Privacy policy for the Mit Kvindeliv app.

Mit Kvindeliv ApS, CVR 46844505, Rislundvej 3, 8240 Risskov, Denmark, is the data controller for the information processed in the app. This applies both to patients of Mit Kvindeliv and to women who are not patients. You can contact us at hej@mitkvindeliv.dk.

Koed Ventures has developed the app and runs it for us as a data processor, with access to the server and under a data processing agreement.

The app is for women over 18. Anyone can create a free account and use the diary, the progress view and the guidance in the app. If you are a patient of Mit Kvindeliv, you can also see your appointments, notes from the clinic and invoices, write to Sara in the chat and share your diary with her (section 6).

The app is available for iPhone (App Store) and Android (Google Play) and as a web version at app.mitkvindeliv.dk. They use the same server and this policy, in Danish or English.

If you are not a patient

You create an account with your email and a 6-digit code that we send to it. You can also use Sign in with Apple or Google, where the app offers it. There is no password. We ask for your year of birth, and if you are under 18 this year, you cannot create an account.

If you are a patient

1. You enter your mobile number.
2. We send a 6-digit one-time code by email to the address the clinic has for you in Terapeut Booking. The code is valid for 10 minutes and can be used once.
3. You enter the code and are logged in.

The answer is the same whether or not the number exists, so no one can test who is a patient. The code is never sent to an address you type yourself. Your number and email must be yours alone: if you share them with another customer of the clinic (for example mother and daughter), you cannot log in with them.

If you have a free account and become a patient, you can link it to the clinic under My doctor (“Are you a patient? Link your account”). If you already have a patient account with data, we ask before anything is moved. If you say yes, we move your diary, your three symptoms, your treatment and your cycle to the patient account and delete the free account.

For everyone

The app keeps you logged in for up to 30 days, or until you log out. On the web you can also create a key (a passkey) on your device and log in with Face ID, fingerprint or the device passcode instead of a code by email. In the apps for iPhone and Android, keys are not available yet.

For Apple’s and Google’s review of the app there is a test account with made-up information. It does not belong to any patient and shows no patient’s information.

The app stores what you record yourself and what is needed for your account and for security. If you are a patient, the app does not store your appointments, notes from the clinic and invoices: they are fetched from Terapeut Booking when you open them.

• Account

  Content

  an account ID, when the account was created and last used (updated at most once a day), your year of birth (only the year, never the date) and your language

  Comes from

  you

  Stored in the app?

  Yes (section 9)

• Login with email, Apple or Google (if you are not a patient)

  Content

  a checksum of your email address or of your user ID at Apple or Google (never the value itself), which ways you log in, and your email address in encrypted form. We use the address only for an email before we delete an account you have not used (section 9), and when you book the free consultation (section 7). If you use Apple, it may be a forwarding address from Apple

  Comes from

  you, Apple or Google

  Stored in the app?

  Yes. The encrypted address is removed if you link the account to the clinic

• Login as a patient

  Content

  mobile number and email (looked up in Terapeut Booking), one-time code (only as a checksum) and session

  Comes from

  Terapeut Booking and you

  Stored in the app?

  Yes, briefly (section 9)

• Key for login (optional, web only)

  Content

  the public half of the key, key ID, a technical counter, a random user ID, whether the key can be backed up, a rough description of the device (for example iphone or safari) and times. Your fingerprint or face never leaves your device. The private half of the key is kept by your device and the provider of your keychain (for example Apple or Google), not by us

  Comes from

  your device and you

  Stored in the app?

  Yes, until you remove the key or delete your account

• Abuse protection

  Content

  your IP address and your mobile number, email or account ID together with the times of attempts to get a code or to book

  Comes from

  your device and you

  Stored in the app?

