Information about our processing of personal data and your rights
We value your privacy and take the protection of your personal information seriously. It is therefore important to us that you understand how we collect and process personal information about you.
This Privacy Notice applies to the processing of the personal information we collect when providing healthcare services to you. The Privacy Notice explains what personal information we collect about you, why and how we collect and process it, and how we share it with others. The Privacy Notice also explains the rights you have in relation to your personal information and how you can exercise those rights.
Responsible for personal data
Capio A/S, who provides healthcare services to you, is legally responsible for ensuring that your personal data is processed in accordance with our Key Privacy Principles, this Privacy Notice and applicable law.
Responsible: Capio A/S, Hans Bekkevolds Allé 2B, 2900 Hellerup, Denmark
Data Protection Officer (DPO): Mads Flensted Hauge: dataprotectionofficer@capio.dk
How we collect personal information about you
Capio has different ways of collecting the personal information covered by this Privacy Notice. Most often, we obtain the information when we provide healthcare services to you, or it is information you have given us during the course of your treatment with us. From time to time, we may also receive information from other parties on your behalf. Generally, we will only do this to provide you with the best possible healthcare and only when you have explicitly authorized us to do so.
Purpose of personal data processing
Every time you seek treatment with us, we register personal data about you in our medical record register. We do this to ensure that you as a patient receive the best and safest treatment possible. We also use your personal data to process invoices and collect payment for our healthcare services.
We process your personal data:
- to keep patient records and other documentation necessary for the care and treatment of patients
- for administration that relates to you in connection with providing you with treatment and care
- to offer you online consultations and contact via services such as Doctor Connect and Platform24
- to establish other documentation required by law, regulation or other constitution
- communicate with you about the healthcare services we provide to you
- to continuously develop and ensure the quality of treatment and care
- for planning, monitoring, evaluating and supervising the business
- to compile statistics on treatment and care
- perform credit checks to assess your application for a healthcare contract
The basis for personal data processing
The processing of your personal data to fulfill the above purposes is legally stipulated in the Danish Personal Data Act, the Danish Health Act and the Danish Journal Entry Order.
Some personal data processing requires your consent. For example, we need your consent to send you emails, text messages or contact you via e-Boks (we use these channels to send you invitations and reminders for hospital consultations). When you are invited for your first visit to the hospital, we will ask you to fill out a consent form for the personal data processing covered.
If you have given consent to a personal data processing - e.g. that we may send you emails - you always have the right to withdraw your consent, after which the personal data processing must cease.
Categories of personal data
Capio collects various information about you. This information varies depending on the healthcare services we provide to you and may include
- Social security number, insurance policy number
- Your name
- Address, phone numbers and other personal contact information
- Gender, date of birth, marital status
- Health information and information about sex life and sexual orientation
- Bank details
In some cases, we process personal data about relatives that you or your relatives have provided, such as name and contact details.
We only collect personal data about you that is deemed necessary to fulfill the purpose of the personal data processing.
Privacy and security provisions applicable to data and data processing
We may only disclose information about you if neither you nor a relative of yours is harmed by the disclosure. The starting point is that disclosure of your data must be made with your consent. In certain situations, however, we are required by law to disclose information to authorities.
Health records are subject to confidentiality and professional secrecy. Unauthorized persons are prevented from accessing your personal information through security measures such as limiting access permissions to patient data.
From time to time we will share your data with third parties, but we ensure your privacy in the process. Usually this happens when third parties help us provide healthcare services to you, but we may also share data if we have your permission to do so or if we are legally required to do so.
Record keeping and access to medical record data
As a patient at Capio, you will have a patient record of your treatment with us. It is a legal requirement to keep a record of your treatment, cf. the Danish Executive Order on Record Keeping. This record can only be accessed by Capio staff, unless you consent to your own doctor or other hospitals having access to the record, if relevant. Records are only disclosed to other healthcare professionals with your informed consent.
You can give your consent to this in the consent form you must fill out when you visit the hospital for the first time. Here you can also give your consent for the doctor at Capio to access your previous medical records, which can be useful to get an overview of your medical history in relation to the ongoing treatment.
Storage and data minimization
We will not keep your information longer than we need it, unless required by law.
It is required by law that patient records must be kept for at least 10 years from the last entry in the record (Journalføringsbekendtgørelsen).
It is stipulated by law that accounting material must be kept for 5 years from the end of the financial year to which the material relates (Bookkeeping Act).
How we protect your personal information
Capio works hard to protect and secure your personal information. We have policies and processes in place internally that are designed to protect your privacy. Our specialists are dedicated to their work and your privacy drives our privacy program.
We have implemented appropriate technical and organizational security measures to protect your personal information from unauthorized access, collection, use, disclosure, modification or disposal. We continuously review our privacy practices throughout the Capio Group and conduct training for individuals involved in privacy-related activities.
When we use service providers or other data processors to process personal data on our behalf, we require them to follow our instructions and apply appropriate security measures to protect the personal data they process on our behalf.
National quality registers
To follow up and improve treatment, we report to national quality registers. In relation to reporting to national quality registers, the Executive Order on reporting to approved clinical quality databases and disclosure of data to the Danish Health Data Authority and the Executive Order on approval of nationwide and regional clinical quality databases apply.
Disclosure of personal data
In case of non-payment of the amount due for examination or treatment at Capio, Capio may, based on legitimate interests (see the Danish Data Protection Agency), disclose information about the outstanding amount, name and contact information to a debt collection company for the purpose of collecting the outstanding payment.
Your rights
You have certain rights in relation to the personal data we hold about you. You always have the right to know exactly what data we hold on your behalf and to ask us to correct or delete data that is inaccurate if permitted by national laws and regulations. We have processes in place to enable you to exercise your rights and ensure that we can fulfill your requests regarding the personal information we hold about you.
Access to read your medical records
As a patient, you have the right to read your own medical records and get a copy of your medical records. Your medical record from Capio is not posted on sundhed.dk, but you can request a copy of your medical record by contacting us. Before we can fulfill your request, we may ask you to identify yourself and provide us with additional information about your request. We will respond to your request within an appropriate timeframe and in any event within the timeframe required by applicable law.
Your request must include the following:
- Your name
- Personal number
- Phone number
- How you want to receive the copies (as a pdf sent via our online patient communication portal or by picking up the copy at the hospital)
- Which department you visited
- What year and preferably the specific date of your visit
Correction of inaccurate personal data
We will do our best to ensure that the personal information we hold about you is correct, complete and accurate. However, it is your responsibility to ensure that you provide us with correct, accurate and complete information and that you keep your contact details up to date.
You have the right to request correction of erroneous information, including information in your medical record, by contacting the healthcare facility in question. If no agreement can be reached on the wording in your medical record, you have the right to have your wording/opinion recorded in the medical record.
It is important that our contact information for you is correct. If you change your address, phone number or email address during your treatment, please let us know.
Complaints
If you believe that your rights have been violated when we process data relating to you, please contact us and we will respond to you in a timely manner.
If you have a complaint about how your personal data is processed and/or protected or about your rights, please send your written comments to us either by email to info@capio.dk or by letter to your processing site. We respond to all complaints in writing and register complaints in our system.
You can also contact the Danish Data Protection Agency if you believe that your personal data has been handled incorrectly by us.
Version: 5 - Revised: January 2022
