Privacy policy.
Last updated: 16 October 2026
We take the protection of your information seriously. Here you can read how we process personal data in connection with our website and healthcare services.
This is an English translation of the Danish original (“Privatlivspolitik”). If there are any differences, the Danish version prevails.
1. Who is the data controller?
Mit Kvindeliv ApS, CVR 46844505, Rislundvej 3, 8240 Risskov, Denmark, is the data controller for the clinic’s processing of personal data. Contact: hej@mitkvindeliv.dk. Website: mitkvindeliv.dk.
2. What information do we process?
We may process name, contact details, date of birth, civil registration (CPR) number where necessary and lawful, booking details, payment and invoicing details, enquiries and relevant technical information about use of the website. In healthcare contact we also process health information, for example symptoms, medical history, contraception, menstruation, fertility, pregnancy, birth, the postpartum period, menopause, medication, test results and treatment plans. We limit the information to what is necessary for the purpose.
3. Why, and on what legal basis?
We use information to answer enquiries, handle bookings, identify patients, prepare and carry out consultations, keep patient records, follow up on treatment, invoice and fulfil legal obligations. Ordinary information is processed under Article 6(1) of the GDPR, including point (b) (contract), (c) (legal obligation) and, where relevant, (f) (legitimate interests). Health information is processed in particular under Article 9(2)(h) and relevant Danish health legislation, subject to healthcare professionals’ duty of confidentiality. CPR numbers are processed only with a lawful basis under data protection legislation. Informed consent to medical treatment is not the same as consent under the GDPR.
4. Booking, questionnaires and medical records
We use Terapeut Booking for booking and patient records. Before a consultation you may receive a relevant healthcare questionnaire. Information from it may become part of your patient record. As a medical clinic we keep records in accordance with the law. Medical patient records are, as a rule, kept for at least 10 years after the most recent record entry.
5. Video consultation and secure communication
Online consultations are held via Whereby. As a rule, we do not record the consultations. Healthcare messages are sent through the secure patient access (My page); ordinary email to hej@mitkvindeliv.dk is used for administrative enquiries. Do not send CPR numbers, test results or detailed health information by ordinary email.
6. Recipients and suppliers
We use, among others, Terapeut Booking for booking and records and Whereby for video consultation. The website is hosted by Cloudflare, and the clinic’s email is provided by Google Workspace. Relevant information may, in accordance with the rules of the law, be passed on to other healthcare professionals, laboratories, authorities or necessary suppliers. Suppliers that process information on our behalf must be covered by relevant data processing agreements. We do not sell health information and do not use it for targeted advertising.
7. International transfers
If a supplier processes personal data outside the EU/EEA, there must be a valid transfer basis and relevant safeguards. These are the suppliers where information about you may be processed, and where this happens:
Terapeut Booking (EasyPractice ApS)
- Used for
- Booking, patient records, questionnaires, My page and emails from the booking system.
- Location
- Denmark. According to the data processing agreement, data is hosted at Wannafind (Denmark), and backups are processed at Amazon Web Services in EU regions.
- Note
- The supplier uses, among others, these sub-processors in the USA: Mailgun (email delivery; email addresses and message content), Google (maps; calendar only if activated), New Relic (performance monitoring) and Cloudflare (security; IP addresses and security logs). Transfers to countries outside the EU/EEA require, according to the data processing agreement, our written consent and appropriate safeguards, for example the European Commission’s standard contractual clauses. The full list is in Annex B to the data processing agreement.
Whereby (Whereby AS)
- Used for
- Video consultation.
- Location
- Norway. According to the supplier, data is stored in the EU.
- Note
- We do not, as a rule, record the consultations.
Dinero (Visma Dinero ApS)
- Used for
- Invoicing and bookkeeping.
- Location
- Denmark. According to the supplier, the programme is hosted in the EU (Germany, the Netherlands and Finland).
- Note
- Emails sent from Dinero, for example invoices, are, according to the supplier, delivered via Mailchimp (USA) on the basis of the European Commission’s standard contractual clauses.
Cloudflare (Cloudflare, Inc.)
- Used for
- Hosting of the website, DNS, security and cookie-free statistics.
- Location
- USA, with a global network of servers. Your IP address may be processed outside the EU/EEA.
- Note
- According to Cloudflare, transfers from the EU take place on the basis of the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
Google Workspace (Google)
- Used for
- The clinic’s email (hej@mitkvindeliv.dk).
- Location
- The Google group in the EU and the USA.
- Note
- Google’s data processing amendment is based on the European Commission’s standard contractual clauses, and Google LLC is certified under the EU–US Data Privacy Framework.
8. Storage and deletion
Information is kept only for as long as there is an objective and lawful need. Medical patient records are, as a rule, kept for at least 10 years after the most recent record entry. Accounting records are, as a rule, kept for 5 years after the end of the relevant financial year. Other enquiries are deleted after a concrete assessment when they are no longer necessary.
10. Data security
We use appropriate technical and organisational security measures, including access restriction and secure handling of information. Only persons with a relevant work-related need may access health information. The website is delivered exclusively over an encrypted connection (HTTPS). According to the data processing agreement, Terapeut Booking encrypts data in transit (TLS) and at rest (AES-256), takes daily encrypted backups in EU data centres and uses role-based access and two-factor login.
11. Your rights
Depending on the circumstances, you have the right of access, rectification, erasure, restriction of processing, objection and data portability. Special rules apply to patient records and statutory retention. Write to hej@mitkvindeliv.dk if you wish to exercise your rights. You can complain about the processing of personal data to the Danish Data Protection Agency (Datatilsynet): datatilsynet.dk.
12. Updates
We update this policy when there are relevant changes in our activities, systems or legislation. The current version is published at mitkvindeliv.dk/en/privacy-policy.
Mit Kvindeliv ApS · CVR 46844505 · hej@mitkvindeliv.dk