Vi bruker cookies for å forstå hvordan nettstedet brukes, men kun hvis du godtar det.

Hopp til hovedinnhold

Privacy Statement

Information about the processing of personal data by Braive

Last updated
August 28, 2026

1. About this Privacy Statement

The contents of this Privacy Statement: This Privacy Statement details the processing of your personal data by Braive. It explains how we collect, store and use your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and other, to us, applicable data protection law (as amended from time to time).

Why this Statement: Braive AS is established in Norway and Braive AB in Sweden and accordingly subject to GDPR. Under the GDPR the controller (see below) of personal data is required to provide certain information about its processing of personal data. We, thus, wish to inform you about the processing of your personal data by these two entities, to the extent that is collected and processed by us, all as further detailed in this Privacy Statement.

Applicability: The Privacy Statement applies to the processing of personal data by Braive as a result of:

  •    your visit to the public website(s) of Braive, that is as a visitor,
  •    you register for use, or log on and use, any services offered by Braive via its website(s), and
  •    you have downloaded our app and through it register for use, or log on and use, any services offered by Braive via its app internet-based platform

Collectively the services offered by Braive are called the ‘Braive Service‘ in this Privacy Statement . From time to time, we may develop new, or offer additional, services. They’ll also be subject to this Privacy Statement, unless stated otherwise when we introduce them

Cookies Statement: Information on how we use cookies and how to manage your cookie preferences is to be found in our separate Cookies Statement [here] (cookies are small files saved on your phone, tablet or computer when you visit a website).

Other resources: Information about your personal data is provided right here in this Privacy Statement.

Additional information: In addition to this Privacy Statement and its contents Braive may from time to time provide you with additional information regarding certain processing of your personal data in a specific context. Such additional information supplements and should be read together with this Privacy Statement.

This Privacy Statement is not the Braive Terms of Service, which is a separate document. The Braive Terms of Service is the agreement between you and Braive for using any Braive Service. Among other things, it describes the rules of Braive which you must follow.

2. Roles – types of Braive interaction and respective data controller

Controller. Who the controller of your personal data collected and processed by Braive is will depend on your access to the Braive Service. In short, by Braive we mean the company Braive AS and it is the controller, unless as provided as follows we mean Braive AB.

Braive AS (Norwegian company, contact details below) is a controller in the following situations:

Visitor – personal data collected and processed when you visit our website(s), not logging in

Unguided User – personal data collected and processed when you register and use Braive Service as a logged in user, but have not connected to a therapist in the Braive Service via a Health Care Provider.

Guided User – personal data collected and processed when you register and use Braive Service as a logged in user, and are connected to a therapist in the Braive Service via a Health Care Provider, and your enrolment is due to an agreement between Braive AS and your Health Care Provider.

Unguided User, after having been a guided one – if you have been a Guided User and you, after being disconnected from a therapist, choose to continue to use the Braive service, Braive will continue to be the controller.

Braive AB (Swedish company, contact details below) is controller in the following situation:

Unguided User –  personal data collected and processed when you register and use Braive Service but have not enrolled with a therapist in the Braive Service via Partner Entity.

Guided User –personal data collected and processed when you register and use Braive Service and are enrolled with a therapist in the Braive Service, and your enrollment is due to an agreement between Braive AB and your Health Care Provider.

Unguided User, after having been a guided one – if you have been a Guided User and you, after being disconnected from a therapist, choose to continue to use the Braive service, Braive will continue to be the controller.

You can get access to Braive’s platform as a self-paying individual, or through a Partner Entity and/or a Health Care provider.

Accessing the Service as an unguided user through a Partner Entity. Examples of Partner Entities include employers, insurance companies and/or other partnerships where you, as an employee or customer of the Partner Entity, can access the Braive service free of charge. For example, Braive signs an agreement with an insurance company and as long as you, as an insurance customer, remain an unguided user on the platform via your insurance, Braive[AS12]  is the controller.

Controller to Controller with Health Care Providers. When you are a Guided User you will have a therapist to interact with through the Braive Service. Therapists access Braive’s platform through an agreement between the Health Care Provider, for which the therapist works, and Braive AS or AB (determined above). Such Health Care Provider and Braive are both to be regarded as controllers for your personal data processed in the Braive Service to the extent that the therapist is the creator of such personal data, or to the extent the therapist initiates any activity in which you share any personal data with the therapist.

