Terms and Conditions

Section 1 — General Provisions

Clause 1 — Provider and Scope

1.1 These Terms and Conditions ("Terms") apply to all services, platforms, and offerings of CW1 AB ("CW1", "we", "us"), operated under the MALM brand. CW1 AB is part of the CW1 Group, an internationally active group of companies with entities in Sweden, Germany, and Portugal.

1.2 By creating a user account, accessing the Website, the Malm App, or any individual service, you accept these Terms in their current version.

1.3 Any deviating terms proposed by you shall not apply unless CW1 has expressly agreed to them in writing.

Clause 2 — Definitions

• "Platform": the complete digital infrastructure of MALM, comprising the Website (www.malm.app), the Malm App, and associated backend systems.
• "Services": all offerings provided by CW1 through the Platform, including website access, app use, health data integration, Medical Concierge, and Second Opinion Service.
• "User": any natural person who creates an account or uses the Services.
• "Health Data": any data containing information about the physical or mental health condition of a person, within the meaning of Article 4(15) GDPR.
• "Health Platform": third-party services for collecting and managing health and fitness data, including Apple Health, Garmin Connect, Google Health (Google Fit), and FitBit.
• "Treatment Agreement": a separate contract between a licensed physician and the User, entered into when direct medical services are provided.

Clause 3 — Eligibility

3.1 To use the Services, you must: be at least 18 years of age or have verifiable parental consent; be a natural person capable of entering into legally binding contracts in your jurisdiction; provide complete, accurate, and up-to-date registration information; and not be barred from receiving services under applicable Swedish, EU, or other relevant law.

3.2 CW1 reserves the right to decline registrations or permanently close suspended accounts without providing reasons.

Clause 4 — Contract Formation and Scope of Services

4.1 The contract between you and CW1 is concluded upon completion of registration and express acceptance of these Terms.

4.2 The specific service descriptions and prices are set out in the sections below and in the current information on the Platform.

4.3 For the direct provision of medical services (second opinions, medical consultation), a separate Treatment Agreement is concluded between you and the treating physician. CW1 is not a party to that treatment relationship.

Clause 5 — Liability (General)

5.1 CW1 is liable in accordance with applicable statutory provisions for damage to life, body, or health, and for damage caused by wilful misconduct or gross negligence.

5.2 For slightly negligent breaches of material contractual obligations (cardinal obligations), CW1's liability is limited to the foreseeable damage typical for this type of contract. Further liability for slight negligence is excluded.

5.3 These limitations do not apply in cases of fraudulent misrepresentation, breach of warranty, or mandatory statutory liability.

5.4 Liability for the clinical content of medical services rests exclusively with the relevant physician under the Treatment Agreement and applicable professional regulations.

Clause 6 — Data Protection (General)

6.1 CW1 processes personal data, including special categories of health data (Article 9 GDPR), exclusively in compliance with the GDPR, the Swedish Dataskyddslagen (SFS 2018:218), the Patientdatalagen (SFS 2008:355), and other applicable regulations.

6.2 The full Privacy Policy is available at www.malm.app/privacy and forms part of these Terms.

6.3 You may exercise your rights as a data subject (Articles 15–22 GDPR) at any time by contacting privacy@malm.app. Complaints may be directed to: IMY (Integritetsskyddsmyndigheten), www.imy.se.

Clause 7 — Amendments and Term

7.1 CW1 may amend these Terms with 30 days' notice by email or in-app notification. If you do not object within 30 days, the amended Terms shall be deemed accepted.

7.2 You may cancel your account at any time via support@malm.app. CW1 may terminate immediately for serious violations.

7.3 Governing law: Laws of Sweden. Jurisdiction: Gothenburg, unless mandatory consumer protection law provides otherwise.

Section 2 — Use of the CW1 Website

Clause 8 — Subject Matter and Access

8.1 CW1 operates www.malm.app as a publicly accessible information portal and entry point for registration and use of MALM services.

8.2 The Website is generally accessible to anyone with an internet-enabled browser. Certain services require registration.

8.3 CW1 reserves the right to temporarily restrict access for technical, security, or legal reasons.

Clause 9 — Cookies and Tracking

9.1 The Website uses cookies categorised as: (a) technically necessary cookies — essential for operation and cannot be disabled; (b) analytics cookies — anonymised analysis, set only with explicit consent; (c) marketing cookies — CW1 does not serve third-party advertising; marketing cookies serve CW1's own purposes only.

9.2 You may manage cookie preferences at any time via the Cookie Preference Centre. Technically necessary cookies cannot be refused.

9.3 Legal basis: Consent under Article 6(1)(a) GDPR for optional cookies; legitimate interest under Article 6(1)(f) GDPR for necessary cookies.

Clause 10 — External Links and Third-Party Content

10.1 The Website may contain links to external third-party websites. CW1 has no control over their content and accepts no liability for them. Use is at your own risk.

