Privacy policy Zymego - Introduction
CodeZyme AB ("CodeZyme", "we", "us" and "our"), reg. no. 559171-0438, process personal data as part of the provision of our services, named Zymego. CodeZyme is a Swedish company with customers and operations in various countries primarily within Europe and the UK. Your integrity is important to us, and we take the protection of your personal data and your personal integrity seriously. We therefore strive towards always protecting your personal data in the best possible way in accordance with applicable data protection laws and regulations. Through this privacy policy, we want to inform you about how we process your personal data.
Processing on behalf of a healthcare provider - data processor
When using Zymego, CodeZyme processes personal data about you on behalf of your healthcare provider to make it easier for you to manage and change your booked appointment with the respective healthcare provider. This processing also includes administration and management of your Zymego account, support matters, and messages sent to you about your appointments. In these situations, the healthcare provider is the data controller for the processing of your personal data and CodeZyme processes data on behalf of the healthcare providers as a data processor. CodeZyme's processing of personal data in such situations is limited to what is necessary to manage appointments on behalf of the healthcare providers. For further information about the processing carried out in such situations, we refer to the respective healthcare providers’ Privacy Policies as the healthcare provider acts as the data controller for such processing. CodeZyme enters into data processing agreements with all its customers (i.e., the healthcare provider) that governs our processing of your personal data on behalf of the healthcare provider. This Privacy Policy describes the processing of your personal data that CodeZyme carries out on behalf of your healthcare provider.
Data controller
CodeZyme does not act as data controller for personal data about patients using Zymego. Before you log in, whether with NHS login or One-Time Password (OTP), you select your healthcare provider or arrive through a link provided by your healthcare provider. All processing of your personal data in Zymego, including the processing required to log in, is therefore carried out on behalf of that healthcare provider. If you cannot be matched to a patient record at that healthcare provider, your personal data is deleted within 1 day.
This Privacy Policy, and the information below, applies to the processing of your personal data that CodeZyme carries out on behalf of your healthcare provider.
What data do we process about you and why?
CodeZyme, as the Processor, is authorised by the Controller to manage certain types of Personal Data. This includes the unique identifiers for both the patient and the practitioner, the name of the individual, the date and time of the booking, as well as the type of booking and account information including contact details and information provided by you in connection with support matters. On behalf of your healthcare provider, CodeZyme processes your personal data as set out below.
User account
Purpose: To administer your use of Zymego and your account in the service.
Lawful basis: The lawful basis for the processing is determined by your healthcare provider as the data controller. Please see your healthcare provider's privacy policy
Categories of personal data processed: Your name and your contact details and other information provided by you in support matters.
Retention period: Your data is stored as long as you are a user of Zymego. All personal data of users who have not logged into the service for 24 months will be deleted.
NHS login: Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS login’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.
One-Time Password (OTP) login: Please note that if you access our service using OTP login, the processing of your personal data required to log in to the service is also carried out on behalf of the healthcare provider you have selected, or that provided the link to the service, as data controller.
Who can access your personal data?
Your personal data will be processed by CodeZyme on behalf of your healthcare provider. When you manage a healthcare appointment through Zymego, your appointment is updated in your healthcare provider's own systems in order to place and secure your booked appointment. Your healthcare provider is the data controller for this personal data.
In addition, your personal data may be shared with third parties who process personal data on the healthcare provider's behalf, so-called sub-processors, such as our supplier of IT-services and other system suppliers that may have access to your personal data.
Our sub-data processors are:
- Google Cloud, for cloud computing services.
- Microsoft Azure, for SMS and emails.
- Clever Cloud, for hosting of support and logging services.
Transfer of personal data to third countries
As a principal rule, we, our suppliers and our partners strive to process your personal data only within the UK and the EU/EEA.
Processing within the UK
When you use Zymego, your personal data is, as a principal rule, processed within the UK.
Processing within the EU/EEA
When we need to access your personal data for specific purposes, including but not limited to maintenance, issue resolution and support, your personal data will primarily be processed within EU/EEA, on the instructions of your healthcare provider. The UK recognises the EU/EEA as providing an adequate level of protection for personal data.
Processing outside the UK or EU/EEA
In cases where personal data is processed outside the UK or EU/EEA, such processing is either based on UK adequacy regulations establishing that the country in question ensures an adequate level of protection or appropriate safeguards that ensure that your rights are protected.
If you wish to obtain a copy of the safeguards we have put in place, information on where they have been made available or any other more detailed information in relation to where and how we process and transfer your personal data, please contact us as set out below.
Your rights
As your healthcare provider is the data controller, please contact your healthcare provider to exercise the rights described below. If you contact us, we will forward your request to your healthcare provider and assist them in responding to it.
Right to access (Article 15 UK GDPR) and right to rectification of processing (Article 16 UK GDPR)
You have the right to access information about the personal data we process about you and the right to request the rectification of your personal data. You also have the right to obtain a copy of the personal data processed by us as well as information about our processing of your personal data.
Right to erasure (Article 17 UK GDPR)
You have the right to obtain erasure of your personal data, if any of the following applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
- you object to the processing pursuant to Article 21.1 UK GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21.2 UK GDPR,
- the personal data have been unlawfully processed, or
- the personal data has to be erased for compliance with a legal obligation in UK law that applies to us.
Please note that our obligation to erase and inform according to above shall not apply to the extent processing is necessary:
- for exercising the right of freedom of expression and information,
- for compliance with a legal obligation which requires processing by UK law which applies to us, or
- for the establishment, exercise or defence of legal claims.
Right to restriction of processing (Article 18 UK GDPR)
You have the right to obtain restriction of the processing of your personal data if any of the following applies:
You have the right to obtain from us restriction of the processing of your personal data if:
- the accuracy of the personal data is contested by you, during a period enabling us to verify the accuracy of the personal data,
- you have objected to processing pursuant to Article 21.1 UK GDPR pending the verification whether our legitimate grounds override yours,
- the processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of their use, and
- you need the personal data for the establishment, exercise or defence of legal claims even though we no longer need the personal data for the purposes of the processing.
Right to data portability (Article 20 UK GDPR)
If you have given your consent, or if we base the processing on a contract with you, you have the right to obtain the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller or to obtain our assistance in transmitting it to another controller where technically feasible.
Right to object (Article 21 UK GDPR)
When the processing of your personal data is based on a balancing of interest, you also have the right to object at any time to the processing of your personal data. We may refuse such request if we can demonstrate compelling legitimate grounds for such processing that overrides your interests.
Right to lodge a complaint with a supervisory authority (Article 77 UK GDPR)
If you have any complaints regarding our processing of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office, the Swedish Data Protection Authority or any other competent supervisory authority that supervises the processing of personal data by companies.
Contact us
If you wish to exercise your rights as set out above or otherwise wish to contact us regarding our processing of your personal data, you can do so by contacting us by e-mail support@zymego.com.
Data Protection Officer
This privacy policy was last updated by CodeZyme AB on 15 October 2026.
