How we handle your information

1. Data controller

2. What information do we process?

Ordinary personal data

• Name and identity. You state your name when booking, and the doctor confirms your identity at the consultation
• CPR number (Danish civil registration number), which the doctor obtains at the consultation for the medical record and the prescription
• E-mail address and mobile number, which you enter yourself when booking
• Information about your membership: chosen treatment, status and payment history
• Technical information about your visit, including IP address, when you or we access your medical record (access log)

Sensitive personal data (special categories, GDPR art. 9)

• Health information from the questionnaire you complete before the consultation, including height, weight, BMI, symptoms and contraindications
• Medical record notes from your consultations: diagnosis, indication, treatment plan and follow-up
• Prescriptions and prescription issuing

Anonymous usage statistics. We keep statistics on how recepta.dk is used, for example which pages are visited, for how long, and how far people get in a treatment flow. The statistics are produced with Umami, a tool that runs on our own server, so no third party receives data about your visit. It uses no cookies and stores nothing on your device. Your IP address is not stored. It is only used in the moment to count the visit and find the country and city. The statistics therefore contain no information about you as a person.

3. Purposes of the processing

We process your information in order to:

• Know your identity, because a doctor must know who a prescription is issued to
• Assess whether you are suitable for the treatment, and carry out your video consultation
• Keep a patient record, as we are obliged to under the Danish Medical Records Order (journalføringsbekendtgørelsen)
• Issue prescriptions and follow up on your treatment
• Administer your membership, payment and bookkeeping
• Send you confirmations, reminders and practical information about your treatment
• Measure whether our ads work, but only if you have accepted marketing cookies (section 6)

4. Legal basis

• Ordinary personal data: GDPR art. 6(1)(b) (necessary to perform the agreement with you) and (c) (legal obligation)
• Health information: GDPR art. 9(2)(h). The processing is necessary for preventive medicine, medical diagnosis and treatment, and it is carried out by healthcare professionals bound by confidentiality
• CPR number: section 11(1) of the Danish Data Protection Act (databeskyttelsesloven), together with the rules on medical records in the Danish Authorisation Act (autorisationsloven) and the rules on prescriptions in the Danish Health Act (sundhedsloven)
• Bookkeeping: the Danish Bookkeeping Act (bogføringsloven)
• Marketing cookies: your consent, GDPR art. 6(1)(a), and the Danish Cookie Order (cookiebekendtgørelsen). You can withdraw your consent at any time (section 6)

5. Who do we share your information with?

We never sell your information. We use the following data processors, all of which are bound by a data processing agreement:

All our data processors comply with GDPR and are bound by data processing agreements. The video consultation itself is encrypted, and no video or audio from the consultation is recorded or stored. What the doctor notes is written in your medical record, which is kept in the EU. Meta and Google only receive information about your visit if you have pressed Allow in the cookie banner (section 6).

In addition, we disclose information when the law requires it, for example prescriptions to the prescription server of the Danish Medicines Agency (Lægemiddelstyrelsen) and the pharmacy, and reports to the relevant authorities.

6. Cookies and statistics

Our own statistics require no cookies. The only things that require your consent are cookies for marketing and for Google Analytics, and we ask about those in the cookie banner the first time you visit the site.

• Necessary. The only things stored in your browser without consent are what the site cannot work without: that you are logged in, which treatment you are booking, your answers along the way in the questionnaire so they are not lost if you refresh the page, and your own answer in the cookie banner.
• Statistics without cookies and without third parties. We use Umami, a statistics tool that runs on our own server, to see which pages are visited, for how long, and how far people get in a treatment flow. Data about your visit does not leave our server. Umami sets no cookies, stores nothing on your device and builds no profile of you. Your IP address is not stored. It is only used in the moment to count the visit and find the country and city.
• Google Analytics, only with your consent. If you press Allow in the cookie banner, we also use Google Analytics to see how visitors from our ads use the site. Google sets a cookie and receives information about your visit (pages, clicks and steps in a treatment flow) with a truncated IP address. If you press Only necessary, Google Analytics is not used.
• Marketing, only with your consent. If you press Allow in the cookie banner, the ad platforms we use (Meta, meaning Facebook and Instagram, as well as Google, Reddit and Snapchat) each set a cookie so we can see whether our ads work. We never send your questionnaire answers or your phone number to them. Meta, Reddit and Snapchat do not get your e-mail either. If you complete a booking, Google receives your e-mail address in encrypted (hashed) form, so Google can see that a click on our ad led to a booking. This only happens if you have pressed Allow. If you press Only necessary, nothing happens, and we remember your choice. You can always change your choice here.
• Fonts and scripts are hosted on our own server. Your browser does not fetch fonts or other content from Google when you visit recepta.dk, unless you have pressed Allow. In that case Google's script for ads and Google Analytics is loaded.

The services needed to complete a treatment flow (login, booking and payment) naturally still set what they need in order to work. They are listed in the table under section 5.

7. How long do we keep your information?

• Patient record: at least 10 years after the latest entry, under the Danish Medical Records Order (journalføringsbekendtgørelsen). The record is append-only: notes cannot be changed or deleted, and corrections are made as new notes
• Bookkeeping records: 5 years from the end of the financial year they relate to
• Access log: kept together with the record as documentation of who has seen your information
• Account without a completed treatment: deleted when it no longer serves a purpose
• Your choice in the cookie banner: stored in your browser until you change it or delete your browser data

8. Protection of your information

• Encryption in transit: all traffic to and from recepta.dk goes over HTTPS/TLS
• Encryption at rest: the database is encrypted at our data processor
• Access control: record data can only be accessed by the clinic's doctor after login. The system's services cannot be accessed by patients or outsiders
• Access log: every lookup in and every write to the record is logged with time and IP address
• Data minimisation: we only collect the information necessary for the treatment. The CPR number never leaves the server

9. Your rights

Under the General Data Protection Regulation you have the following rights:

• Access (art. 15): you can find out what information we process about you and get a copy
• Rectification (art. 16): you can have incorrect information corrected. In the medical record, corrections are made as a new note so the course can be documented
• Erasure (art. 17): you can ask to have information deleted. Note that the 10-year medical record duty takes precedence over an erasure request for record data
• Restriction (art. 18): you can ask us to restrict the processing
• Objection (art. 21): you can object to our processing
• Data portability (art. 20): you can receive your information in a machine-readable format
• Withdrawal of consent: if you have given consent, you can always withdraw it. This does not affect the lawfulness of the processing before the withdrawal

To exercise your rights, write to kontakt@recepta.dk. We reply within one month.

10. Complaints to the Danish Data Protection Agency

If you are dissatisfied with how we process your information, you can complain to the Danish Data Protection Agency (Datatilsynet):

Complaints about the medical treatment can be made to the Danish Agency for Patient Complaints (Styrelsen for Patientklager), stpk.dk.

11. Changes to this policy

We update this policy when our processing of information changes. The version in force at any time is on this page, with the date it was last updated. Significant changes are announced by e-mail.

12. Contact

If you have questions about how we process your information, you are always welcome to write:

See also

Other things you may be looking for

Terms and conditionsPrices, cancellation and withdrawal → About ReceptaWho is behind the clinic → Access to your dataWrite to kontakt@recepta.dk →