MediReady — Swedish Market Classification & Readiness Document

Table of contents

1. Purpose
2. Product Description
3. Intended Purpose
4. Assessment under MDR (EU 2017/745)
5. Assessment under HSLF-FS 2022:42 (National Medical Information Systems)
6. Swedish Regulatory Framework Context
7. Data Protection and GDPR
8. Swedish Data Protection Authority (IMY) Alignment
9. NIS2 Directive — Scope and Applicability
10. European Health Data Space (EHDS) — Future Monitoring
11. Data Residency and Geographic Processing
12. Overall Conclusion

1. Purpose

This document establishes MediReady's formal classification and regulatory readiness for the Swedish market in relation to:

• EU Regulation (EU) 2017/745 (MDR) — medical devices and medical device software (MDSW)
• HSLF-FS 2022:42 — national medical information systems (NMI)
• GDPR (EU 2016/679) — data protection framework
• Patientdatalagen (2008:355) — Swedish patient data law
• IMY supervisory priorities — Swedish Data Protection Authority guidance
• NIS2 Directive (2022/2555) — cybersecurity for critical infrastructure
• EHDS Regulation (2023/2664) — European Health Data Space (future monitoring)

The document describes MediReady's intended use, functional limitations, and regulatory boundaries as the basis for the assessment that the product is not within the scope of MDR and not within the scope of the NMI framework, while remaining fully aligned with Swedish data protection expectations.

2. Product Description

MediReady is an administrative tool for compliance documentation and workflow audit. The system is used by administrators, quality leads, and operations managers to:

• generate policies, SOPs, and risk assessments
• perform administrative gap analyses
• map standards (HIPAA, ISO, NIST, etc.)
• perform non-clinical workflow audits
• produce reports for internal governance and compliance

MediReady does not process medical decisions, does not influence patient care, and does not provide recommendations on diagnosis, treatment, or clinical actions.

3. Intended Purpose

MediReady is intended for:

• administrative documentation
• compliance work
• internal workflow audits
• policy and governance document management
• non-clinical risk assessments

MediReady is not intended to:

• be used for diagnosis, treatment, monitoring, or alleviation of disease
• be used for clinical decisions or patient-facing assessments
• process medical records or clinical parameters
• provide recommendations that affect patient care or treatment
• update or read authority registers in healthcare

4. Assessment under MDR (EU 2017/745)

4.1 Relevant Criteria

Under MDR, software is classified as a medical device if it has a medical purpose, for example to:

• diagnose
• prevent
• monitor
• treat
• alleviate disease

4.2 Assessment

MediReady meets none of MDR's medical purposes. The system:

• does not analyse patient data
• does not influence clinical decisions
• does not generate medical recommendations
• is not used by clinical staff in patient-facing work
• processes administrative information only

“Software for administrative purposes is not covered.” — MDR interpretation per EU guidance

4.3 Conclusion

MediReady is not a medical device and is not within the scope of MDR.

5. Assessment under HSLF-FS 2022:42 (National Medical Information Systems)

5.1 Relevant Criteria

NMI covers systems that:

• process medical information of significance for an individual patient's care, or
• provide direct access to or update authority registers, or
• are used to dispense prescriptions at pharmacies

5.2 Exception in the Regulation

HSLF-FS 2022:42 states that the following is not NMI:

“Generic software used in a care environment, except where the software has been adapted in a way that meets the definition of a national medical information system.”

5.3 Assessment

MediReady:

• does not process medical information
• does not affect patient care
• has no connection to authority registers
• is not used for prescriptions or dispensing
• is not adapted for clinical decisions
• is not a system of significance for an individual patient's care

5.4 Conclusion

MediReady does not meet the definition of NMI and is not within the scope of HSLF-FS 2022:42.

6. Swedish Regulatory Framework Context

MediReady operates in Sweden under the following regulatory framework:

Critical classification question for Swedish healthcare providers: Is MediReady a medical device (MDSW) or a national medical information system (NMI)?

The answer is no to both. MediReady is subject to GDPR but not to medical device or NMI-specific regulations.

7. Data Protection and GDPR

Even though MediReady is neither MDSW nor NMI, the system is subject to GDPR.

8. Swedish Data Protection Authority (IMY) Alignment

IMY (Integritetsskyddsmyndigheten) has published supervisory priorities for 2024–2025 that include:

• AI use in healthcare and sensitive data processing
• Healthcare sector data protection practices
• Transparency and human oversight in automated decision-making

MediReady's design aligns with IMY priorities as follows:

8.1 AI Transparency

8.2 Sensitive Data Minimization

8.3 Data Subject Rights

MediReady assists the Company in responding to Data Subject Access Requests (DSAR) and other rights under GDPR Articles 12–22. (See §6 of the Data Processing Agreement.)

8.4 Accountability Documentation

MediReady maintains:

• Audit logs
• Breach records
• Processing documentation as required by GDPR Article 5(2)

Documentation is made available to IMY upon inspection request.

8.5 Commitment to Swedish Law

9. NIS2 Directive — Scope and Applicability

The EU NIS2 Directive (2022/2555) sets cybersecurity obligations for critical infrastructure operators and essential service providers.

9.1 When NIS2 Applies

NIS2 applies where a company:

• Has ≥ 50 employees, or
• Has annual turnover ≥ EUR 10 million, or
• Is classified as an “essential” actor in healthcare (e.g., operates an EHR system or national health-data platform)

9.2 MediReady's Position

9.3 Important Note for Swedish Healthcare Providers

If MediReady is used by a Swedish healthcare provider (e.g., region, clinic, hospital) that is itself a NIS2 essential actor, that provider's NIS2 obligations may extend to evaluating MediReady's security posture as part of their supply-chain risk management.

9.4 MediReady's NIS2 Commitments

10. European Health Data Space (EHDS) — Future Monitoring

The EHDS Regulation (2023/2664) is under implementation.

10.1 What EHDS Addresses

• Secondary use of health data for research and policy
• Interoperability of electronic health records
• Rights to data portability in healthcare

10.2 MediReady's Position

10.3 Monitoring Commitment

MediReady:

• Monitors EHDS implementation phases
• Will assess scope if EHDS interoperability requirements evolve to include compliance-audit tools
• Will implement as required

10.4 EHDS Implementation Timeline

MediReady evaluation timeline: Q1–Q2 2026

11. Data Residency and Geographic Processing

MediReady Guarantee

This commitment applies to all Company Personal Data, including administrative records, policies, and workflow documentation provided to MediReady.

12. Overall Conclusion

Based on intended use, functionality, and regulatory criteria, MediReady is assessed as follows:

For Swedish Healthcare Providers

You can use MediReady as an administrative compliance and workflow tool. You must:

• Sign a GDPR-compliant Data Processing Agreement (provided separately)
• Assess MediReady's security posture for your own risk management (documentation available)
• Apply MediReady's findings with independent professional judgment

The tool does not substitute for legal or clinical counsel.