10.2 CW1 checks linked pages for obvious legal violations at the time of linking and removes non-compliant links promptly upon becoming aware of any issues.

Clause 11 — Intellectual Property

11.1 All Website content — including text, graphics, logos, images, and software — is protected by copyright and is owned by or licensed to CW1 AB.

11.2 Reproduction, distribution, or public communication of Website content without prior written permission is prohibited, except for personal, non-commercial use.

Clause 12 — Prohibited Use

The following uses are prohibited: spreading false or misleading information; transmitting harmful code, viruses, or malware; gaining unauthorised access to CW1 or third-party systems; transmitting unlawful content under Swedish, EU, or other applicable law.

Section 3 — Use of the Malm App

Clause 13 — Subject Matter of the Malm App

13.1 The Malm App is the mobile and web-based core application of the MALM Platform. It enables users to: manage their personal health profile; securely upload, store, and retrieve medical documents; access the Medical Concierge and Second Opinion services; integrate with external Health Platforms; and communicate with the CW1 concierge team and cooperating physicians.

Clause 14 — Account and Credentials

14.1 A personal user account is required. You must provide complete and accurate information and keep it up to date.

14.2 You are responsible for maintaining the confidentiality of your credentials. Any suspected unauthorised use must be reported immediately to support@malm.app.

14.3 CW1 supports two-factor authentication (2FA) and strongly recommends its activation.

14.4 You may request at any time to delete your user account or by contacting care@malm.care.

Clause 15 — Data Storage and Encryption

15.1 All data stored in the App is stored on GDPR-compliant servers located exclusively within the EU.

15.2 CW1 applies: encryption in transit (TLS 1.3); encryption at rest (AES-256); strict role-based access controls with no routine staff access to health documents without explicit consent; and regular security audits (ISO 27001-oriented).

15.3 A full overview of technical and organisational measures (TOMs) pursuant to Article 32 GDPR is available on request at privacy@malm.app.

Clause 16 — Uploading and Managing Documents

16.1 You may upload medical documents in PDF, JPEG, PNG, and DICOM format. CW1 reserves the right to remove files containing malware or violating these Terms.

16.2 You confirm that you are authorised to share the documents you upload and that they do not infringe any third-party rights.

16.3 Documents are stored for the duration of the relevant service and applicable statutory retention obligations. Upon account deletion, data will be deleted or anonymised in accordance with the Privacy Policy.

Clause 17 — Data Deletion and Portability

17.1 You have the right to request deletion of your account and all associated personal data (Article 17 GDPR), unless statutory retention obligations apply.

17.2 You may download a copy of your data in machine-readable format (JSON or PDF) via the App settings or by request to privacy@malm.app (Article 20 GDPR).

17.3 Account deletion terminates access to all Services. Ongoing Treatment Agreements or pending cases remain unaffected until their conclusion.

17.4 You may request at any time to delete your user account or by contacting care@malm.care.

Section 4 — Integration of Health Platforms

Apple Health · Garmin Connect · Google Health (Google Fit) · FitBit

Clause 18 — General Provisions for Health Data Integration

18.1 Health Platform integration is optional and voluntary. All transferred data constitutes special categories of personal data under Article 9 GDPR, processed solely on the basis of your explicit consent under Article 9(2)(a) GDPR.

18.2 You may disconnect any Health Platform at any time in the App settings (withdrawal of consent). Withdrawal does not affect the lawfulness of prior processing. CW1 does not share your Health Platform data with third parties except as necessary for a service you have booked with your explicit consent.

Clause 19 — Apple Health (HealthKit)

19.1 Requires an Apple device running iOS 14 or later. Transmitted data categories (subject to your per-category authorisation): activity data (step count, active energy, workouts, stand hours); vital signs (heart rate, HRV, SpO2, respiratory rate, blood pressure); body data (weight, BMI, body fat); sleep data (duration and stages); nutrition data (calories and macronutrients if logged).

19.2 CW1 uses HealthKit data exclusively for the described service purposes. Sharing with advertising networks is prohibited under Apple's HealthKit guidelines. Consent is managed via the native iOS permission dialogue (Settings → Privacy & Security → Health).

Clause 20 — Garmin Connect

20.1 Uses the Garmin Health API via OAuth 2.0. A Garmin account and authorisation in your Garmin account settings are required. Transmitted data: GPS routes, VO2max, continuous heart rate, stress level, body battery, SpO2, sleep score, and weight.

20.2 Garmin's own Privacy Policy applies to data within Garmin's systems (www.garmin.com/privacy). You may disconnect under Garmin Connect → Settings → Connected Apps.

Clause 21 — Google Health (Google Fit)

21.1 Uses the Google Fit REST API via OAuth 2.0. Transmitted data: step count, calories, workouts, heart rate, blood glucose, blood pressure, sleep data, and body metrics.

