Privacy policy for AssistFai

Version 1 · 6 November 2026

AssistFai is a business system for personal-assistance providers made by Tizfai Technologies AB, company reg. no. 559284-7379, Kumminvägen 1, 611 46 Nyköping, Sweden (“we”). This policy covers the web app, notifications and this website. Providers use AssistFai under their own name and at their own address.

In short
  • If you work for a provider, or receive assistance through one, the provider decides about the data about you. We process it on the provider's behalf.
  • Identity numbers, care records, deviations, messages, bank accounts and files are stored encrypted.
  • We use no advertising or analytics tools and never sell personal data.
  • The data is stored on servers in the EU.

1. Who is responsible for the data?

  • Assistants, other staff, clients receiving assistance, representatives and relatives: the provider is the controller. We are the processor under the data processing agreement, which is part of the customer agreement with the provider. Ask the provider first about the data.
  • Contact people at the providers: we are the controller for the customer agreement, support and invoicing.
  • Everyone who uses AssistFai: we are the controller for what we process to keep the service secure, such as sign-ins and security logs, and for this website.

2. What data is processed?

  • Staff: name, identity number, contact details, employment, schedule, time, absence, pay, tax, bank account, competences, the details Försäkringskassan requires about the assistant, and BankID signatures. For criminal-record extracts we note that one was shown; a copy is kept only where the law requires it.
  • Clients receiving assistance: name, identity number, decisions from Försäkringskassan and the municipality, schedule, time, care records, implementation plan, deviations and Lex Sarah cases, contacts and documents.
  • Representatives and relatives: name, contact details and what they do in the client portal.

3. Health data

Care records, implementation plans, deviations and sick leave are health data, a special category of personal data. The provider may process them to give support under LSS and for its duties as an employer (Article 9(2)(h) and 9(2)(b) GDPR). They are stored encrypted, only those with permission can read them, every reading of the care records is logged, and our support never reads care records or messages.

4. Where does the data come from?

From the provider, from you, from BankID when you sign in or sign, and from authorities the provider exchanges data with, such as Försäkringskassan and Skatteverket.

5. Who receives the data?

  • The provider and the people the provider gives permission. A client sees only what the provider opens in the client portal, never pay.
  • Authorities and recipients the provider sends to: Försäkringskassan, Skatteverket, municipalities, the bank (the bank file), Fora or Pensionsvalet, and Fortnox or Kivra if the provider connects them.
  • Our sub-processors: Hetzner Online GmbH (servers in the EU), and OpenAI if the provider reads in a schedule from another system: the text of the file is interpreted, and names are replaced by codes before the text leaves our servers. E-mail is sent from our own mail server and text messages through our own SMS service.
  • BankID is provided by Finansiell ID-Teknik BID AB.
  • Authorities when the law requires it.

We never sell personal data or pass it on for marketing.

6. Where is the data processed?

The data is stored and processed in the EU/EEA. OpenAI may process data outside the EU/EEA; this then happens with the safeguards the GDPR requires, such as the European Commission's decision on the EU–US Data Privacy Framework or standard contractual clauses.

7. How long is the data kept?

  • As long as the provider uses AssistFai, following the provider's instructions and the law.
  • Care records are deleted two years after the last entry, unless the provider has reason to keep them longer.
  • Lex Sarah cases are kept for at least five years after they are closed.
  • Pay and bookkeeping records are kept as long as the Swedish Bookkeeping Act requires, until the end of the seventh year after the end of the financial year.
  • Files in the trash are deleted after 30 days.
  • When the customer agreement ends we delete the provider's data under the data processing agreement.

8. The web and notifications

  • No tracking: AssistFai and this website use no analytics, advertising or tracking tools.
  • Cookies: the web app uses only necessary cookies for signing in and for browsers you have confirmed. This website uses no cookies.
  • Notifications about messages name the sender, never the content.
  • Demo requests from this website open in your own e-mail program. Nothing is sent through the website.

9. Your rights

You have the right to know what data is processed about you and get a copy, have errors corrected, have data erased, restrict or object to the processing, and receive data you provided in a machine-readable format. The right to erasure does not cover what the provider must keep by law. For data the provider is responsible for, contact the provider; we help the provider answer.

If you are unhappy with how the data is processed you can complain to the Swedish Authority for Privacy Protection (imy.se).

10. Security

All traffic is encrypted (HTTPS). Sensitive data and files are stored encrypted, passwords only as hashes, and a new browser is confirmed with a code. Everyone sees only what their permissions allow. To help a provider our support can open the provider's account; this is logged, and the support never reads care records or messages.

11. Contact

Tizfai Technologies AB, company reg. no. 559284-7379, Kumminvägen 1, 611 46 Nyköping, Sweden. E-mail: info@tizfai.com.

12. Changes

We publish changes here with a new date and version number. For larger changes we inform the providers.