  Yes, for at most 25 hours and only as a checksum (never in plain text)

• Your chosen life stages

  Content

  what you have chosen under “What would you like help with?”: menstruation and cycle, contraception, fertility, pregnancy, menopause or preparing for a doctor’s appointment. It may say something about your health

  Comes from

  you

  Stored in the app?

  Yes, as part of your account profile, until you change it under Profile, My life stage, or delete your account. It is not deleted when you withdraw the consent to store

• Life stage at the clinic (patients only)

  Content

  the life stage labels the clinic has put on your customer profile in Terapeut Booking, which also decide what the app shows you

  Comes from

  Terapeut Booking

  Stored in the app?

  No, shown only

• Consents

  Content

  which consents you have given (to store, to share with Sara and to analysis), in which version, in which language and when

  Comes from

  you

  Stored in the app?

  Yes

• Diary

  Content

  for each day: your mood (1–5) and a comment, bleeding (none, spotting with colour, or a period: light, moderate or heavy, and whether it is the first day), your three symptoms (0–4) and how much your everyday life is affected, at work and socially (0–4)

  Comes from

  you

  Stored in the app?

  Yes, only with consent

• Your three symptoms, your cycle and your treatment

  Content

  the three symptoms you follow; the date of your last period or that you no longer have periods; medicine, dose and dates of start, dose change, switch and stop

  Comes from

  you

  Stored in the app?

  Yes, only with consent

• BMI measurements (optional)

  Content

  your weight and height and the time, when you save a measurement in the BMI calculator yourself (BMI is calculated from them); only you can see them, and they are not shared with Sara

  Comes from

  you

  Stored in the app?

  Yes, only with consent and only when you tap “Save measurement”. You can delete each measurement

• Questionnaires (optional)

  Content

  your answers to the menopause questionnaire (Menopause Rating Scale, 11 questions) with date and score, and your daily answers in the PMS/PMDD diary (Daily Record of Severity of Problems: mood, body, daily life and bleeding); whether you want reminders about the menopause questionnaire, and which reminders you have received

  Comes from

  you

  Stored in the app?

  Yes, only with consent (the PMS/PMDD diary has its own consent)

• Older entries

  Content

  what you recorded in an earlier version of the app, for example older diary entries, contributing factors and side effects. The app no longer shows them, but we still have them

  Comes from

  you

  Stored in the app?

  Yes, until you withdraw your consent or delete your account

• Chat with Sara (patients only)

  Content

  your messages and the clinic’s replies with time and sender, how far you have read, and the clinic’s draft of a medical record note after a conversation

  Comes from

  you and the clinic

  Stored in the app?

  Yes, encrypted (section 6)

• Booking the free consultation

  Content

  name, email, phone number, what you are seeking help with, and what you want to tell Sara in advance

  Comes from

  you and your account

  Stored in the app?

  No, it is sent to Terapeut Booking (section 7)

• Access log

  Content

  time and the name of the event (for example “login”, “account created”, “data downloaded” or “booked in the app”), linked to a pseudonym; never content. At login and for a new key, a rough description of the device is also recorded. The log is also used to see when you first used the app, so the app knows when it may ask for feedback, and to count how many people use the app (only numbers, never who)

  Comes from

  the system

  Stored in the app?

  Yes

• Profile photo (optional)

  Content

  the photo you choose yourself

  Comes from

  you

  Stored in the app?

  Yes, if you choose a photo on the web: it is kept by us so that you can see it on all your devices, until you remove it. In the apps it is kept only on your own device

• Feedback about the app (optional)

  Content

  a number from 0 to 10 and two text fields (at most 1000 characters each), where you came from (Home or Profile), whether it was the web, iPhone or Android, your language, and a marker if you have chosen “Not now”

  Comes from

  you

  Stored in the app?

  Yes, without your name and under a pseudonym (section 9)

• Notifications and reminders (optional, apps only)

  Content

  the phone’s push address (from Apple or Google via Expo), whether it is an iPhone or Android, your language, whether you have chosen “Hide content in notifications”, and which login the address belongs to; for the reminder, time of day and time zone; and which notes, appointments and invoices you have already been notified about (only their numbers, never the content)

  Comes from

  your phone and you

  Stored in the app?