Your designated Health Care Provider/therapist will have access to your personal data in the Braive Service for as long as you remain a Guided User (see hereabout in more detail below as regards to which data).

As between the designated Health Care Provider/therapist and Braive, the Health Care Provider has found that Braive and the Braive Service meet its data protection requirements.  The parties have entered into an agreement which shall make it possible for the Health Care Provider/therapist to access and use the Braive Service to provide its services to you and, thus, use the Braive Service to interact with you. It is Braive that has undertaken to inform you about the processing of your personal data within the Braive Service and it is Braive you should contact as regards the exercising of the rights you have as a data subject under the GDPR (see below for more information on your rights).

The Braive Service is not the Health Care Provider/therapist medical record keeping system or similar. You should, however, be aware that the Health Care Provider/therapist has legal obligations to keep records of its patients and dealings with its patients, which it will fulfil by other means than the Braive Service. For such processing outside of the Braive Service, the Health Care Provider/therapist is the controller and not Braive. Please, seek information from the Health Care Provider as to its processing of your personal data if you require such information.

Braive is not a processor. Braive is not a processor to a Partner Entity or Health Care Provider/therapist in regard to your personal data processed within the Braive Service. In short, you enter into an agreement with us and under that agreement we provide you with Braive’s treatment programs in the Braive Service. Furthermore, you can determine how your personal data is to be utilised as further set out in this Privacy Statement and your agreement with Braive, not the Partner Entity or Health Care Provider/therapist. The Service will give the Health Care Provider means to communicate with and take part of its patient’s progress in his or her treatment program, but individuals can independently of any Health Care Provider (Unguided User) also use the Braive Service as self-care and this without direct communication with any therapist.

Braive is a processor: For the management of therapists’ data, which includes user ID and their communication with patients, is carried out on behalf of the Health Care Provider, and in such management, Braive acts as a data processor for the Health Care Provider. As between the designated Health Care Provide and Braive, the parties have entered into an agreement which shall make it possible for their therapists to access and use the Braive Service to provide care and to interact with you.

Braive reserves the right to use the data generated as a result of this collaboration in a purposeful manner in relation to, (but not limited to) product development and the production of statistics.

3. Source(s) of personal data

Braive collects personal data in the course of providing the Braive Service to you. It is this personal data that is processed within the Braive Service.

Here are the sources of the data we collect and process (find more on detailed data tables under 4.Purpose and legal basis for processing):

Personal Data you provide to us: We collect the personal data you provide in relation to your use of the Braive Service.

Automatic registration: We automatically collect certain data when you interact with the Braive Service.

Your activity generated results: We collect the personal data that amounts to your results from carrying out the different tests, assignments and assessments provided to you within the Braive Service.

Information from other sources: We receive personal data that relates to you from other sources.  

4. Purpose and legal basis for processing

Under the GDPR Braive is, as controller, obliged to inform you of the purpose(s) for which Braive processes personal data of yours and the legal basis for such processing. This information is thus, presented in tables under the headings: Purpose, Personal data and Legal basis.

Please note that by “legitimate interest” we mean the legal basis of a balance of interest as provided under the GDPR article 6.1f. In short, in such cases we have determined processing is necessary for the purposes of the legitimate interests pursued by us (or by a third party), and where such interests are not overridden by the interests or fundamental rights and freedoms of yours which require protection of personal data.

4.1 Visitor

Personal Data you provide to us

To communicate with you, when you fill in a contact form or similar on our website
  • Processed personal data (categories): The personal data you provide in contact form (e.g. name, contact details)
  • Legal basis: Legitimate interest.
    • Interest pursued: to communicate with you to offer our services and otherwise attempt to answer your questions.
  • Data retention: 3 months

Your activity generated results

Cookies – When you visit our website(s) we collect cookies – please refer to our cookie Statement and any consent granted in connection thereto. In addition to cookies the following processing may occur if you visit our website(s)
  • Processed personal data (categories): See Cookie Statement
  • Legal basis: Consent or legitimate interest as further determined in our cookie Statement
  • Data retention: The time during which we store cookies depend on which cookie that is placed on your device. Permanent cookies remain on your device until you delete them, or the expiry date passes and you return to our service. Session cookies do not have an expiration date and are stored temporarily on your device during the time you visit our service. Possible session cookies are removed when you close your browser. Read more about our cookies in our cookie Statement.

