Privacy policy for OSAIA App

2. Types of personal data, purposes, legal bases and deletion

OSAIA collects information directly from you in the following ways:

• Through your use of the app
• Through your use of the website
• When you contact us or communicate with us through the platform (for example online chat)
• When you contact us or communicate with us by email

Your interaction, purchases of services and, in some cases, consents you have given will determine which parts of section 2 of this privacy policy are relevant to you.

2.1 Professional healthcare treatment

We process the following personal data about you when you receive online professional healthcare treatment through the platform as a result of your purchase of one or more of our services:

Ordinary personal data

• Name
• Email address
• Age
• Sex
• Date of birth
• Telephone number
• Correspondence
• CPR number (Danish civil registration number; confidential personal data)

Special category personal data

• Health data that it is necessary to process in order to provide professional healthcare treatment (for example medication, symptoms and illnesses).

OSAIA makes an initial assessment of which professional healthcare treatment you need. We do this in order to assess how your further programme should be arranged, and in order to give you the correct online professional healthcare treatment, coaching, teaching and advice.

We process your personal data in order to perform the contract entered into with you, for the purpose of combating disease and managing health services, cf. Article 6(1)(b) of the General Data Protection Regulation (GDPR) (ordinary personal data), section 7(3) of the Danish Data Protection Act, cf. Article 9(2)(h) of the GDPR (special category personal data), and section 11(2), no. 4, of the Danish Data Protection Act, cf. section 7(3) of that Act (CPR numbers).

Information covered by the record-keeping requirements is kept for 10 years from the last entry in the patient record, in accordance with the applicable legislation. Patient records that are the subject of a complaint, a supervisory case or a compensation claim are deleted after the case has been finally closed, if the case extends beyond the 10-year period.

2.2 Logbook in the app

We process the following personal data about you when you keep a logbook of your health in the app:

• Calcium calculation
• DXA scan
• Medication
• Symptoms

In some cases the information constitutes health data (special category personal data). We process the information above so that you can follow your health over time through the logbook. We carry out the processing on the basis of your explicit consent, cf. Articles 9(2)(a) and 6(1)(a) of the GDPR. Information collected through the logbook may also be processed for other purposes and on other legal bases.

2.3 Quality assurance, statistics and analysis

We process the following personal data about you from your patient record or logbook in order to carry out quality assurance, prepare statistics and analyses, and improve the platform:

Ordinary personal data

• Name
• Age
• Sex
• Date of birth
• Exercise
• Diet
• Quality of life
• Motivation
• CPR number (confidential personal data)

Special category personal data

• Health data (for example medication, symptoms, and combinations of ordinary personal data that can lead to inferences about your health).

Personal data contained in your patient record is processed in order to prepare statistics, carry out quality assurance, and develop and analyse the programme, cf. section 10(1) of the Danish Data Protection Act (special category personal data) and Article 6(1)(f) of the GDPR (the balancing of interests rule) (ordinary personal data). Our legitimate interest in carrying out quality assurance, preparing statistics and analyses, and improving the platform takes precedence over any opposing interests you may have. Your CPR number is processed for scientific or statistical purposes under section 11(2), no. 3, of the Danish Data Protection Act (CPR numbers).

Personal data contained in your logbook is processed with your consent in order to make the logbook available to you (see above). OSAIA may, however, also process your information in the logbook in order to prepare statistics, carry out quality assurance, and develop and analyse the programme, cf. section 10(1) of the Danish Data Protection Act (special category personal data) and Article 6(1)(f) of the GDPR (the balancing of interests rule) (ordinary personal data). Our legitimate interests in preparing statistics, carrying out quality assurance, and developing and analysing the programme take precedence over any opposing interest you may have. Your CPR number is processed for scientific or statistical purposes under section 11(2), no. 3, of the Danish Data Protection Act (CPR numbers).

Personal data is processed solely for these purposes for as long as it is necessary, and OSAIA makes sure to anonymise the information as soon as possible after it is extracted from your patient record. For this purpose, OSAIA processes only patient-record information that is less than 5 years old, in accordance with the Danish Health Act. OSAIA processes your logbook information only for as long as you have an active subscription.

2.4 Legal obligations and legal claims

We process the following personal data about you if it is necessary in order to comply with our legal obligations under Danish health legislation (including reporting obligations and similar), and in order to establish, exercise and defend legal claims.

Ordinary personal data

• Name
• Email address
• Age
• Sex
• Date of birth
• Telephone number
• Correspondence
• CPR number (confidential personal data)

Special category personal data

• Health data

Your personal data is processed for the purpose of complying with our legal obligations, cf. Article 6(1)(c) of the GDPR (ordinary personal data) and Article 9(2)(g) of the GDPR, cf. Danish health legislation (special category personal data).

