Privacy policy for AssistFai

1. Who is responsible for the data?

• Assistants, other staff, clients who receive assistance, representatives and relatives: the provider is the controller. We are the processor under the data processing agreement, which is part of the customer agreement with the provider. Ask the provider first about the data.
• Contact persons at the providers: we are the controller for the customer agreement, support and invoicing.
• Everyone who uses AssistFai: we are the controller for what we process to keep the service secure, such as logins and security logs, and for the platform's own administrators.

2. Which data is processed?

• Staff at the providers: name, personal identity number, contact details, employment, schedule, time, absence, pay, tax, bank account, competences, the data Försäkringskassan requires about the assistant and BankID signatures.
• Clients who receive assistance: name, personal identity number, decisions from Försäkringskassan and the municipality, schedule, time, journal, care plan, deviations and Lex Sarah cases, contact details and documents.
• Representatives and relatives: name, contact details and what they do in the client portal themselves.
• Contact persons and administrators: name, contact details, customer agreements, invoices and support cases.

3. Health data

Journals, care plans, deviations and sick leave are health data. The provider may process them to provide assistance under LSS and for its obligations as an employer (Article 9(2)(h) and 9(2)(b) of the GDPR). They are stored encrypted, only those with permission can read them, every reading of the journal is logged, and our support never reads journals, deviations, Lex Sarah cases or messages.

4. Who receives the data?

• The provider and the people the provider gives permission. A client sees only what the provider opens in the client portal, never pay.
• Authorities and recipients the provider sends to: Försäkringskassan, Skatteverket, municipalities, the bank (the payroll file), Fora or Pensionsvalet, and Fortnox or Kivra if the provider connects them.
• Our sub-processors: Hetzner Online GmbH (servers in the EU), Finansiell ID-Teknik BID AB (BankID), Apple and Google (notifications to the app) and OpenAI if the provider imports a schedule from another system — names are then replaced by codes before the text leaves our servers. Email is sent from our own mail server and SMS through our own SMS service.
• Authorities when the law requires it.

The data is stored and processed in the EU/EEA. Notifications are delivered by Apple and Google, and OpenAI may process the coded schedule text outside the EU/EEA; this happens with the safeguards the GDPR requires. We never sell personal data or share it for marketing.

5. How long is the data kept?

• As long as the provider uses AssistFai, and according to the provider's instructions and the law.
• The journal is deleted two years after the last entry, unless the provider must keep it longer.
• Lex Sarah cases are kept at least five years after they were closed.
• Pay and bookkeeping are kept as long as the Bookkeeping Act requires, until the end of the seventh year after the financial year.
• Files in the trash are deleted after 30 days.
• When the customer agreement ends we delete the provider's data under the data processing agreement; what the law requires is kept as long as the requirement applies.

6. The web, the app and notifications

• No tracking: AssistFai uses no analytics, advertising or tracking tools.
• Cookies: only necessary cookies for the login, for browsers you have confirmed and for your own choices such as language and appearance.
• The app keeps the login for 30 days from its last use, locks with Face ID or a fingerprint entirely on the phone, and stores the notification token if you allow notifications. Notifications about messages name the sender, never the content.

7. Your rights

You have the right to know which data is processed about you and get a copy, have errors corrected, have data deleted, restrict or object to the processing, and receive data you provided yourself in a machine-readable format. The right to deletion does not cover what must be kept by law. For data the provider is responsible for, contact the provider; we help the provider answer.

If you are unhappy with how your data is processed, you can complain to the Swedish Authority for Privacy Protection (imy.se).

8. Security

All traffic is encrypted (HTTPS). Sensitive data and files are stored encrypted, passwords only as hashes, and a new browser is confirmed with a code. Everyone sees only what their permissions allow. To help a provider, our support can open the provider's account; that is logged, and support never reads journals, deviations, Lex Sarah cases or messages.

9. Contact and changes

Tizfai Technologies AB, org.nr 559284-7379, Kumminvägen 1, 611 46 Nyköping. Email: info@tizfai.com. We publish changes here with a new date and version number, and tell the providers about larger changes.