4.2 Unguided User

The following personal data may be processed when you are an Unguided User.

Personal Data you provide to us

To allow you to register for, log into the Braive Service, control access to your account, and to manage your account and keep it in working order
  • Processed personal data (categories):
    • Name
    • Email address
    • Personal Identity number if you choose BankID to create your account
    • Confirmation that you agreed to Terms of Service
    • Your choice of consenting or denying to your pseudonymised data being used for research
  • Legal basis: Performance of a Contract
  • Data retention: For the duration of your continuous use of the Braive Service, as we need to keep this data for you to be able to continue your use of Braive.
To communicate with you, when you fill in a contact form, survey, or similar on the Braive Service
  • Processed personal data (categories): The personal data you provide in contact form (e.g. name, contact details)
  • Legal basis: Legitimate interest
    • Interest pursued: to communicate with you to offer our services and otherwise attempt to answer your questions.
  • Data retention: For the duration of your continuous use of the Braive Service
To provide you with all program and toolbox tools of the Braive Service
  • Processed personal data (categories): The personal data you choose to provide in the programs and tools, such as journal and sleep data.
  • Legal basis: Consent (If you do not consent do not enter data!)
  • Data retention: For the duration of your continuous use of the Braive Service
To allow you to control certain aspects of the Braive Service, such as user settings, notifications, language, therapist etc., in your user settings
  • Processed personal data (categories):
    • Name
    • Email address
    • Language
    • Therapist that you are connected to
  • Legal basis: Legitimate interest
    • Interest pursued: to allow you use the Braive Service as intended and expected.
  • Data retention: For the duration of your continuous use of the Braive Service

Automatic registration

1) Monitoring of the technical function and to increase the operational security of our web service. 2. Delivery and provision of the website
  • Processed personal data (categories): Technical connection data of server access (IP address, date, time, requested page, browser information), Email, User ID. Log data on your use of the Braive Service and functions, including:
    • date, time, log-in history
    • URL information
    • online identifiers such as cookie data and IP addresses
    • information about the devices you use such as: network and device performance, browser type, language setting on device, operating system, Braive application version
  • Legal basis: Legitimate interest
    • Interest pursued: economic interest in safe and functioning operation of the technical systems through which services are provided.
  • Data retention: 30 days
To anonymise and create statistics: To develop new technical features in and for the Braive Service. To understand user behaviour and needs. We may identify and analyse usage trends, including for the purposes of research, and reporting on a non-individual basis. This may include creation of graphs with demographic information and psychometric test results on group levels, derived from Mental Health Check surveys and treatment progress- and outcome data
  • Processed personal data (categories): Log data on your use of the Braive Service and functions, including:
    • User ID
    • date, time, log-in history
    • URL information
    • online identifiers such as cookie data and IP addresses
    • information about the devices you use such as: network and device performance, browser type, language setting on device, operating system, Braive application version
  • Legal basis: Legitimate interest
    • Interest pursued: user centred and valuable development of the Braive Service
  • Data retention: 1 day

Your activity generated results

To evaluate and develop suggested therapeutic interventions. Completing the Mental Health Check
  • Processed personal data (categories):
    • User ID
    • Result of the Mental Health Check (severity level, and symptoms showing)
  • Legal basis: Consent
  • Data retention: 1 day

Information from other sources

To authenticate you when you register for, and log into the Braive Service using BankID, that service will send your information to us. This information is needed to create and identify your account with us through BankID.
  • Processed personal data (categories):
    • Name
    • Personal identification number
  • Legal basis: Performance of a Contract
  • Data retention: For the duration of your continuous use of the Braive Service, unless you choose another login method, in which case the personal identification number will be deleted immediately.

4.3 Guided User

The following personal data may be processed when you are a Guided User.

