Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how GetTested International AB (“GetTested”, “we”, “us” or “our”) collects, uses, stores and shares personal data when you use:

the GetTested website and online shop;

the GetTested mobile application;

your GetTested account and customer portal;

laboratory testing and test-result services made available through GetTested;

rapid-test reading and related digital features;

health and fitness features available through the GetTested app;

customer support; and

other related GetTested digital services.

GetTested International AB is the data controller for the processing described in this Privacy Policy unless another controller is specifically identified.

Contact: hello@gettested.io

This Privacy Policy should be read together with our Terms and Conditions and any specific consent information shown to you when you use an optional feature.

2. Personal Data We Collect

The personal data we collect depends on which GetTested services and app features you use.

2.1 Account and identity information

When you create or use a GetTested account, we may collect:

name;

email address;

telephone number;

account identifiers;

date of birth or age, where required;

gender or sex where relevant to a test or service;

authentication and login information;

communication preferences; and

information you provide in your account profile.

How we collect it: directly from you when you create, update or use your account.

Why we use it: to create and manage your account, authenticate you, provide requested services, communicate with you and protect account security.

2.2 Order, purchase and delivery information

When you purchase a test, supplement or other product, we may process:

products or services ordered;

order and purchase history;

billing information;

delivery address;

payment status and transaction identifiers;

discount or promotion information;

returns and refund information; and

related customer-service records.

Payment information may be processed directly by payment providers such as Klarna or Stripe. GetTested does not necessarily receive or store your full payment-card details.

How we collect it: directly from you and from our payment, checkout, fulfilment and logistics providers.

Why we use it: to process your order, receive payment, deliver products, handle refunds and returns, provide customer service, prevent fraud and comply with accounting and other legal obligations.

2.3 Laboratory test and health information

When you register, connect or access a laboratory test through GetTested, we may process information including:

test registration information;

test or kit identifiers;

sample identifiers;

type of test performed;

laboratory results;

measured values and reference ranges;

information required to connect a test result with your account;

information you voluntarily provide in connection with the test or result; and

other health-related information generated as part of the service.

Some of this information constitutes data concerning health and therefore receives additional protection under applicable data-protection law.

How we collect it: directly from you, through the GetTested service, and from the laboratory or other testing partner performing the analysis.

Why we use it: to register tests, connect and display your results, provide the service you requested, provide customer support, maintain service security and, where separately permitted, provide optional result-related digital functions.

Where processing involves health data, we process such information only where an appropriate legal basis and an applicable condition for processing special-category data exist, including your explicit consent where required.

3. Rapid-Test Image Reading

The GetTested app may allow you to photograph or upload an image of a compatible rapid-test cassette so that the app can assist in identifying the visible control and test lines and present a result to you.

When you use this feature, we may process:

the photograph or image you take or select;

the type of rapid test being analysed;

visible test and control lines;

information required to perform the analysis;

the result generated from the image; and

technical information necessary to process the request.

A rapid-test image and the result inferred from it may constitute health-related personal data.

Camera and photo access

The app only accesses your camera or photo library after you grant the relevant device permission. GetTested does not use images accessed through these permissions for advertising, behavioural marketing or unrelated profiling.

You can deny or subsequently revoke camera or photo permissions through your device settings.

4. Use of Third-Party Artificial Intelligence Services

Certain optional features of the GetTested mobile application use third-party artificial intelligence (“AI”) services to process information submitted by the user and provide the requested functionality.

GetTested currently uses the following AI service providers:

OpenAI, through the OpenAI API. For GetTested’s EEA use, the relevant OpenAI contracting entity is OpenAI Ireland Ltd.

Google Gemini, through the Gemini API / Google Cloud services. The applicable Google contracting entity depends on the service agreement and billing arrangement used by GetTested.

These providers process information on behalf of GetTested only where required to provide the relevant AI-enabled functionality.

4.1 Information that may be sent to AI providers

Depending on the AI-enabled feature used, information sent to OpenAI and/or Google Gemini may include:

text or questions submitted by the user;

photographs or images deliberately submitted for analysis;

images of rapid-test cassettes where an AI-assisted image-analysis function is used;

the type of test or service being used;

visible information contained in an uploaded image;

laboratory-result values or other health information where this is necessary for the specific feature and has been clearly disclosed to the user;

information or answers voluntarily entered by the user;

contextual information necessary for the AI service to generate the requested response; and

limited technical information necessary to transmit, process and return the request.

Because some GetTested services relate to laboratory testing, wellness and health, information submitted to an AI feature may constitute data concerning health under the GDPR.

GetTested applies data-minimisation principles and does not intentionally send information such as a user's name, email address, delivery address, payment information or complete account history to an AI provider unless this is necessary for the specific feature and has been separately disclosed to the user.

4.2 Which AI provider receives the information

The provider receiving information depends on the particular feature being used.

Where a specific feature uses OpenAI, the user’s disclosed information is transmitted to OpenAI through the OpenAI API.

Where a specific feature uses Google Gemini, the user’s disclosed information is transmitted to Google through the Gemini API / Google Cloud service.

Where GetTested may technically route a request to either provider, the user will be informed before the information is transmitted that the information may be processed by OpenAI and/or Google Gemini.

Where reasonably possible, the consent notice presented for the particular feature will identify the specific provider used for that feature.