  Yes, when you turn on notifications or the reminder yourself

If you are a patient, information from Terapeut Booking is cached for at most 30 seconds in the server’s memory (the client list for at most 5 minutes) and is not written to the database. The app reads your medical record to select the notes your doctor has marked for you; the other notes are not shown and not stored. If you are not a patient, the app fetches or sends nothing at Terapeut Booking, unless you book the free consultation yourself (section 7).

Feedback: on Home (after two weeks of use) and under Profile you can give us a number from 0 to 10 and write what works and what does not. It is voluntary and not covered by the consent to store. We store the answer without your name and contact details, under a pseudonym, so that it can be deleted together with your account. The screen asks you not to write health information. The answers are read only by the developer at Koed Ventures, not by the clinic.

The clinic does not see your diary unless you are a patient and share it yourself (section 6). The app uses no analytics, tracking or advertising tools. We show no ads and never sell your information.

We process health information only with your explicit consent or as part of your treatment at the clinic. Everything else we process to provide the app to you under the terms and to run and improve it securely.

• Creating your account, logging you in and keeping you logged in

  Information

  account, year of birth, language, login information and session, your encrypted email address (if you are not a patient); with a key also its public half and the device’s rough description

  Legal basis

  GDPR Article 6(1)(b) (the agreement to use the app, see the terms) and (f) (secure access)

• Storing your diary, your symptoms, your cycle and your treatment so that you can follow your progress, and adapting the app to the life stages you have chosen

  Information

  diary, the three symptoms, cycle, treatment, chosen life stages and older entries

  Legal basis

  Article 9(2)(a) (your explicit consent) and Article 6(1)(a)

• Showing patients their appointments, invoices and notes from the clinic and adapting the app to the life stage at the clinic

  Information

  information from Terapeut Booking, including the life stage labels the clinic has put on you

  Legal basis

  Article 6(1)(b); for notes and appointments also Article 9(2)(h) (health purposes)

• Chat with Sara (patients only)

  Information

  messages, replies and the clinic’s draft of a medical record note

  Legal basis

  Article 6(1)(b) and Article 9(2)(h) (health purposes)

• Sharing your diary with Sara as a medical record note (patients only)

  Information

  the days you share (shown to Sara in the clinic’s overview) and a summary of your diary every 30 days (mood, bleeding, symptoms, daily life, treatment and your comments); your answers to the menopause questionnaire (written in your medical record) and in the PMS/PMDD diary (shown to Sara in the clinic’s overview)

  Legal basis

  Article 6(1)(b) and Article 9(2)(h) (health purposes: your treatment at the clinic); you can opt out at any time. After that, as medical record information under the rules on medical records

• Booking the free consultation in the app

  Information

  name, email, phone number, what you are seeking help with, and your note to Sara

  Legal basis

  Article 6(1)(b) (arranging the consultation with you); for what you write about your health, Article 9(2)(a) (your consent when you tick the box)

• Combined analyses so that Sara can see patterns across women (only if you say yes)

  Information

  copies of parts of your entries under a research number (section 5)

  Legal basis

  Article 9(2)(a) (your separate, explicit consent) and Article 6(1)(a)

• Protecting against abuse by limiting attempts to get codes and to book

  Information

  IP address, mobile number, email or account ID (stored only as a checksum), times

  Legal basis

  Article 6(1)(f) (legitimate interest in secure operation)

• Being able to document who has had access to what

  Information

  the access log and the clinic’s log of chat conversations

  Legal basis

  Article 6(1)(f), in view of the requirement of appropriate security in Article 32

• Letting you give feedback and seeing whether and how much the app is used, so that we can improve it

