SWORD HEALTH PRIVACY NOTICE
European Union and United Kingdom
INTRODUCTION
We offer a variety of health and wellness, physical therapy and pediatric healthcare services by connecting our users, or the children on whose behalf our users act, through a combination of technology, accessory devices, and Specialist support, supported through our websites including, but not limited to, www.swordhealth.com and related sites, and the Sword and Mind mobile applications (collectively, the “Sites”), as well as the Sword Health Digital Therapist device, Sword motion sensors, the Bloom Pod device, the Pulse wearable device, the AI Pediatrics conversational assistant as well as accessory devices, biofeedback technology, exercise monitoring equipment and other electronic means such as video conferencing, computer vision, chat, phone, and online events (the foregoing, together with the Sites, the “Services”).
Sword provides the Services through which you can access a variety of health and wellness programs for musculoskeletal support, pelvic health support, mental wellbeing, pediatric care and other health programs provided by a professional (“Health Services”). Sword engages independent doctors of physical therapy, physical therapists, physiotherapists, clinical psychologists, pediatricians and other appropriately qualified professionals (the “Professional(s)”) to provide Health Services to you as part of the Services. Where the Services include AI Pediatrics, please refer to the AI Pediatrics Section below, which applies in addition to this Introduction.
The use of “Sword” in this Privacy Notice refers to the Sword Health contracting entity for your geographical region, as identified below.
Unless otherwise indicated below, for European Union users of the Services, the contracting entity is Sword Health, S.A. For users based in the European Union, Sword Health, S.A. is the data controller.
For UK users of the Services, the contracting entity is Surgery Hero Limited trading as Sword Health. For users based in the United Kingdom, Surgery Hero Limited trading as Sword Health is the data controller.
For Portugal users of Services including AI Pediatrics, the contracting entity and data controller is Sword Health Physio, Unipessoal, LDA.
The Services are owned by Sword Health Technologies, Inc, and its affiliates, including, but not limited to Surgery Hero Limited trading as Sword Health, Sword Health, S.A., and Sword Health, Inc.
If you are accessing the Services from the United States click here.
If you are accessing the Services from Canada click here.
To help you read this Privacy Notice, we have organised it into the following sections:
Information Collected While Using Our Services
Information Collected from Other Sources
How We Use and Share Personal Data
Our Legal Basis for Processing Personal Data
Right to Restriction of Processing
Right to Lodge a Complaint with Your Supervisory Authority
Cookies and Other Tracking Technologies
Managing Your Tracking Technology Preferences
Changes to This Privacy Statement
Contact Us or File a Complaint
Personal Data We Collect
We may collect information that identifies, or is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual (“Personal Data”) as further described in the categories below. We collect Personal Data from you, from your use of the Services, including when you visit the Sites, from certain third party sources, and through the use of your personal devices and Third Party Wearables that are compatible with the Services and that you choose to use with the Services. By using the Services, you agree that we can collect and use your Personal Data as described in this Privacy Notice.
Information You Provide to Us
Sword collects information that you provide to us, or, where the Services include AI Pediatrics, that a Parent/Guardian User provides to us about a Child as described in the AI Pediatrics Section below, including when you enroll, use the Services, give updates about your or your Child’s condition, respond to a survey, or contact us. This information may include:
- Contact or other Identifying Information, such as your name, address, email address, telephone number, username, and password;
- Professional or employment-related information, such as the name of your employer, company, and other professional or employment information you provide to us;
- Mental and physical condition information, such as age, height, weight, general health, exercise patterns, personal motivations, information about pregnancies and childbirth, and feelings of anxiety, pain, fatigue, or depression;
- Medical information, such as current or former injuries, medical diagnoses, and whether you are cleared by a physician to exercise;
- Payment information, such as bank account number, credit card number, or debit card number, where you are being directly billed for your use of the Services.
