Finland

Mindemo Oy (formerly Heltti Oy)

33,000 €

GDPR enforcement action by Deputy Data Protection Ombudsman on 2026-10-02.

Rank · Sector

#86

of 290 in Health Care

Rank · Finland

#17

of 29

Rank · All fines

#923

of 3,223

Case details

Authority: Deputy Data Protection Ombudsman
Date: 2026-10-02
Controller / Processor: Mindemo Oy (formerly Heltti Oy)
Sector: Health Care
Quoted Articles: Art. 5 (1) f) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Finnish DPA has imposed a fine of EUR 33,000 on Mindemo Oy (formerly Heltti Oy). The controller offers booking software services for healthcare providers. Following a tip-off in November 2022, the authority made several test bookings through the controller's service, arranging different appointments for different issues. The controller provided Google and Microsoft Services (Analytics, DoubleClick, Bing and LinkedIn) with data relating to the bookings. This data contained information on which healthcare professional was searched for, which was chosen, confirmation that a booking had been made, insurance information relating to the bookings and the location. IP addresses, device and browser information, cookies and URLs were also processed in an unencrypted and unpseudonymised form. This took place from April 2024 to May 2025.

Open original source Links to the regulator's original publication or another source.