  Information

  feedback under a pseudonym; the access log, where only numbers are counted

  Legal basis

  Article 6(1)(f) (legitimate interest in improving the app)

• Notifying you of news from the clinic and reminding you of your diary, when you have turned this on yourself (apps only)

  Information

  push address, platform, language, the choice to hide content, the reminder’s time of day and time zone

  Legal basis

  Article 6(1)(a) (your own choice, which you can turn off again)

Consent to store

When you create an account, we ask for your consent for Mit Kvindeliv to store the health information you record yourself, so that you can follow your progress. It covers your diary, your three symptoms, your cycle and your treatment. Without the consent, the app cannot store your diary. If you are a patient, you can see your appointments, notes and invoices and use the chat without it. If we change the text, we ask you again.

You can withdraw the consent at any time under Profile, My data and consents (“Withdraw”). We then delete your diary, your three symptoms, your cycle, your treatment, your older entries, a consent to sharing from an older version of the app and your consent to analysis, and we store no new ones until you say yes again. Your account, your chosen life stages (they are part of your account profile) and an opt-out from sharing with Sara remain. What you have already shared with Sara stays in the medical record (section 6). Withdrawal does not make the processing that took place before you withdrew your consent unlawful.

Share with Sara (patients only)

If you are a patient, you share your diary with Sara by default, and you can opt out. This does not require a separate consent, but your diary is only stored with the consent to store (section 6).

Help Sara learn more

This is a separate, voluntary consent, and the choice is shown in the app only when the analysis is turned on. If you say yes, we copy parts of your entries to a separate database: without name, contact details, comments and other free text, under a research number instead of your account ID, with the week instead of the date and with your age group instead of your age. Sara sees only combined figures with at least 10 women behind each figure, never you alone.

The information is pseudonymised, not anonymous: with a key that is kept only on the server, the research number can be traced back to your account. You can withdraw the consent under Profile, My data and consents. We then delete your information in the analysis database. Figures that have already been combined cannot be withdrawn.

Feedback, notifications and reminders

Feedback to us about the app is voluntary and not covered by the consent to store (sections 3 and 4).

Notifications and reminders in the apps are also your own choice: the phone asks for permission first when you turn them on, and you can turn them off again under Profile, Reminders or in the phone’s settings. The reminder about your diary comes only if you have said yes to storing, because otherwise we cannot see whether you have already filled in the day. The reminder about the menopause questionnaire comes only once you have filled in the questionnaire at least once, and when it is time again according to the schedule; you can turn it off under Questionnaires. If you turn notifications off in the app, we delete the phone’s push address; if you only turn them off in the phone’s settings, they are not shown, but the address stays with us until you log out.

Appointments, notes and invoices

The app shows your own appointments, the notes your doctor has marked for you, and your invoices from Terapeut Booking. It does not store them and never changes anything in the medical record. Invoices cannot be paid in the app.

Chat with Sara

If you are a patient and the clinic has opened the chat for you, you can write to Sara under My doctor. You will usually get a reply within 1–2 working days. The chat is not for emergencies: in an emergency, call 112.

The messages are stored on the app’s server in Germany, encrypted with a key that is not kept in the database or in the backups. Only you and the clinic can read them. The clinic gets an email saying there is a new message, but never your name or what you wrote, and you get a notification on your phone without content when there is a reply.

When a conversation ends, Sara can write a medical record note based on it. It is written to your medical record in Terapeut Booking only when she has approved it, and it stays in the medical record even if you delete your account. The clinic logs when a conversation is opened or changed (the conversation’s number and the event, never the content).

Share your diary with Sara

If you are a patient, you share your diary and your logs with Sara, your doctor, by default, so that she can follow your care. You can opt out at any time (Profile, Share with Sara). Before anything is shared, the app shows you what is shared and that you can say no. Sara can see the days you share in the clinic’s own overview; only the clinic has access, and every view is logged without content. Nothing is written in your medical record day by day: every 30 days the app writes a summary of the period as a note in your medical record in Terapeut Booking. The first one is written no earlier than 30 days after you received the message.