Information Collected While Using Our Services
Sword may also collect certain information when you access, browse, and use our Services, or, where the Services include AI Pediatrics, when a Parent/Guardian User or a Child accesses, browses, or uses the Services on the Child's behalf. This information is generated by the computer, tablet, mobile app, devices, other accessories or electronic sensors used in the Services. This information may include:
- Internet and other electronic activity data, such as the name of the domain, host and device from which you access the Internet; the browser software you use, and your operating system; the date and time you access the service; how often you access the Services, and the Internet address of the website from which you directly linked to Sword;
- Log and Troubleshooting Information, such as information about how our Services are performing when you use them, like service related diagnostic and performance information, including log files, timestamps, diagnostic or crash data, website/app performance logs, and error messages or reports;
- Identifiers or Geolocation data, such as Internet Protocol (IP) address, device identifier or geolocation (if enabled);
- Sensor or computer vision data, such as the type and order of exercises, number of repetitions, duration, manner, and individual performance during the assigned exercise; and require your affirmative opt-in consent before any data is accessed; and
- Data from Tracking Technologies, such as information from cookies, web beacons, tags or other tracking technologies, as further described below.
Sword will not record video or audio of your sessions without your explicit prior consent. Computer vision, which provides real-time movement guidance during sessions, processes your device camera feed in real time to derive movement-tracking vectors and positional data; raw images are not stored, any authorised recording will be handled in accordance with this Privacy Notice.
Information Collected from Other Sources
In connection with your use of the Services, we may combine or compare data we have collected from you with information collected from a third party, which may include:
- Eligibility Information: If you are participating in a program sponsored by your employer, insurance provider, health plan or other authorised benefits provider, information contained in an eligibility file, such as whether you are enrolled in the plan, your name, email, and some related health information;
- Information We Obtain From Your Health Care Providers and Other Sources: In connection with your treatment, we may collect medical records from your past, current, and future healthcare providers, which may include past or present diagnoses, previous treatments, general health, test results and reports, any family history of illness, and records of communications related to your health; and
- Information Collected From Third Parties: We may collect information available about you from third party service providers to facilitate your access to, improve, and tailor the delivery of Services .
How We Use and Share Personal Data
Use of Personal Data
We may use the Personal Data we collect for one or more of the following business purposes:
- To provide insights (such as summaries, trends and recommendations based on your activity and device data) and to personalise, improve, update, and expand our Services, including for product testing and development, quality assurance, research data analysis, establishing metrics and survey purposes;
- To identify individuals who may benefit from Sword Intelligence and/or Sword Predict which can be utilised to improve outreach and drive enrollment, based on clinical eligibility and health risk factors.
- To communicate with you about the Services, including:
- To respond to your inquiries and concerns or inquire about safety or other concerns;
- Provide you with information or request action in response to technical, security, and other operational issues; and,
- To follow-up with you regarding your enrollment process;
- To create de-identified information (for example, aggregated statistics) related to the use of the Services or for scientific and statistical research;
- To comply with laws and regulations, including to respond to law enforcement or government requests as required by applicable law, court order, or governmental regulations and to monitor our compliance with those obligations;
- To collect data necessary to comply with EU, UK, and international legislation with respect to post-marketing surveillance and vigilance as necessary to monitor safety and performance of our product;
- To monitor, troubleshoot, and improve the Services;
- To protect the integrity and maintain the security of our Services;
- To enforce our Terms and Conditions; and
- For any other purpose for which you may provide consent or as disclosed to you when you provide Personal Data to us.
When we use the term “de-identified information,” we mean information that is neither used, nor intended to be used, to identify an individual. We take reasonable measures to maintain and use information in de-identified form and do not attempt to re-identify it except as permitted by law. We may use de-identified information for any lawful purpose, including research and analytics, and may share it with unaffiliated third parties.
Sharing Personal Data
Sword does not share your Personal Data with third parties except as described in this Privacy Notice or with your additional consent (if applicable).
