Draft privacy policy, to be reviewed by a lawyer before launch. Details in square brackets are filled in when the company exists.
Privacy policy
Last updated 2026-10-25
Who is responsible
Mesial is run by [company name], company number [number], [address]. We are the controller for your account, the marketplace and the services you use as a member.
When you book a course, the organizer sells and runs it. The organizer is the controller for your details as a participant, and Mesial processes them on the organizer's behalf as a processor, under a data processing agreement in the terms for organizers.
Questions about your personal data: write to [email address for data protection].
What data we process
Account: name, email address, password (only as an encrypted value), profession, country and language.
Bookings: courses you booked, participants, payment method and amounts, invoice details when you book on invoice, and cancellations and refunds.
The course day: attendance, check-in and sessions you signed up for.
Diet and allergies: only if you give them and consent, and only for that course.
Training: your courses, hours and certificates, and courses you add yourself.
Clinic: if you work at a clinic that uses Mesial, what you choose to share with the clinic.
Lecturers and CVs: what you put in your profile or CV yourself, and who may see it.
Technical: sign-ins and security logs. We do not keep your IP address together with what you do on the pages.
Why, and on what basis
To give you your account and carry out bookings (contract).
To keep the accounts and report as the law requires, such as bookkeeping rules and the reporting rules for platforms, DAC7 (legal obligation).
For security, troubleshooting and preventing misuse (legitimate interest).
Diet and allergies, and sharing training with a clinic, only with your consent, which you can withdraw at any time.
Newsletters and course alerts are sent only if you chose them.
Who receives the data
The organizer of the course you book, and the clinic you chose to share with.
Suppliers that help us run the service: hosting in the EU, email and payment. They get only what is needed and are bound by agreements.
Authorities when the law requires it.
We never sell personal data and show no advertising based on it.
Where the data is
The data is stored in the EU/EEA. Should a supplier need to process data outside the EU/EEA, it happens only with the safeguards the GDPR requires.
How long we keep it
Your account stays until you close it.
Participant details are deleted by the organizer's rules, five years after the course by default. Diet and allergies are deleted after the course.
Accounting records are kept for seven years as the law requires.
Free text in evaluations is deleted after five years; evaluations are anonymous.
Your rights
You have the right to know what data we hold about you, to have it corrected or erased, to restrict or object to the processing, and to receive it to move it elsewhere (data portability).
For your details as a participant at an organizer, we help the organizer answer.
If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or the authority where you live.
Cookies
We use only the cookies the service needs. Read more on the cookies page.
Changes
If the policy changes in a way that affects you, we tell you in the service or by email before the change applies.