The questionnaires are shared in the same way when you are a patient and share with Sara: each menopause questionnaire you fill in is written as a note in your medical record with date, answers and score (you can say no for each questionnaire), and Sara can see your answers in the PMS/PMDD diary for the shared period in the clinic’s overview (they are not written in your medical record). If you turn sharing off, none of them are shared. If you are not a patient, your questionnaires are not shared with anyone.

The summary has the dates of the period, how many days you logged, your mood, bleeding and when your period started, your symptoms (average, highest and change from the previous period), how much your daily life was affected, changes to your treatment and your comments with their dates. Days you have chosen not to share (“Don’t share this day”) are left out. The practitioners at Mit Kvindeliv who have access to your medical record can see the note together with the rest of it.

If you used the app before you became a patient, the app asks you once whether you also want to share your earlier logs with Sara. Nothing is selected in advance. If you say no, only what you log from the day you became a patient is shared. If you say yes, Sara can see them, and they can be gathered in one note in your medical record.

Notes that have been shared stay in the medical record, even if you delete something in the app, withdraw your consent or delete your account, because the medical record is the clinic’s documentation. If you opt out, no new summaries are written, and if you opt in again, only days from that day are shared. The notes are marked as coming from your app, shared by default, and they are not shown among your notes from the clinic.

In the app you can book a free 15-minute video consultation with Sara, whether or not you are a patient. You can have one upcoming free consultation at a time.

When you book, the app sends your name, your email, your phone number, what you are seeking help with, and what you want to tell Sara in advance to Mit Kvindeliv’s medical record system Terapeut Booking, so that Sara can prepare for the consultation. Name and email are taken from your account; if we do not have your name, you write it yourself. “What are you seeking help with?” is filled in in advance from the life stages you have chosen, and you can change it. You must give your consent by ticking a box before you can book.

If the clinic does not already have a customer profile with your email, we create one in Terapeut Booking with your name, your email, your phone number and what you are seeking help with. The appointment and the customer profile are then processed by the clinic as described in the website’s privacy policy. This does not link your account in the app to the clinic; that happens only if you link it yourself (section 2).

You get a confirmation by email, and the clinic gets a short email with the time. The app itself does not store what you wrote: only counters that limit the number of attempts (as a checksum, for at most a day), and that you have booked, in the access log (without content).

Your health information is stored in the EU: on the app’s server at Hetzner in Falkenstein, Germany, and, if you are a patient or have booked a consultation, at Terapeut Booking in Denmark. We use the suppliers below to run the app. They process information only on our instructions and under data processing agreements.

• Hetzner Online GmbH

  What they do

  server and database for the app

  Information

  everything the app stores (section 3); the database is on an encrypted disk

  Location

  Falkenstein, Germany

• Terapeut Booking (EasyPractice ApS)

  What they do

  the clinic’s medical records, appointments, invoices and customer profiles

  Information

  what patients see in the app is fetched from here; shared notes, approved notes from the chat and bookings of the free consultation are written here

  Location

  Denmark, with sub-processors as in the clinic’s privacy policy

• Google Workspace (Google)

  What they do

  sends emails from noreply@mitkvindeliv.dk and the clinic’s email

  Information

  your email address and the code; the confirmation of a booking; the email before we delete an account you have not used; emails to the clinic about a new chat message or booking (without content); for new feedback, an email to the developer with the number, but never the text

  Location

  EU and USA

• Cloudflare, Inc.