Sword may share Personal Data with the following categories of third parties for the following purposes:
- Service Providers: We may share your Personal Data with service providers, such as contractors and other third parties we use to support our organisation and provide us with services. These companies are subject to contractual obligations governing privacy, data security, and confidentiality consistent with applicable laws. These companies include our cloud services infrastructure providers, vendors that assist us in marketing and consumer research analytics, fraud prevention, security, communications, infrastructure providers, vendors that help us provide some support functions, like phone support or survey tools, law firms, and third party partners for analytics and advertising purposes.
- Corporate Affiliates: We may share your Personal Data with our subsidiaries, affiliates, and associated organisations.
- Research Partners: We may share your Personal Data with research partners if you provide us with your express consent or if otherwise permitted by law. Research partners include commercial or non-profit organisations that conduct or support scientific research, the development of therapeutics, medical devices or related material to treat, diagnose, or predict health conditions. In some circumstances, a research partner or Sword may have a financial interest in the research arrangement.
- Health Care Providers, Health Plans, Insurance Companies, and Similar Organisations: Personal Data that we create or obtain about you may be shared with health care providers, health plans, insurance companies or other similar health care organisations to provide the Service or as permitted by law or pursuant to your consent.
- Law Enforcement, Government Agencies, or Other Third Parties: From time to time, we may be required to provide Personal Data to a third party in order to comply with a subpoena, court order, government investigation, or other similar legal process. If we disclose your Personal Data to law enforcement, we will reasonably attempt to provide you with advance notice, unless we are prohibited from doing so. We may share your Personal Data if we believe it is reasonably necessary to:
- Comply with valid legal process (e.g., subpoenas, warrants);
- Respond to a government request;
- Enforce or apply our Terms and Conditions;
- Investigate fraud;
- Protect the security or integrity of the Services;
- Protect the rights, property, or safety of Sword, our employees/contractors, members or users; or
- At your direction or with your permission.
- Corporate Transaction: If we are involved in a bankruptcy, merger, acquisition, reorganisation, or sale of all or a portion of our assets, we may share or transfer your Personal Data as part of such corporate transaction.
- Employer: In very limited circumstances, we may share your Personal Data with your employer if legally permissible to do so. For example, if you have access to the Services through your employer, Sword may share your Personal Data to confirm eligibility for the Services.
- Analytics and Advertising Partners: We may share device, cookie, and usage data with third-party analytics and advertising networks (such as Google Analytics, Meta Platforms or LinkedIn) to analyze website traffic and deliver tailored advertising. Where required by law, this data is shared only with your explicit consent obtained through our Cookie Preference Center.
- Meta Platforms Ireland Limited (Custom Audiences): From time to time and only as permitted by law, we may share pseudonymized or hashed contact information (such as hashed email addresses) with Meta Platforms Ireland Limited acting as our data processor under Meta's Custom Audience Terms.
- Meta Platforms Ireland Limited (Custom Audiences): From time to time and only as permitted by law, we may share pseudonymized or hashed contact information (such as hashed email addresses) with Meta Platforms Ireland Limited acting as our data processor under Meta's Custom Audience Terms.
Sword will not disclose or share mobile numbers or text message opt-in data with third parties for their own marketing purposes.
Our Legal Basis for Processing Personal Data
Under the GDPR/UK GDPR, we have to specify what our legal basis is for processing your Personal Data. We collect, use, and share the Personal Data we have in the ways we described above:
1. Performance of a Contract (Article 6(1)(b))
We process your Personal Data where it is necessary to fulfill our obligations under our Terms and Conditions, specifically to provide you with the Sword Health services and manage your account.
2. Provision of Health Care (Article 9(2)(h) and Article 6(1)(b))
Because we provide health-related services, we process your Special Category (Health) Data as necessary for the purposes of medical diagnosis and the provision of health or social care and treatment.
3. Explicit Consent (Article 9(2)(a) and Article 6(1)(a))
In certain circumstances, such as for specific marketing activities or voluntary participation in elective programs, we will ask for your explicit consent to process your health data. You have the right to withdraw this consent at any time.
