Privacy notice

Last updated:

In short: Formwren never receives or stores your clients' answers. They stay on the device and are erased when you start a new client or close the app. We only store a small account record for each clinician so we can check that only licensed health professionals use the app.

1. Who is responsible

The data controller is (org.nr. ), . Email for privacy questions: . General contact: , .

2. What we store about clinicians

Data	Why	Legal basis (GDPR)
Name, work email, professional registration number (e.g. HPR number), country, clinic name	To verify that you are a licensed health professional before the app opens, and to run your account	Art. 6(1)(b) – needed for the agreement with you. Art. 6(1)(f) – our legitimate interest in keeping the screening reliable by stopping clients from using it
Password	To sign you in. Stored only as a one-way hash by our authentication provider. We can never see it.	Art. 6(1)(b)
Account dates: created, email confirmed, approved, last sign-in, terms accepted; chosen language	Security, proof of consent to the terms, and deleting inactive accounts on time	Art. 6(1)(b) and (f)
Technical logs (IP address, time, browser) kept by the hosting provider	Security and preventing abuse	Art. 6(1)(f)
Contact form on the website: name, email, clinic, country, number of clinicians, your message	To answer you and tell you when the clinic plan launches	Art. 6(1)(f) – our legitimate interest in answering requests you send us

A registration number is public information in the national register. It is not health data.

3. What we do not store

No client or patient data. Questionnaire answers, scores, consultation notes, consent and letters are processed only in the memory of the device. They are never sent to us. If you copy a summary into your own records, your clinic is the controller of that copy.
No analytics, advertising or tracking. No third-party fonts or scripts – everything loads from our own domain.

4. Storage on your device

We only use storage that is strictly necessary for the service, so no cookie consent is needed:

nf_jwt and nf_refresh cookies and a sign-in session in local storage – keep you signed in.
formwren.access.v1 – the date your access was last confirmed, so the app works offline for up to 14 days.
formwren.pin.v1 – a hash of your clinician PIN (never the PIN itself). formwren.lang – your language.
An offline copy of the app files (no personal data).

5. Who processes the data for us

Netlify, Inc. (USA) hosts the app and runs sign-in, account storage, account emails and the website contact form as our data processor, under a data processing agreement. Transfers to the USA are protected by the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Our email provider handles messages you send to us. We never sell or share your data with anyone else.

6. How long we keep it

Email never confirmed: deleted after 30 days.
Request not approved: deleted after 90 days.
Approved account with no sign-in for 24 months: deleted automatically.
Contact form messages: deleted when the request is closed, and no later than 12 months after you sent them.
When you delete your account in the app (Account → Delete my account), it is erased immediately.

7. Your rights

You have the right to access, correct, delete, restrict or object to the use of your data, and to receive it in a portable format. You can delete your account yourself in the app. For anything else, email . We answer within 30 days.

You can complain to the Norwegian Data Protection Authority, Datatilsynet, or the authority in your own country (in Spain, the AEPD).

8. Changes

If we change this notice in a way that matters, we tell you in the app before the change applies.

Privacy notice · Terms of use · Contact