  What they do

  delivers the web version’s files at app.mitkvindeliv.dk and DNS

  Information

  your IP address and technical information when the page loads; no health information

  Location

  global network, USA

• Koed Ventures

  What they do

  develops and runs the app

  Information

  technical access to the server and the database for operation and troubleshooting; reads the feedback that is sent (stored without name)

  Location

  Denmark

• Expo, with Apple and Google as sub-processors

  What they do

  pass notifications and reminders on to your phone when you have turned them on (apps only)

  Information

  the phone’s push address and the fixed text of the notification; no health information in the text

  Location

  USA

Apple and Google provide the App Store and Google Play when you download the app. They see that your Apple or Google account has downloaded the app, but no information from the app goes through the stores. If you choose Sign in with Apple or Google, Apple or Google confirms to us who you are. They see that you are logging in to the Mit Kvindeliv app, and we get only your user ID and your email. Apple and Google are themselves responsible for their processing of information about your Apple or Google account.

If you turn on notifications or the reminder in the app, our server sends the notification via Expo’s push service, and Expo passes it on via Apple’s notification service to an iPhone or via Google’s (Firebase Cloud Messaging) to an Android phone. They see the phone’s push address and the text of the notification. The texts are fixed and never contain names, dates or what something is about: “You have a new note from Mit Kvindeliv.”, “You have a new appointment.”, “One of your appointments has changed.”, “You have a new invoice.”, “You have a new message from Mit Kvindeliv.” “Don’t forget your daily log.” and “It’s time to fill in a questionnaire.” If you have chosen “Hide content in notifications”, the only text is “There is something new for you in Mit Kvindeliv.”

Google, Cloudflare, Expo and Apple have servers in the USA. According to the suppliers, the transfer takes place on the basis of the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses, as in the clinic’s privacy policy. The app’s server and database are in the EU, and traffic to the server goes directly, bypassing Cloudflare.

We never sell your information, show no ads and do not use your information for marketing.

What you record yourself is stored until you withdraw your consent or delete your account. If you have a free account that you have not logged in to or used for 24 months, we delete it and everything the app has stored about you. We send an email 30 days before if we have an email address we can read; otherwise the account is deleted without an email. Patient accounts are not deleted automatically.

If you delete your account in the app (Profile, My data and consents, “Delete my account”), we immediately delete everything the app has stored about you: account and logins, diary and entries, including the older ones, consents, chat messages, keys, push addresses, reminders, feedback, profile photo and your information in the analysis database. The exceptions are in the overview: the access log, the clinic’s log of chat conversations, what has been written to your medical record, and backups.

• Appointments, invoices, notes and customer profile at the clinic

  Stored

  not in the app, but in Terapeut Booking

  Deleted

  follows Terapeut Booking and the rules on medical records (the clinic’s policy: as a rule at least 10 years after the latest entry in the medical record)

• Account, year of birth, chosen life stages, language and logins

  Stored

  until you delete your account; a free account for at most 24 months after you last used it

  Deleted

  immediately when you delete your account. If you link a free account to the clinic, the encrypted email address is removed; if it is merged with a patient account, the free account is deleted

• One-time code (checksum)

  Stored

  10 minutes

  Deleted

  when the code has been used; otherwise at the latest about 1 hour after it expires

• Checksums in the counters against abuse

  Stored

  at most 25 hours

  Deleted

  automatically, cleared every hour

• Session

  Stored

  up to 30 days

  Deleted

  immediately when you delete your account; otherwise at the latest 7 days after expiry or logout

• Consent, diary, symptoms, cycle, treatment and older entries

  Stored

  until you withdraw your consent or delete your account

  Deleted

  immediately when you do so

• Information in the analysis database (only if you have said yes)

  Stored

  until you withdraw your consent to analysis or to storing, or delete your account

  Deleted

  immediately when you do so; figures that have already been combined remain

• Chat messages and drafts of medical record notes (patients only)

  Stored

  until you delete your account; there is currently no automatic deletion

  Deleted

  immediately when you delete your account. A medical record note Sara has approved stays in the medical record

• The clinic’s log of chat conversations

  Stored

  2 years

  Deleted

  automatically after 2 years, not when you delete your account. It contains only the conversation’s number and the event, never the content

• Access log

  Stored

  currently without a deletion deadline

  Deleted

  not when you delete your account

• Notes shared to the medical record

  Stored

  in the medical record

  Deleted

  not deleted by the app (section 6)

• Profile photo

  Stored

  on the web with us until you remove it or delete your account, and as a copy in your browser until you log out; in the apps only on your device

  Deleted

  with us immediately when you remove it or delete your account (the photo is overwritten in the database)

• Keys for login (public half etc.)