4. Scientific Research and Statistics (Article 9(2)(j) and Article 6(1)(f))
We may process health data for research, innovation, and statistical purposes to improve healthcare outcomes. This processing is carried out in accordance with Article 84B of the UK Data (Use and Access) Act 2025 and is subject to appropriate safeguards (such as pseudonymisation).
5. Employment and Social Protection (Article 9(2)(b))
Where we provide services through your employer, we may process health data as necessary to carry out obligations in the field of employment and social protection law (e.g., assessing working capacity or managing occupational health).
6. Legitimate Interests (Article 6(1)(f))
We rely on our legitimate interests (or those of a third party) where they are not outweighed by your rights and freedoms. You have the right to object to processing based on this basis. We use this basis to:
- Promote new developments and features of our Services;
- Improve and develop our Services through data analytics;
- Ensure the ongoing security, fraud prevention, and availability of our Services;
- Conduct general product innovation; and
- Provide customer support and relationship management.
7. Legal Obligation (Article 6(1)(c))
We process data where necessary to comply with the law, such as responding to valid legal requests, subpoenas, or mandatory regulatory reporting.
8. Vital Interests (Article 6(1)(d) and Article 9(2)(c))
In extreme cases, we may process your data to protect your life or the life of another person (e.g., sharing critical health info with emergency responders during a health crisis).
Cross Border Transfers
As part of your use of the Services, your Personal Data may be transferred for processing to countries outside of your country of residence. Some of these countries may have data protection laws that are less protective than the rules of your country. Nonetheless, we will take steps to ensure your Personal Data is adequately protected as required by applicable data protection laws, including the GDPR/UK GDPR, and will not be used in a way contrary to this Privacy Notice. We may rely on the following transfer mechanisms:
- Adequacy Decisions: Where we (or our third-party vendors) participate in approved certification schemes, we may rely on these for transfers to the United States:
- Data Privacy Framework (DPF) & UK Data Bridge: Where applicable, we may rely on self-certification under the EU-U.S. Data Privacy Framework and the UK Extension to the DPF (the "UK-U.S. Data Bridge") to ensure a level of protection essentially equivalent to that in the EU and UK.
- Appropriate Safeguards, Standard Contractual Clauses (SCCs):
- We may implement the 2021 EU SCCs for transfers from the EEA.
- UK IDTA / Addendum: We may utilise the International Data Transfer Agreement or the UK Addendum to the SCCs for transfers from the UK.
- Transfer Risk Assessments (TRAs): We may conduct formal assessments of the laws and practices of the destination country to ensure the effectiveness of these contractual safeguards.
- Intra-Group Transfer Mechanisms: Transfers of Personal Data between members of the Sword Health group (such as between Surgery Hero Limited, Sword Health, S.A., and Sword Health Technologies, Inc.) may be governed by internal data transfer arrangements. These may include a formal Intra-group Data Transfer Agreement (IGDTA) or the execution of SCCs between specific entities, ensuring that all Sword affiliates globally adhere to the same high standards of data protection.
Retention of Personal Data
Sword will retain the Personal Data you provide while creating your account and your profile until such time as you delete your account or you request deletion provided you are entitled to request deletion under applicable law, whichever comes first. Any health records created as a result of your use of the Services will be securely maintained by Sword for a period that is no less than the minimum number of years such records are required to be maintained under applicable law. Sword may also retain certain information as reasonably necessary to comply with our legal obligations (including law enforcement requests), resolve disputes, maintain security, prevent fraud and abuse, as well as to comply with tax, securities, and regulatory compliance requirements.
Your Data Protection Rights
Under applicable data protection laws, you have the rights described below.
Right to Access
You have the right to ask us for copies of your Personal Data.
Right to Rectification
You have the right to ask us to rectify Personal Data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Right to Erasure
You have the right to ask us to erase your Personal Data in certain circumstances. We may deny or limit your request under certain legally permitted circumstances, such as if we are required to retain your data to comply with legal obligations or maintain medical records. Please note that there may be some latency in deleting your Personal Data from our backup systems after it has been deleted from our primary production and development systems.
