This translation is provided for information only. The Danish version is legally binding.

Privacy policy

When we examine, diagnose and treat you as a patient, the clinic collects and processes personal data about you. This privacy policy describes how we use and disclose your personal data.

The clinic collects and processes the following types of personal data about you (where relevant to you):

General personal data:

  • Name, address, email address if provided, phone number, Danish personal identification number (CPR), family and social relationships, work relationships and education.

Special categories of personal data (“sensitive personal data”):

  • Health data (for example medical records, test results, tests, scan images and scan reports), sex life, racial or ethnic origin and religious beliefs.

Purposes

We process your personal data for these purposes:

  • Examining, diagnosing and treating you
  • Preparing medical statements
  • Preparing certificates for authorities, insurers and others
  • Communicating with or referring you to other health professionals, doctors, hospitals or hospital laboratories
  • Prescribing medicines, including issuing prescriptions
  • Reporting to clinical quality databases
  • Reporting laboratory samples to hospital laboratories
  • Billing
  • Meeting our legal obligations, including the duty to keep records
  • Statistical studies and scientific research
  • Complying with the basic principles and legal basis for processing personal data
  • Handling enquiries and complaints from data subjects and others
  • Handling inspections and enquiries from supervisory authorities
  • Handling disputes with data subjects and third parties

Voluntary provision

When the clinic collects personal data directly from you, you provide it voluntarily. You are not obliged to give it to us. However, if you don’t, we may not be able to fulfil the purposes above, and in some cases we may not be able to examine, diagnose or treat you.

Sources

In some cases we collect personal data about you from other health professionals, for example hospitals or your referring doctor, or by looking you up in electronic record systems. We process the data we receive in line with this privacy policy.

Disclosure of personal data

Where necessary for your examination, diagnosis or treatment, your personal data will be disclosed to and shared with others:

  • Data is disclosed to other health professionals when needed for ongoing treatment.
  • Data is disclosed to other authorities, clinical quality databases, the Danish Vaccination Register, the Danish Patient Safety Authority, the Shared Medication Record (Det Fælles Medicinkort), the police, social services and Labour Market Insurance (Arbejdsmarkedets Erhvervssikring) where the law requires it. As a patient you have the right to see your own medical records.
  • When we refer you, data is disclosed to the health professionals receiving the referral.
  • When laboratory samples are reported, the samples are sent to hospital laboratories.
  • When billing for patient treatment is reported, data is disclosed to the regional billing offices.
  • When prescriptions are issued, data is disclosed to pharmacies and the Danish Medicines Agency via the prescription server.
  • When reporting to clinical quality databases.
  • When discharge summaries are sent, data is disclosed to the referring doctor and in some cases the referring hospital.
  • In other cases, data is disclosed to relatives or insurers.

Legal basis for processing and disclosing personal data

For ordinary patient treatment, general personal data is processed under Article 6(1)(c) and (d) of the General Data Protection Regulation (GDPR), and sensitive personal data under Article 9(2)(c) and (h) GDPR.

We are also required to process certain personal data in ordinary patient treatment under Chapter 6 of the Danish Authorisation Act (autorisationsloven), the Executive Order on health professionals’ medical records (journalføringsbekendtgørelsen), in particular sections 5–10, and Chapter 9 of the Danish Health Act (sundhedsloven).

Health data for further treatment on referral is disclosed under sections 20–23 of the Agreement on Specialist Medical Care (Overenskomst om speciallægehjælp) and the Health Act.

Laboratory samples are reported to hospital laboratories under the Danish Health Authority’s guidance on paraclinical tests, issued under the Authorisation Act.

Data for billing patient treatment is sent once a month to the region’s billing office under section 49 of the Agreement on Specialist Medical Care and the Health Act.

Prescriptions are sent through the prescription server IT service under Chapter 42 of the Health Act and the Executive Order on prescriptions and dose dispensing of medicines, in particular Chapter 3.

Clinical patient data is disclosed to clinical quality databases under sections 195–196 of the Health Act and the Executive Order on reporting to clinical quality databases. Data may also be disclosed with your specific consent.

Discharge summaries, a short summary of your medical history and treatment, are sent to the referring doctor and in some cases the referring hospital under Chapter 9 of the Health Act.

Withdrawing consent

If we process your personal data on the basis of consent, you have the right to withdraw it. Withdrawing consent doesn’t affect processing that took place before, including any disclosure based on consent.

Use of data processors

Your personal data is processed and stored by our data processors on our behalf and on our instructions. Our current data processor is Novax, Bremårevej 9, 8520 Lystrup, Denmark, tel. +45 87 42 44 24.

Retention period

We keep your personal data for as long as we need it for the purposes above. Under the medical records rules we must keep it for at least 10 years after the last entry in your record. In some cases, such as a complaint or compensation claim, we may need to keep it longer, until the case is finally closed.

Your rights

Within the limits of the law, you have certain rights, including the right of access to your personal data, the right to have incorrect data corrected, the right to erasure, the right to restriction of processing, the right to data portability and the right to object to processing, including automated individual decision-making (“profiling”). You also have the right to complain to a supervisory authority, such as the Danish Data Protection Agency (Datatilsynet).