  Stored

  until you remove the key (Profile, My devices, on the web) or delete your account

  Deleted

  with us immediately when you do so. The private half of the key is kept by your device and the provider of your keychain; you remove it there

• Feedback (number and text, without name)

  Stored

  until you delete your account, and at most 730 days (two years) after you sent it

  Deleted

  immediately when you delete your account; otherwise automatically when it is 730 days old

• Push address (apps only)

  Stored

  until you turn off notifications in the app, log out, your login expires (after 30 days), or you delete your account

  Deleted

  with us immediately when you do so, or when Apple or Google reports that the address no longer works; for an expired login within an hour

• The reminder’s settings and the numbers of what you have been notified about

  Stored

  until you delete your account

  Deleted

  immediately when you delete your account

• Backups

  Stored

  up to 14 days

  Deleted

  see below

The app’s database is copied every night, and the copies are kept encrypted for 14 days. What you delete may therefore remain in a copy for up to 14 days. In addition, Hetzner backs up the whole server.

Your information is protected by encryption, limited access and technical barriers. These are the most important measures:

• The connection to the app is encrypted (HTTPS).
• The server is in Germany. The database is on an encrypted disk, and the backups are encrypted. The server has a firewall, requires a key for access and is updated automatically.
• Chat messages are encrypted with a separate key that is kept neither in the database nor in the backups.
• Email, mobile number, IP address and user ID at Apple or Google are stored only as a checksum (HMAC-SHA256 with a secret key that is not in the database). The only email address we can read again is the encrypted address on a free account (section 3).
• The one-time code has 6 digits, is valid for 10 minutes and can be used once. There are 5 attempts per code and at most 3 codes per 10 minutes and 10 per day, and the number is also limited per IP address.
• If you log in with Apple or Google, the server itself checks the proof from Apple or Google.
• In the app on your phone, under Profile, Privacy and security, you can lock the app with Face ID, fingerprint or the phone’s passcode, hide the content of notifications and hide the app in the app switcher. The choices are off until you turn them on, and they apply only to that phone. Your face or fingerprint never leaves the phone.
• On the web you can log in with a key on your device. We store only the public half of the key, and a new key can be created only within 15 minutes after a login with a one-time code.
• In the browser your login is kept in a cookie that the page’s own code cannot read, and strict security rules limit what the page may load and contact.
• You can see only your own information, and the patient features only as a patient. This is checked on the server and covered by automated tests.
• Only the fields the app needs are fetched from Terapeut Booking. CPR numbers and internal notes never reach your phone or browser. The key to Terapeut Booking is kept only on the server.
• The access log shows what has happened (for example a login), but never the content.

If there is a personal data breach, we report it to the Danish Data Protection Agency (Datatilsynet) and tell you about it when the rules require it.

Before you log in, the web version sets no cookies. Some choices and small markers are stored in the browser’s local storage, a few also before you log in (overview below).