Right to Restriction of Processing
You have the right to ask us to restrict the processing of your Personal Data in certain circumstances.
Right to Object to Processing
You have the right to object to the processing of your Personal Data in certain circumstances, (in particular, where we don’t have to process the information to meet a contractual or other legal requirement, or where we are using the data for direct marketing). This applies where we rely on the lawful basis of legitimate interest.
Right to Data Portability
You have the right to ask that we transfer the Personal Data you gave us to another organisation, or to you, in certain circumstances.
Right to Withdraw Consent
You have the right to withdraw your consent, where we rely on consent as the legal basis for processing your Personal Data. Where you withdraw your consent, the withdrawal will not affect the lawfulness of processing based on consent before the withdrawal.
Right to Lodge a Complaint with Your Supervisory Authority
For EU Residents, you can complain to the relevant Supervisory Authority if you are unhappy with how we have used your Personal Data. A list of Supervisory Authorities and related contact information is provided in the European Data Protection Board’s directory available here.
For UK Residents, you can also complain to the ICO if you are unhappy with how we have used your Personal Data (see contact details in the "Contact Us or File a Complaint" section below).
If you wish to exercise your rights, or a Parent/Guardian User wishes to exercise a Child's rights under AI Pediatrics, please send an email to privacy@swordhealth.com. When submitting your request, please provide us with your name and contact information for purposes of enabling us to begin verifying your identity, and, if you are a Parent/Guardian User acting for a Child, your relationship to and authority to act for the Child. We may request additional information about you if needed to verify your identity. Unless you have previously provided us your Personal Data for another purpose, we will only use the Personal Data provided in the verification process to verify your identity or authority to make a request, and to track and document your request to meet our obligations. Certain exceptions or exemptions may apply that will limit your ability to exercise these rights.
Authorized Agents: If permitted under applicable law, you may use an authorized agent (such as a legal representative) to submit a request to exercise your rights on your behalf. We require that your authorized agent provide written proof of authorization, and we reserve the right to verify your identity directly with you.
We do not discriminate or retaliate against individuals for exercising any of their data protection rights.
Tracking Technologies
We may use technologies such as cookies, web beacons or pixels, tags, scripts, and other storage technologies (collectively “Tracking Technologies”) to collect or receive information on the Sites. These Tracking Technologies may help us save your preferences, understand how you navigate through the Sites, and improve your experience.
Cookies and Other Tracking Technologies
Cookies are small data files that we transfer to your device to collect information about your use of the Sites. Cookies can be recognized by the website that downloaded them or other websites that use the same cookies. This helps websites know if your browsing device has visited them before. We may use both first party and third party cookies on the Sites for the following purposes: to make the Sites function properly; to improve the Sites; to track your interaction with the Sites; to enhance your experience with the Sites; to remember information you have already provided; to collect information about your activities over time and across third party websites or other online services in order to deliver content tailored to your interests; and to provide a secure browsing experience during your use of the Sites.
The length of time a cookie will stay on your browsing device depends on whether the cookie is a “persistent” or “session” cookie. Session cookies will only stay on your device until you stop browsing. Persistent cookies stay on your browsing device until they expire or are deleted. The following types of cookies may be used on the Sites:
- Strictly Necessary Cookies. These cookies are essential because they would enable you to use the Sites. For example, strictly necessary cookies allow you to access secure areas of the Sites and for us to provide the Sites. These cookies do not gather information about you for marketing purposes. This category of cookies would be essential for the Sites to work and they cannot be disabled.
- Functional or Preference Cookies. We may use functional cookies to remember your choices so we can tailor the Sites to provide you with enhanced features and personalised content. For example, these cookies can be used to remember your name or preferences on the Sites. We would not use functional cookies to target you with online marketing. While these cookies can be disabled, this may result in less functionality during your use of the Sites.
- Performance or Analytic Cookies. These cookies collect passive information about how you use the Sites, including webpages you visit and links you click. We would use the information collected by such cookies to improve and optimise the Sites. We would not use these cookies to target you with online marketing. You would be able to disable these cookies.
