Privacy · Articles 13 and 14 GDPR

We collect nothing unless you say yes.

No advertising, no tracker that follows you elsewhere, no account and no form. The one thing we ask is whether we may count your visit, and a banner asks you once. Say no and nothing changes: every page and every register stays open either way. This page says what is processed, what our registers name, and how to exercise your rights. Questions go to info@dysnet.org.

Version of 22 September 2026; earlier versions stay in the public history of this site. The controller is DysNet Ideell Förening, organisation number 802444-3015, Nybodagatan 1, 171 42 Solna, Sweden, with an office at Rue du Chantier 2, B-1000 Brussels. We have appointed no data protection officer, and we will name one before the registry begins processing health data.

• Your request reaches our host, not us. GitHub Pages serves these files, so GitHub receives what every web request carries: your IP address, the time, the page and your browser. It uses that to deliver the page and to protect the service. We keep no visitor database and receive nothing visitor-level, so nobody here can look up who read what. Legal basis: our legitimate interest in a website that works, Article 6(1)(f). The site is static files with no database and no login, served over HTTPS.
• We count visits only if you accept. A banner asks once. Accept, and Google Analytics records the page, the time, the country your address places you in, and your browser and device, and it gives your browser a random number so that a second page counts as the same visit rather than a new stranger. It tells us which registers people actually reach. It does not tell us who you are, and every advertising feature Google offers is switched off. Decline, and none of it loads and nothing is stored. Legal basis: your consent, Article 6(1)(a).
• Your answer is remembered, and so is the map card. Your browser keeps your yes or no so the banner does not ask again, and on the pages with a map it keeps the word open or closed so the information card stays as you left it. Neither carries an identifier and neither reaches us. To change your answer, use the button in section 04.
• Videos wait for you. Nothing loads from Google until you press play. Then Google receives your IP address and device information under its own policy.

Our mail runs on Zoho's European service, with Zoho Corporation B.V. in Utrecht as our processor. We read your message and answer it, and we keep the thread. We do not delete correspondence on a timer, because a question from a family or an association often resumes years later and that record is part of what the network is for. You can ask us to erase your correspondence at any time, and we will. Membership and donation records that count as accounting information stay for the seven years after the end of the calendar year in which the financial year closed, which Swedish law requires (Bokföringslag 1999:1078, chapter 7).

Legal bases: answering the people who write to us, Article 6(1)(f); membership, donations and agreements, Article 6(1)(b) and (c). If you describe your own or your child's condition, you are sending health data. We may hold it because we are a non-profit body with a health aim, acting for our members and the people in regular contact with us, and because we disclose it to nobody outside (Article 9(2)(d)). Write in general terms if you would rather. We ask for no medical detail we do not need.

Some of what we publish concerns named professionals we never asked, and Article 14 requires us to say so. The researcher register holds 203 research teams with their institution, country, the surnames and initials of first and last authors and their publications on our conditions, taken from the affiliations recorded in PubMed. The bibliography holds 1,929 references with their authors as published. The studies page carries the contact each study gives for itself, member associations the addresses they publish for themselves, and People our board and the volunteers who maintain the registers. Care centres and registries name institutions only.

Legal basis: our legitimate interest, Article 6(1)(f), in publishing a free resource on conditions too few people study. We keep to professional information its holders have already published in a professional capacity, and we publish nothing about anyone's health. To be corrected or removed, write and name the entry: we act within 30 days and ask you for no reason. One limit we state openly, because the registers are open data under CC BY 4.0: a copy downloaded before a removal stays with whoever took it.

We considered putting the registers behind an analytics tracker you would have to accept. We had the question tested first, and it cannot be done lawfully. It would also be wrong: these pages describe a health condition, so a record that you read them would say something about your own or your child's health. A family looking up a diagnosis at two in the morning owes us nothing in exchange.

This page used to promise that if we ever measured our traffic we would count pages rather than people, and say so here before we started. We are saying so. Since 22 September 2026 a banner asks whether we may count visits with Google Analytics, and it counts only for readers who accept. Refusing costs you nothing at all, which is the whole point: the registers are not the payment.

You can change your mind whenever you like, in either direction.

Change your answer

Why the wall is unlawful, for the reader who wants it: Swedish law allows an identifier to be stored on your device only with your consent, or where that is strictly necessary for the service you asked for (9 kap. 28 § lagen (2022:482) om elektronisk kommunikation). Consent extracted by withholding the content is not freely given (European Data Protection Board guidelines on consent of 4 May 2020, paragraphs 39 to 41). Our banner asks for that consent and takes no for an answer, leaving every page readable either way, which is the condition those guidelines set.

The limb-malformation registry does not exist, and no health data reaches us through this site. When it opens it will carry its own notice, published before the first family enters anything. Four things will hold.

• Each person holds their own account and decides what goes into it.
• Consent is explicit, given study by study, and withdrawable at any time (Article 9(2)(a)).
• No association enrols anybody. Families are invited, and they enter their own information.
• We do not sell the data, and we will not pass it to insurers or employers. Bulk access without the consent of the people described will not be possible.

The technical partner is Health Data Safe. Its statutes rule out any sale of health data and limit its use to care and research, and they provide that personal data is never treated as an asset of the foundation.

You may ask us to do any of this, and Article 15 to Article 21 GDPR give you the right:

• give you a copy of what we hold about you, or correct it;
• erase it, or stop using it while a question about it is open;
• hand it over in a form you can take elsewhere;
• stop processing that rests on our legitimate interest.

In the registry, you will not have to ask us. These rights are part of how the registry is built rather than a procedure wrapped around it. Each person holds their own account at Health Data Safe, and from it they review, correct, export and delete their own data, and withdraw a consent to share, without writing to anybody. Health Data Safe already publishes a self-service download of everything in an account and a route to delete it. Until the registry opens, the rights above are exercised by writing to us, and we carry them out by hand.

Consent, where we rely on it, can be withdrawn at any time. Write to info@dysnet.org. We answer within one month, free of charge, and if a request is genuinely complex we say so inside that month (Article 12(3)). We take no automated decisions about anybody and we build no profiles.

Three others ever touch anything: GitHub hosts the site from the United States, and states that it complies with the EU-US Data Privacy Framework; Zoho carries our mail on its European service; and Google counts the visits of readers who accept the banner, from the United States, and states that it complies with the same framework. Nobody else. We use no advertising network, no data broker and no mailing-list service, and we have never sold or rented personal data.

If we get something wrong, tell us, because most of it we can simply fix. You may also complain to a supervisory authority, choosing the one where you live, where you work or where you think the problem happened (Article 77), and you may go to court (Article 79). Ours is Integritetsskyddsmyndigheten, the Swedish Authority for Privacy Protection: Box 8114, 104 20 Stockholm, imy@imy.se, +46 8 657 61 00, which takes complaints through its own form.