• __Host-mk_session

  What

  cookie from api.mitkvindeliv.dk

  Purpose

  keeps you logged in

  Lifetime

  30 days, or until you log out

  Type

  necessary

• mitkvindeliv.signedIn

  What

  local storage in the browser

  Purpose

  remembers that you were logged in, so that the page can be shown at once (a yes/no marker, no secret)

  Lifetime

  until you log out

  Type

  necessary

• mitkvindeliv.profilbillede

  What

  local storage in the browser

  Purpose

  a copy of the profile photo you choose yourself, so that it is shown at once

  Lifetime

  until you remove the photo or log out

  Type

  functional, only if you choose a photo

• mitkvindeliv.passkeysServer

  What

  local storage in the browser

  Purpose

  remembers whether login with a key is turned on with us; also stored before you log in

  Lifetime

  until you clear the browser’s data

  Type

  functional

• mitkvindeliv.passkey

  What

  local storage in the browser

  Purpose

  remembers that this browser has a key for us

  Lifetime

  until you remove your last key or clear the browser’s data

  Type

  functional, only if you have created a key

• mitkvindeliv.symptomer

  What

  local storage in the browser

  Purpose

  a copy of the app’s list of symptoms (the same for everyone, nothing about you)

  Lifetime

  until you clear the browser’s data

  Type

  functional

• mitkvindeliv.guide and mitkvindeliv.tip.dagbog

  What

  local storage in the browser

  Purpose

  remembers that you have seen the guide and the diary tips, so that they are not shown again

  Lifetime

  until you clear the browser’s data

  Type

  functional

• mitkvindeliv.sprog, mitkvindeliv.tema and mitkvindeliv.visalt

  What

  local storage in the browser

  Purpose

  your choice of Danish or English, of light or dark display, and whether you want to see everything in the app

  Lifetime

  until you change the choice or clear the browser’s data

  Type

  functional, only if you choose it

In the apps for iPhone and Android, your login and your choices (for example language, notifications, lock, hide content and that you have seen the guide) are kept in the phone’s secure storage (Keychain or Keystore), and the profile photo in the app’s own folder. The apps set no cookies and load no analytics, tracking or advertising services. The Android app contains Google’s notification module (Firebase Cloud Messaging), which is used only for notifications.

The web version loads fonts and images from its own address and loads no services from other providers. If you choose to log in with Google on the web, Google opens a window that Google itself is responsible for. The login cookie is necessary for the service, and the other markers are your own choices or yes/no information without personal data.

You have the right to access your information, to have it corrected or deleted, to restrict processing, to object and to receive it (data portability). You can also withdraw a consent. You can do most of this directly in the app:

• Download all your data

  How

  Profile, My data and consents, “Download my data”. You get one file in JSON format with everything the app itself has stored about you: account, diary and entries, including the older ones, symptoms, treatment, consents, messages to and from Sara, reminders, feedback and when you have used the app. The file contains health information, so keep it somewhere safe

• See and correct your entries

  How

  your diary and your progress are shown under Diary and Progress. You can correct a day up to 29 days back and change your symptoms, your treatment and your life stages under Profile

• Withdraw consent

  How

  Profile, My data and consents (section 5)

• Stop sharing with Sara

  How

  Profile, Share with Sara; no new summaries are written (section 6)

• Delete everything the app has stored about you

  How

  Profile, My data and consents, “Delete my account”. What is deleted, and what is not, is described in section 9

• Remove a key or log out on all devices

  How

  on the web: Profile, My devices. In the apps you log out on the device you are using

• Have your feedback deleted before your account

  How

  write to hej@mitkvindeliv.dk

• Get your medical record, appointments and invoices, correct information in the medical record, restrict or object

  How

  write to hej@mitkvindeliv.dk; we reply within one month at the latest

The right to erasure does not apply to information the clinic must keep under the rules on medical records, including notes you have shared and notes from the chat (section 6).

We update this policy when the app changes. If we change what we store, or what you have consented to, we ask you again in the app. The current version is at mitkvindeliv.dk/en/app/privacy-policy.

You can contact us at hej@mitkvindeliv.dk or Mit Kvindeliv ApS, Rislundvej 3, 8240 Risskov, Denmark. You can complain about our processing of your information to the Danish Data Protection Agency (Datatilsynet): datatilsynet.dk.