How we handle your personal and health data.

Data controller

The data controller for the processing of your personal data is:

• Walsted Lungeklinik v/ Emil Ingerslev Walsted
• Jægersborg Allé 16, 3rd floor, 2920 Charlottenlund
• Company reg. no. (CVR): 27711812
• Contact: kontakt@emilwalsted.dk · +45 21 74 65 74

If you have questions about how we process your data, you are welcome to contact the clinic using the details above.

What information we process

To investigate and treat you, we process the following categories of information:

• General personal data, such as name, civil registration number (CPR), address and contact details.
• Health data, such as your medical record, history, examination and test results, and information about your medication.

We collect this information from you, from the referral from your GP and, where relevant and permitted, from other healthcare providers who have been involved in your treatment.

Purposes of the processing

We process your information for the following purposes:

• Investigation, diagnosis and treatment of your condition.
• Keeping a medical record, as required by law.
• Settlement of payment with the region and the public health insurance scheme.

Legal basis

Our processing of your personal data is based on the GDPR and Danish health legislation:

• GDPR Article 6(1)(c) and (e): processing necessary to comply with a legal obligation and to carry out a task in the public interest.
• GDPR Article 9(2)(h): processing of health data for the purposes of medical diagnosis and the provision of health care and treatment.
• The Danish Data Protection Act (databeskyttelsesloven), sections 7(3) and 11: the national legal basis for processing health data and civil registration numbers in connection with your treatment and record-keeping.
• The Danish Health Act and the executive order on keeping medical records (journalføringsbekendtgørelsen).

Recipients of your data

In connection with your treatment, your information may be shared with the following:

• Your own GP and other healthcare providers, via secure communication (MedCom / the national health data network), when relevant to your treatment.
• The Capital Region of Denmark and the public health insurance scheme, in connection with settlement of payment.
• Laboratories and imaging providers, where such examinations are required.
• Sundhed.dk, where your test results and the clinic's practice declaration are published, to the extent required by law.
• The National Referral Service (Den Nationale Henvisningsformidling), which passes your referral on to the clinic, under a data processing agreement.
• A data processor for the clinic's record system (EG Clinea / EG A/S), under a data processing agreement.

We do not sell your information, and we do not share it for marketing purposes.

Storage

We store your information for as long as required by law. Medical records must, as a rule, be kept for at least 10 years after the most recent entry. Information processed solely for settlement of payment is kept for as long as the rules on accounting and settlement require.

Your rights

Under the GDPR you have a number of rights in relation to our processing of your data:

• The right of access, so you can see what information we process about you.
• The right to rectification, so incorrect information can be corrected.
• The right to erasure (limited by our legal duty to keep medical records).
• The right to restriction of processing.
• The right to object to the processing.

Because we are subject to a legal duty to keep medical records, some of these rights may be limited. To exercise your rights, contact the clinic using the details under “Data controller”. We will respond as quickly as possible and within the time limits set by law.

If you write by email, please remember that ordinary email is not a secure channel: do not include your civil registration number or health information. You are also welcome to call during phone hours.

Complaints

If you are dissatisfied with how we process your personal data, you can lodge a complaint with the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk.

This website

The website is built to process as little as possible about you, and any processing takes place in accordance with the EU General Data Protection Regulation (GDPR). The website collects no personal data about its visitors. This website only presents information. Patient records and health data are never processed here; booking and messages go through the separate patient portal, and referrals through your own GP.

No cookies

The website sets no cookies for visitors and stores nothing in your browser, no local storage either. That is why you see no cookie banner: there is nothing to consent to. Your choice of language is not saved anywhere; it simply follows the address you visit (Danish on /, English on /en/). The clinic's closed staff area uses strictly necessary login cookies (session, “remember me” and pre-launch preview), but that concerns staff only, never visitors.

Anonymous, aggregated visitor statistics

To understand which pages are used, the website keeps a fully anonymous, aggregated visitor statistic that we host ourselves. For each page view, only the following is recorded: the date and hour, the page address (path), the domain you may have arrived from (e.g. google.com, never the full address), and a coarse device type (mobile, tablet or computer). No IP addresses, cookies, device identifiers or other information that could identify you are ever stored. The statistics therefore contain no personal data within the meaning of the GDPR. The figures are stored on the clinic's own web host for a maximum of 24 months and are not shared with anyone. The statistics also respect your browser's “Do Not Track” / “Global Privacy Control” setting.

No third parties

The website loads nothing from third parties: fonts and all other resources are served from our own web host, and there are no embedded maps, videos, tracking scripts or CDNs. Your IP address is therefore not shared with Google or anyone else simply because you visit the site, and we share no data from the website with third parties. Some links lead to external services (e.g. directions via Google or Apple Maps, or sundhed.dk). They only open when you click them, the site sends no referrer information along, and from there the privacy terms of those services apply.

Hosting in the EU

The website and its statistics are hosted by our web host one.com in data centres in Denmark/the EU. No data from the website is transferred to countries outside the EU/EEA.

In addition to the anonymous visitor statistics above, our web host one.com keeps its own ordinary operational logs for operation and security. These logs typically contain IP addresses and are separate from the clinic's own anonymous statistics.

The patient portal you use to book appointments and write to the clinic (EG Clinea) is a separate service with its own privacy policy. When you use the portal, the terms and privacy policy of that service apply.