- Targeting or Advertising Cookies. These cookies are used to drive online advertising that is relevant to you by building up a picture of what you are interested in from your use of the internet. The cookies can limit the number of times you see an advert and help to measure the effectiveness of any advertising. They remember that you have visited a website and this information may be shared with other organizations or advertisers. We may use these cookies in limited circumstances associated with our public-facing sites.
We may also use tracking technologies to collect “clickstream” data, such as the domain name of the service providing you with Internet access, your device type, IP address used to connect your computer to the Internet, your browser type and version, operating system and platform, the average time spent on the Sites, web pages viewed, content searched for, access times and other relevant statistics, and assign unique identifiers to the device or other credentials you use to access the Sites for the same purposes. Our Sites and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
Managing Your Tracking Technology Preferences
When viewing the Sites, you can accept or reject non-essential cookies via our cookie preferences banner/tool. In addition, many browsers allow you to manage your cookie preferences at the individual browser level. You can set your browser to reject and/or delete some or all cookies. If you reject or delete cookies, please be aware that you may not be able to use some or all portions or functionalities of the Sites.
Location Information. You may be able to adjust the settings of your device so that information about your physical location is not sent to us or third parties by: (a) disabling location services within the device settings; or (b) denying certain websites or mobile applications permission to access location information by changing the relevant preferences and permissions in your mobile device or browser settings. Please note that your location may be derived from your WiFi, Bluetooth, and other device settings. Please see your device settings for more information.
Analytics Tools and Marketing Technologies (e.g., Google Analytics, Meta, LinkedIn). We may use third-party analytics scripts and advertising pixels on our public Sites to understand visitor engagement, measure communication effectiveness, and generate aggregate reports. These tools deploy non-essential cookies and identifiers only where you have provided explicit consent via our Cookie Settings. You can manage, update, or withdraw your consent at any time using the "Cookie Settings" link in our website footer.
Regarding Targeted Advertising. For more information about online behavioral advertising and how you can manage your preferences, European and UK users can visit the European Interactive Digital Advertising Alliance (EDAA) opt-out portal at https://www.youronlinechoices.com/uk/.
Artificial Intelligence
Sword uses artificial intelligence, including Phoenix, its AI Care Specialist, to support the delivery of the Services. Phoenix provides real-time movement guidance using computer vision, communicates with you during and between sessions, and personalises your care based on your session history, clinical scores, and — where you have opted in — wearable and calendar data. Phoenix builds a clinical memory across your interactions to maintain continuity of care; this clinical memory may inform across programs you are enrolled in (e.g., Thrive, Mind, Bloom, or Pulse). Phoenix does not make autonomous clinical decisions; all clinical judgement, treatment planning, and escalation decisions are overseen by licensed clinicians.
Sword does not use identifiable personal data to train large language models or other general-purpose AI systems. Sword may use data that has been de-identified in accordance with applicable legal standards (including the GDPR and UK GDPR) to improve service quality and product functionality. If these practices materially change, we will update this Privacy Notice and, where required by applicable law, obtain your consent.
Children’s Information
We are committed to protecting the privacy of children. Except where the Services include AI Pediatrics, as described in the AI Pediatrics Section below, we do not collect Personal Data directly from anyone who is, to our knowledge, under the age of 13, or under the applicable age of digital consent (which ranges from 13 to 16 years) in European Member states, without parental or guardian authorisation. If you are under the age of digital consent in your country of residence and are not using AI Pediatrics through a Parent/Guardian User, please do not provide any information to us through the Sites or Services without parent or guardian involvement. If you become aware that an individual under the age of digital consent has provided their information directly to us without appropriate consent, other than through AI Pediatrics, please contact us as described in the “Contact Us” section, so that we can delete the information.