4.3 Purpose of the AI processing

Information is shared with an AI provider only for the purpose of performing the AI-enabled functionality requested by the user, which may include:

analysing information submitted by the user;

analysing an image submitted by the user;

generating explanations or summaries;

providing wellness-related information;

assisting with interpretation of information presented within the GetTested service; or

providing another AI-enabled function clearly described to the user before use.

AI providers are not authorised by GetTested to use personal data submitted through these integrations for advertising or behavioural marketing.

GetTested uses business or paid API services and configures available data-sharing settings so that user inputs and outputs are not voluntarily contributed for general AI model training or product-improvement purposes.

4.4 Permission before sharing data with an AI provider

GetTested does not transmit personal data to OpenAI or Google Gemini through an optional AI-enabled feature until the user has been informed of:

the type of personal data that will be sent;

whether the information may contain health data;

the AI provider receiving the information;

the purpose for which the information will be processed; and

how the information will be used,

and the user has actively chosen to allow the transmission.

Consent to AI processing is separate from general acceptance of GetTested's Terms and Conditions or Privacy Policy.

Where the information constitutes health data and consent is relied upon under the GDPR, GetTested obtains the user's explicit consent before the health data is transmitted for the relevant AI processing.

Users may decline an optional AI-enabled feature without losing access to unrelated GetTested services.

Consent may be withdrawn at any time for future AI processing. Withdrawal does not affect processing lawfully performed before consent was withdrawn.

4.5 Model training and provider use of data

GetTested uses its AI providers through business or production API services rather than through ordinary consumer AI accounts.

Under the service configurations used by GetTested, personal data submitted through the AI integrations is not intentionally shared with OpenAI or Google for the purpose of training their general-purpose AI models.

GetTested does not opt into voluntary programmes that allow API inputs, outputs or datasets containing GetTested user personal data to be contributed for general model-improvement or model-training purposes.

This restriction does not prevent an AI provider from carrying out limited processing required to operate, secure and protect its service, including fraud, abuse and security monitoring where permitted under the applicable service agreement and law.

4.6 Retention by AI providers

GetTested limits provider-side retention as far as reasonably possible and configures available retention and logging controls in accordance with the sensitivity of the information processed.

Information may nevertheless be retained by an AI provider for a limited period where required for service operation, security, abuse prevention, contractual compliance or legal obligations.

GetTested periodically reviews the retention settings available from its AI providers and seeks to use reduced-retention or zero-retention configurations where appropriate and technically available.

GetTested does not use provider-side AI conversation history as a substitute for GetTested's own customer records.

4.7 International data transfers and contractual protection

OpenAI and Google may use infrastructure, affiliated companies or subprocessors located outside Sweden or the European Economic Area.

Where personal data is transferred outside the EEA, GetTested requires an appropriate transfer mechanism under applicable data-protection law, such as an adequacy decision or European Commission Standard Contractual Clauses.

GetTested maintains appropriate data-processing arrangements with AI service providers and requires providers processing personal data on our behalf to apply contractual, organisational and technical safeguards appropriate to the nature of the information being processed.

4.8 AI and health information

AI-generated information may contain inaccuracies and should not automatically be treated as professional medical advice, diagnosis or treatment.

Where an AI feature processes health-related information, GetTested applies additional safeguards appropriate to special-category personal data.

The availability of an AI feature does not replace consultation with an appropriately qualified healthcare professional where professional medical assessment is required.

5. Health and Fitness Data

The GetTested app may offer optional features that allow you to connect health or fitness information from your device or a supported health platform, including Apple Health/HealthKit.

The app requests access only after you actively choose to use a feature requiring such information and grant the relevant device permission.

Health and fitness data accessed

Before publication, replace the following with the exact data types requested by the production app.

GetTested does not access health or fitness categories for which you have not granted permission.

How we use health and fitness data

Health and fitness information is used only to provide health, fitness or wellness functionality directly to you, such as displaying activity information, monitoring your selected metrics and providing the app functionality you request.

HealthKit and other device health or fitness data will not be used for:

• advertising;
• behavioural advertising;
• marketing profiling;
• sale to data brokers; or
• unrelated data-mining purposes.

Where device permissions can be changed through Apple Health or your device settings, you may revoke access at any time.

Revoking permission prevents future access but may not automatically delete information already lawfully stored by GetTested. You may separately request deletion as described below.

6. Device, App and Technical Information

When you use our website or app, we may process technical information such as:

• IP address;
• device type;
• operating system and app version;
• device or app identifiers;
• language and region settings;
• login events;
• crash and diagnostic information;
• security logs;
• pages or app functions accessed; and
• cookie or similar technology information where applicable.

How we collect it: automatically through our website, app, servers and authorised technical service providers.

Why we use it: to operate the service, maintain security, diagnose errors, prevent fraud and misuse, understand technical performance and improve the service.

Analytics and other non-essential tracking technologies are used only where permitted under applicable law and, where required, after obtaining consent.

Health, medical or HealthKit information is not used for advertising or behavioural analytics.

7. Customer Support

When you contact GetTested customer support, we process the information necessary to respond to your request, including your:

• name and contact details;

• account or order information;

• correspondence with us;

• support history; and

• any information you voluntarily provide.

You may choose to provide health information or test results when contacting support. Such information is processed only where necessary to assist with your request and in accordance with applicable rules for health data.

We currently use Intercom to support customer-service operations. Intercom processes relevant information on our behalf in accordance with applicable contractual and data-protection requirements.

Please avoid providing health information to customer support unless it is relevant to the issue you are asking us to resolve.