21.2 Google's Privacy Policy applies to data within Google's systems. You may revoke access at myaccount.google.com → Security → Third-party access.

Clause 22 — FitBit

22.1 Uses the FitBit Web API via OAuth 2.0. Transmitted data: step count, active minutes, continuous heart rate, HRV, SpO2, skin temperature, sleep stages (REM/deep/light), sleep score, weight, and BMI.

22.2 FitBit's Privacy Policy (Google LLC) applies to data within FitBit's systems. You may revoke access at fitbit.com → Settings → Connected Apps.

Clause 23 — Common Provisions for All Health Platforms

23.1 Consent per Health Platform is separate and may be withdrawn via the Malm App settings or directly in the respective Health Platform.

23.2 CW1 does not warrant the completeness or accuracy of data transferred from Health Platforms. Data quality depends on the devices used and synchronisation frequency.

23.3 Health Platform data is for guidance and service support only. It does not replace a medical diagnosis. Consumer wearables are not certified medical devices under EU MDR 2017/745 unless expressly labelled as such.

23.4 CW1 is not responsible for data processing within the respective Health Platform or for errors arising from third-party interfaces.

Section 5 — CW1 Medical Concierge Service

Clause 24 — Service Description

24.1 The CW1 Medical Concierge Service is a personalised health management and coordination service. It includes: appointment management (booking, rescheduling, oversight); claims management (submission and coordination of insurance/reimbursement claims); health monitoring (analysis of health data, regular progress reports); lifestyle advice (evidence-informed guidance on nutrition, activity, sleep, and prevention); specialist coordination (referrals); and case revision support (administrative assistance accessing the Second Opinion Service).

24.2 Lifestyle advice by non-physician concierge staff does not constitute medical advice and does not replace consultation with a physician.

24.3 Concierge services are provided on a best-efforts basis. CW1 does not guarantee specific appointments, waiting times, or availability of external providers.

Clause 25 — Access and Communication

25.1 The Concierge Service is accessible via the Malm App and at concierge@malm.app.

25.2 Regular availability: Monday to Friday, 08:00–18:00 CET. No on-call service outside these hours. For medical emergencies: call 112.

25.3 Requests are typically responded to within 4 working hours during operating hours.

Clause 26 — Pricing and Subscription Models

26.1 The service is offered on a subscription or per-service basis. Current prices and packages are available at www.malm.app/pricing.

26.2 Subscriptions renew automatically unless cancelled at least 30 days before the renewal date via the App or by email to support@malm.app.

26.3 Upon cancellation, access continues until the end of the paid period.

Clause 27 — Demarcation from Medical Services

27.1 The Medical Concierge Service is a coordinating and administrative service. It does not include direct medical diagnosis or treatment decisions.

27.2 Where a CW1-affiliated physician provides direct medical services within the Concierge offering, a separate Treatment Agreement is concluded pursuant to Clause 4.3.

Section 6 — CW1 Second Opinion Service

Clause 28 — What is the Second Opinion Service?

28.1 The Malm Second Opinion Service enables patients to receive expert written assessments of their medical records from licensed physicians. The reviewing physician examines uploaded documents and prepares a structured written opinion.

28.2 The service includes: clinical assessment of uploaded documents, a written opinion by a licensed specialist, and written follow-up responses via the Platform.

Clause 29 — Process and Response Times

29.1 You upload your medical documents to your secure patient area and describe your concern.

29.2 CW1 assigns your case to a licensed specialist. The written opinion is delivered within 48 hours of case acceptance. No on-call duty; no case quota obligation for the reviewing physician.

29.3 CW1 reserves the right to decline cases where documents are insufficient, the request exceeds the service scope, or no suitable specialist is available. In that event, a full refund will be issued.

Clause 30 — Treatment Agreement and Liability

30.1 Upon acceptance of the case by the reviewing physician, a Treatment Agreement is formed between you and that physician under applicable law. CW1 is not a party to that relationship.

30.2 Medical liability rests exclusively with the reviewing physician. CW1 is not liable for the clinical content of the second opinion.

Clause 31 — Pricing, Payment and Right of Withdrawal

31.1 Prices are transparently displayed on the Platform prior to booking (gross prices inclusive of applicable VAT).

31.2 As a consumer, you have the right to withdraw from your booking within 14 days without giving reasons, in accordance with the EU Consumer Rights Directive (2011/83/EU) and applicable national law. Notice must be sent in writing to support@malm.app. If the reviewing physician begins processing at your express request before the withdrawal period expires, the right of withdrawal lapses upon full completion of the service.

Clause 32 — Data Protection in the Second Opinion Service

32.1 Health data uploaded for the second opinion is processed on the basis of your explicit consent (Article 9(2)(a) GDPR) and used exclusively for preparing the second opinion.

32.2 The reviewing physician is bound by applicable professional secrecy obligations. You may request deletion of your uploaded documents after case completion via the App settings or at privacy@malm.app.