A parent or guardian may create an account on behalf of an eligible minor child, provided that the parent or guardian assumes responsibility for supervising the child's use of the Services in accordance with applicable local laws. Where permitted by applicable local law (including the GDPR and UK GDPR), minors who reach the age of digital consent or legal capacity may exercise their own data protection rights directly regarding their Personal Data.
AI Pediatrics (only where available, not currently available in all regions)
This Section applies only where the Services include AI Pediatrics, a service through which a parent, legal guardian, or other individual with parental responsibility or equivalent legal authority (a "Parent/Guardian User") uses the Services on behalf of a child (the "Child"), including a Child under the age of 13. It does not affect the general position described in "Children's Information" above, which continues to apply outside AI Pediatrics.
For AI Pediatrics, the contracting entity and data controller for a given jurisdiction is Sword Health Physio, Unipessoal, LDA.
Where you use AI Pediatrics, we process the Child's Personal Data, including health data, because you, as the Parent/Guardian User, have provided it to us on the Child's behalf, and not because the Child has provided it to us directly. This includes: identifying information such as the Child's name and date of birth; developmental and wellbeing information; symptoms, medical history, diagnoses, prescriptions, and other clinical information recorded in the course of Health Services; and your conversations with the AI Component about the Child.
Because this involves the health data of a child, we apply additional safeguards to this processing, including restricting access to the Child's clinical information to the Professionals involved in the Child's care and to personnel who need it to operate the Services, and retaining it in accordance with applicable healthcare record-keeping law. All references to Personal Data, and to the rights and mechanisms described elsewhere in this Privacy Statement (including Your Data Protection Rights, Our Legal Basis for Processing Personal Data, Sharing Personal Data, Cross Border Transfers, and Retention of Personal Data), apply equally to the Child's Personal Data where you use AI Pediatrics, and you may exercise the Child's data protection rights on the Child's behalf, subject to verifying your relationship to the Child and your authority to act for them. Further detail on how consent for specific Health Services is obtained is set out in the Healthcare Services and Clinical Governance Notice referenced in the Terms.
If you become aware that a Child has provided Personal Data to us directly, other than through a Parent/Guardian User's use of AI Pediatrics as described above, please contact us as described in the "Contact Us" section, so that we can address it appropriately.
External Websites
The Sites may contain links to other websites, including, but not limited to, investor relations, job applicant information gathering, assessment, and testing sites. These third party sites have their own privacy practices and measures to secure and protect your information. This Privacy Notice does not apply to any third party sites. We encourage you to review the privacy notice of any other third party website you may visit.
Google API Services
If you choose to connect your Google account to the Services, Sword may access information from Google Workspace APIs, such as your Google Calendar event details, to provide scheduling and personalized wellbeing features within the Services. This access is optional, user-initiated, and limited to powering features visible within the Services. Sword does not use Google user data for advertising, and does not sell or transfer Google user data to third parties except as necessary to provide the Services, comply with applicable law, or as part of a merger, acquisition, or asset sale with adequate notice to users. The use and transfer of information received from Google Workspace APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Changes to This Privacy Statement
This Privacy Notice is effective as of the date stated at the bottom of this Privacy Notice . We may change this Privacy Notice from time to time. Please be aware that, to the extent permitted by applicable law, our use of your Personal Data is governed by the Privacy Notice in effect at the time we collect the information. If you visit the Sites or use the Services after a change to this Privacy Notice is posted on the Sites, you will be bound by such change.
Contact Us or File a Complaint
If you have any questions or comments regarding this Privacy Notice, please contact us at:
Sword Health, S.A.
Avenida Sidónio Pais 153, Edifício A, Piso 5,
4100-467 Porto, Portugal.
or by emailing us at:
You may also contact Sword’s Data Protection Officer directly by sending an email to: DPO@swordhealth.com.
EU Residents can also complain to their Supervisory Authority by locating their applicable Supervisory Authority on the European Data Protection Board’s directory of Supervisory Authorities at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
UK Residents can also complain to the ICO if you are unhappy with how we have used your Personal Data through the methods below:
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Last Updated and Effective Date: September 30, 2026