Privacy Policy

This privacy policy describes how Lægerne på Bryggen, Kigkurren 8M, 2300 Copenhagen S, CVR: 33923120, processes, uses, and discloses your personal data.

1. Processing of Information

In connection with our consultation, examination, diagnostics, and treatment of you as a patient, we collect and process a number of personal data about you as the data controller. We are obligated to do this in accordance with Chapter 6 of the Authorization Act and the Medical Record Keeping Executive Order.

2. Types of Information

We collect and process the following types of personal data about you (to the extent relevant for you):

General categories of personal data:

• Name, address, email address (if applicable), phone number, CPR number (national identification number), gender.
• Family and social relations, employment relationships, and education.

Special categories of personal data ("sensitive personal data"):

• Health information (e.g., medical records, lab results, tests, X-rays, scan results, etc.).
• Sexual relationships, race or ethnic origin, and religious beliefs.

3. Purposes

We process your personal data for the following purposes:

• Our examination, diagnostics, and treatment of you.
• Preparation of medical certificates and reports.
• Preparation of certificates for use by authorities, insurance companies, etc.
• Communication with or referral to other health professionals, doctors, hospitals, or hospital laboratories, including receiving and sharing necessary patient information (such as booked appointments, diagnoses, and treatment plans).
• Conducting video consultations, if relevant.
• Potential use of imaging materials for diagnostics.
• Medication prescriptions, including issuing prescriptions.
• Reporting to clinical quality databases.
• Ordering laboratory tests from hospital laboratories.
• Billing and invoicing purposes.
• Complying with our obligations under applicable legislation, including the EU General Data Protection Regulation (GDPR), the Danish Data Protection Act, and other relevant healthcare legislation. This includes:
  • Duty of documentation.
  • Compliance with basic principles for processing personal data and legal bases.
  • Implementation and maintenance of technical and organizational security measures, including preventing unauthorized access to systems, preventing malicious code, halting denial-of-service attacks, and preventing damage to computer systems.
  • Investigation of suspected or known security breaches and reporting to individuals and authorities.
  • Handling inquiries and complaints from data subjects and others.
  • Handling inspections and inquiries from supervisory authorities.
  • Handling disputes with data subjects and third parties.
  • Statistical studies and scientific research.

4. Voluntary Provision

When we collect personal data directly from you, you provide it voluntarily. You are not obligated to provide this data. The consequence of not providing the personal data will be that we cannot fulfill the purposes listed above, and in some cases, we may not be able to examine, diagnose, or treat you.

5. Data Sources

In some cases, we collect personal data about you from other health professionals, e.g., hospitals, or through access to electronic medical record systems. We process the received information in accordance with this privacy policy.

6. Disclosure of Personal Data

To the extent necessary for your specific examination, diagnosis, or treatment, your personal data will be disclosed and shared with the following recipients:

• Other healthcare professionals.
• RKKP (clinical quality databases), the Danish Patient Safety Authority, the Danish Health Data Authority (prescriptions, vaccinations, adverse events, and deaths), police and courts, social authorities, and the Danish Labour Market Insurance (AES) where required by law.
• Referral recipients (disclosing data to the health professionals to whom the referral is sent).
• Hospital laboratories (submitting laboratory samples).
• Regional billing offices (submitting information for treatment reimbursement).
• Pharmacies and the Danish Medicines Agency via the Shared Medicine Card (FMK) when issuing prescriptions.
• Relatives or insurance companies (only with your explicit consent).

7. Legal Basis for Processing and Disclosure

The legal basis for collecting, processing, and disclosing your personal data is:

• For general patient care, general data is processed under GDPR Article 6(1)(c) and (d), while sensitive health data is processed under Article 9(2)(c) and (h).
• Furthermore, we are legally required to keep medical records under Chapter 6 of the Authorization Act, the Medical Record Keeping Executive Order (specifically §§ 5-10), and Chapter 9 of the Danish Health Act.
• Where not required by law, data is only shared with other health professionals with your prior consent in accordance with §§ 42a-42e of the Danish Health Act.
• Billing data is sent monthly to the regional billing office under the Agreement on General Practice / § 60 of the Danish Health Act.
• Medication and vaccination data is transmitted via the Shared Medicine Card (FMK) under § 157 of the Danish Health Act and the Prescription Executive Order.
• Insurance companies receive data solely with your prior consent, ref. GDPR Articles 6(1)(a) and 9(2)(a).
• Relatives receive data solely with your prior consent under § 43 of the Danish Health Act. For deceased patients, certain data may be disclosed to close relatives under § 45 of the Health Act.

Withdrawal of Consent: If the processing of your personal data is based on consent, you have the right to withdraw it at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

8. Recipients and Data Processors

Your personal data is processed and stored by us and our data processors on our behalf. Our current data processors are:

• Clinea (electronic medical records system)
• KiAP (digital care pathways)
• SynLab, Webreq, and Webpatient (lab test ordering and patient questionnaire storage)

9. Retention Period

We store your personal data as long as necessary to fulfill the purposes above. However, according to § 15 of the Medical Record Keeping Executive Order, we are obligated to retain patient records for a minimum of 10 years after the last entry. In certain cases (e.g., complaints or compensation claims), records may be stored longer until the case is finalized.

10. Your Rights

Under data protection law, you have the right to request access to your personal data, request correction of incorrect data, request restriction of processing, request data portability, and object to the processing.

Please note that your rights are limited by the laws governing general practitioners. For example, § 14 of the Medical Record Keeping Executive Order prohibits deleting records in patient files; only corrections/additions may be made.

You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you are dissatisfied with how we process your data. Contact details are available at www.datatilsynet.dk.