Personal Data you provide to us

To allow you to register for, log into the Braive Service, control access to your account, and to manage your account and keep it in working order
  • Processed personal data (categories):
    • Name
    • Email address
    • Personal Identity number if you choose BankID to create your account
    • Confirmation that you agreed to Terms of Service
    • Your choice of consenting or denying to your pseudonymised data being used for research
  • Legal basis: Performance of a Contract
  • Data retention: For the duration of your continuous use of the Braive Service, as we need to keep this data for you to be able to continue your use of Braive.
To communicate with you, when you fill in a contact form or similar on the Braive Service
  • Processed personal data (categories): The personal data you provide in contact form (e.g. name, contact details)
  • Legal basis: Legitimate interest
    • Interest pursued: to communicate with you to offer our services and otherwise attempt to answer your questions.
  • Data retention: For the duration of your continuous use of the Braive Service
To provide you with all program and toolbox tools of the Braive Service
  • Processed personal data (categories): The personal data you choose to provide in the programs and tools, such as journal and sleep data.
  • Legal basis: Consent (If you do not consent do not enter data!)
  • Data retention: For the duration of your continuous use of the Braive Service
To allow you to control certain aspects of the Braive Service, such as user settings, notifications, language, therapist etc., in your user settings
  • Processed personal data (categories):
    • Name
    • Email address
    • Language
    • Therapist that you are connected to
  • Legal basis: Legitimate interest
    • Interest pursued: to allow you use the Braive Service as intended and expected.
  • Data retention: For the duration of your continuous use of the Braive Service

Automatic registration

1) Monitoring of the technical function and to increase the operational security of our web service. 2. Delivery and provision of the website
  • Processed personal data (categories): Technical connection data of server access (IP address, date, time, requested page, browser information), Email, User ID. Log data on your use of the Braive Service and functions, including:
    • date, time, log-in history
    • URL information
    • online identifiers such as cookie data and IP addresses
    • information about the devices you use such as: network and device performance, browser type, language setting on device, operating system, Braive application version
  • Legal basis: Legitimate interest.
    • Interest pursued: economic interest in safe and functioning operation of the technical systems through which services are provided.
  • Data retention: 30 days
To anonymise and create statistics: To develop new technical features in and for the Braive Service. To understand user behaviour and needs. We may identify and analyse usage trends, including for the purposes of research, and reporting on a non-individual basis. This may include creation of graphs with demographic information and psychometric test results on group levels, derived from Mental Health Check surveys and treatment progress- and outcome data
  • Processed personal data (categories): Log data on your use of the Braive Service and functions, including:
    • User ID
    • date, time, log-in history
    • URL information
    • online identifiers such as cookie data and IP addresses
    • information about the devices you use such as: network and device performance, browser type, language setting on device, operating system, Braive application version
  • Legal basis: Legitimate interest
    • Interest pursued: user centred and valuable development of the Braive Service
  • Data retention: 1 day
To enable user-to-therapist communications (if you give your approval to this when using specific features of our Service)
  • Processed personal data (categories): User ID, Email during invitation state
  • Legal basis: Consent
  • Data retention: Email stored for 14 days

Your activity generated results

To create a summary of a session with a therapist for use by you and/or the therapist
  • Processed personal data (categories): Voice Data
  • Legal basis: Consent (when you consent to audio recording, transcribing and summary of a video call with your therapist)
  • Data retention: The voice data will be briefly processed by us, and deleted after the transcription is in place.Braive will use the text transcription of the recorded call to assist the therapist and you by summarising the content of the call with help of AI-models hosted on Braive's servers. The main types of summaries completed, after your call has been transcribed, are; 1) draft summaries to assist your therapist in the clinical documentation a Health Care Provider is obliged to complete under the Patient Data Laws, as well as 2) to provide the therapist with a draft for a summary about the content of your call including key topics discussed, as well as agreed upon goals and plans for the successive treatment which the therapist will share with you.

Information from other sources

To enable creation of an account and connection with your Health Care provider and your therapist, in those cases your Health Care provider or Partner Entity has an API setup with the Braive Service. It is always the Health Care Provider/Partner Entity who invites you to be a guided user in Braive. In those cases there is an API set up between the Partner Entity/Health Care provider and Braive, Braive can receive some information from another system of the Partner Entity/Health Care provider, such as email, to be able to send an invite to you.
  • Processed personal data (categories): Email
  • Legal basis: Legitimate interest
    • Interest pursued: to allow you use the Braive Service as intended and expected.
  • Data retention: 14 days (after this, the invitation will expire, and this sent data will be deleted)

‍

4.4 Therapists

Braive is always the data processor for the therapists, by processing the information of a therapist employed by a Health Care Provider with an agreement with Braive, in accordance with the contract between the Health Care Provider and Braive.

‍

‍