Privacy Policy
Charlottenlund Privathospital processes personal data relating to patients, relatives, and visitors to our website. This policy explains what personal data we process, why we process it, how long we retain it, and your rights under the General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
What personal data do we process?
For bookings and treatment: name, CPR number, address, telephone number, and email address; health data, including referrals, medical record notes, and examination results; information about health insurance and insurance providers; and payment information in the case of self-funded treatment.
When using the website: information submitted through booking and contact forms and through the digital assistant “Anna”; technical information such as IP address, browser type, and pages visited, where consent has been given for cookies. See our Cookie Policy.
What do we use the information for?
The information is processed only for the purposes stated below and on the legal basis specified.
| Purpose | Legal basis |
|---|---|
| Examination, treatment, and medical record keeping | S Danish Health Act and Danish Authorization of Healthcare Professionals Act; GDPR Art. 6(1)(c) and Art. 9(2)(h) |
| Booking, appointments, reminders, and communication regarding the course of treatment | GDPR Art. 6(1)(b) and (c) |
| Billing of patients, insurance providers, or regions | GDPR Art. 6(1)(b) and (c); Danish Bookkeeping Act |
| Statutory reporting to registers and public authorities | GDPR Art. 6(1)(c) |
| Patient satisfaction surveys | GDPR Art. 6(1)(f) (legitimate interest in improving treatment) |
| Statistics and improvement of the website | Consent, GDPR Art. 6(1)(a) |
Who receives the information?
Information is disclosed only where there is a lawful basis for doing so: to the patient’s general practitioner and referring doctor, to the insurance provider covering the treatment, to the relevant region where treatment is provided under a tender agreement or the extended free choice of hospital scheme, to public registers and authorities where required by law, and to other hospitals in connection with referrals.
We also use data processors that process information on behalf of the hospital and in accordance with our instructions: XMedicus Systems ApS (medical records system and patient portal), Medqore (booking, telephone system, and the digital assistant “Anna”), Duda Inc. (website platform), Microsoft (email and office systems), Vibrant (payment solution), and Rambøll (patient satisfaction surveys). Data processing agreements have been entered into with all data processors.
Is information transferred to countries outside the EU?
Patient records and the patient portal are operated in Denmark. The website is hosted by Duda, and analytics tools are provided by Google; these providers may process technical information in the United States. Such transfers are based on the European Commission’s adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.
Health data is not transferred to countries outside the EU/EEA.
How long do we retain the information?
Patient records are retained for 10 years from the date of the most recent entry, as required by the Danish Executive Order on Medical Records. Enquiries submitted through the contact form or the digital assistant are entered into the medical record where they relate to a course of treatment and are subject to the same retention period.
Accounting records are retained for five years from the end of the relevant financial year in accordance with the Danish Bookkeeping Act. Cookie data is retained as described in the Cookie Policy.
What rights do you have?
You may request access to the personal data processed by the hospital and ask for inaccurate information to be corrected. In certain circumstances, you may request erasure, restriction of processing, or data portability, and you may object to the processing.
Medical record information cannot be deleted, as the hospital is legally required to retain it. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.
Requests should be sent to erbe@chph.dk and will be answered within one month at the latest.
How can you make a complaint?
Complaints regarding the hospital’s processing of personal data may be submitted to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk.
Complaints concerning the healthcare treatment itself should be submitted to the Danish Agency for Patient Complaints (Styrelsen for Patientklager).
How do we protect your information?
Access to patient information is restricted to employees who are involved in the patient’s treatment or have an administrative need for access. All logins to medical record and office systems require two-factor authentication, and access to patient records is logged.
This policy is updated whenever changes are made to the processing of personal data. Latest version: 17 September 2026..