppsbron 11, 211 20 Malmö, Sweden
Email: info@gbobesitas.com
Phone: 0706-024056
