Privacy Policy

Hodoscope turns your medical scan into artwork. We take the privacy of that data seriously, because your scan is among the most personal information there is. This policy explains what we collect, why, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The data controller is Carl-Gustav AB (org.nr 559344-8276), 442 31 Kungälv, Sweden ("Hodoscope", "we"), a Forge Nord project. Privacy contact: privacy@hodoscope.com.

2. What this covers

Two stages, deliberately kept separate:

• Waitlist (now). We collect only your email address and your consent to be contacted.
• The service (at launch). When you order artwork, we additionally process your uploaded scan and order/delivery details. The scan sections below apply only from that point.

3. What we collect, why, and our legal basis

Data	Purpose	Legal basis (GDPR)
Email + consent (waitlist)	To email you once when Hodoscope launches	Consent — Art. 6(1)(a). Withdraw anytime via the unsubscribe link.
Uploaded scan (DICOM/image) — health data	To create the artwork you order	Explicit consent — Art. 9(2)(a), plus contract — Art. 6(1)(b). Special-category data.
Order & delivery details	To fulfil and ship your order	Contract — Art. 6(1)(b).
Basic analytics (e.g. UTM tag of the link you arrived from)	To understand which campaigns work	Legitimate interest — Art. 6(1)(f).

We do not need — and do not ask for — your name, date of birth or medical record number to make art. Identifying tags embedded in a scan file are stripped on upload.

4. How long we keep it

• Waitlist email: until you unsubscribe, or until a reasonable period after launch, whichever is first.
• Uploaded scans: automatically deleted 30 days after your order is fulfilled, unless you ask us to keep them for reorders.
• Finished artwork files: kept only if you opt in for reorders.
• We delete any of the above sooner on request (see section 7).

5. Who we share it with

We never sell your data. We share the minimum necessary with vetted processors under a data processing agreement:

• Hosting — EU-based infrastructure that stores the site and your files.
• Print partner — receives only the finished artwork and your shipping address, never your scan, to print and ship physical orders.
• Email delivery — to send the launch email and order updates.

6. Where it's stored & security

Your data is stored on servers in the EU. If any processor operates outside the EU/EEA, we rely on European Commission Standard Contractual Clauses. We protect data with encryption in transit and at rest, access controls, and data minimisation.

7. Your rights

Under the GDPR you can, at any time: access your data; correct it; have it erased; restrict or object to processing; receive a portable copy; and withdraw consent (which is as easy as giving it). To exercise any of these, email privacy@hodoscope.com.

You also have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) — imy.se.

8. Cookies

The waitlist page sets no tracking cookies. We read the campaign tag (UTM) from your link only to attribute sign-ups to a campaign; it is not used to profile you.

9. This is an art service — not medical

Hodoscope does not provide medical interpretation, diagnosis, screening or advice, and its images must not be relied on for any medical purpose. For anything about your health, please speak to a qualified healthcare professional.

10. Changes

We'll update this page if our practices change and revise the date above.