Your personal data is also processed on the basis of our legitimate interest in being able to establish, exercise and defend legal claims, cf. Article 6(1)(f) of the GDPR (ordinary personal data), Article 9(2)(f) of the GDPR (special category personal data), and section 11(2), no. 4, of the Danish Data Protection Act, cf. Article 9(2)(f) of the GDPR (CPR numbers).

Patient records that are the subject of a complaint, a supervisory case or a compensation claim are deleted after the case has been finally closed, if the case extends beyond the 10-year period.

2.5 Purchase of services

We process the following personal data about you when you buy healthcare services from us through our platform or by telephone:

• Name
• Address
• Email
• Telephone number
• Information about your purchase and payment

We process your personal data in order to invoice you and in order to comply with our legal obligations under the Danish Bookkeeping Act, cf. Article 6(1)(b) and Article 6(1)(c) of the GDPR respectively.

The personal data above may also be processed on the basis of our legitimate interest in sending you service messages, and in order to comply with our terms of sale, cf. Article 6(1)(f) and Article 6(1)(b) of the GDPR.

The personal data in question will be processed in connection with completing the individual order, after which it will be stored in our accounting records for 5 years from the end of the financial year, in order to comply with the documentation requirements of the Danish Bookkeeping Act.

2.6 Contacting us or booking a free call

We process the following personal data about you if you contact us through the platform or by email, including in order to book a free call:

• Name
• Email
• Telephone number

The personal data above is processed on the basis of our legitimate interest in being able to answer your enquiries, advise you, and market our services better, cf. Article 6(1)(f) of the GDPR, and in some cases in order to enter into an agreement, cf. Article 6(1)(b) of the GDPR.

If a contract is entered into, your personal data is processed for as long as you have ongoing services with us. Information that must be entered in the patient record is kept as described above, in accordance with Danish health legislation. If your contact does not lead to a customer relationship, we delete the information 1 year after the contact.

2.7 Use of images, videos and/or statements in marketing

We process the following personal data about you if you consent to publication of your image, video and/or statements for use in marketing:

• Your name
• Your age
• Statements (for example for use on our blog)
• Your image, video and/or statement, which may show information about your health

Publication of your image, video and/or statements through the platform or on social media takes place on the basis of your prior consent, cf. Article 9(2)(a) of the GDPR (special category personal data) and Article 6(1)(a) of the GDPR (ordinary personal data). You may withdraw your consent at any time, and we will then remove your image, your video and/or statement from the platform and/or social media.

We process your personal data until the consent is withdrawn, or until we ourselves choose to withdraw the publication of your image, video and/or statement. The declaration of consent itself is, however, kept for up to 5 years from the time the consent is withdrawn.

2.8 Marketing

We process the following personal data about you if you consent to receiving marketing material from us:

• Name
• Email

We process your personal data for marketing on the basis of our legitimate interest in marketing our service and similar products, cf. Article 6(1)(f) of the GDPR. However, we only send marketing material by email and push notification in the app on the basis of your active prior consent, in accordance with section 10(1) of the Danish Marketing Practices Act.

Your personal data and the associated consent are deleted when the consent is withdrawn. The declaration of consent itself is, however, kept for up to 5 years after withdrawal.

2.9 Creating a user profile in the app

We process the following personal data about you if you choose to create a user profile in the app:

• Name
• Email
• Password

When a user profile is created, we process the personal data above in order to create and administer your user profile, at your prior request, cf. Article 6(1)(b) of the GDPR.

We keep your personal data until you yourself choose to delete your user profile.

2.10 Notifications in the app

We process the following personal data about you if you choose to accept notifications (service messages) in the app, or if other service messages are required under the legislation or the contract:

• IP address
• Email address
• An indication of whether notifications are wanted

We process your personal data in order to send notifications through the app, on the basis of our legitimate interest in meeting your request to receive these notifications, cf. Article 6(1)(f) of the GDPR, and in certain cases in order to comply with our legal obligations, cf. Article 6(1)(c) of the GDPR, cf. Danish health legislation and the Danish Consumer Contracts Act. You can unsubscribe from future notifications in the app at any time, and thereby also object to this processing.

The information is processed for this purpose for as long as we have an ongoing relationship, for as long as we are legally obliged to send service messages, and, in some cases, for as long as you have agreed to receive service messages through the app.

Engaging data processors and disclosure to other controllers

In order to fulfil the purposes above, OSAIA may give third parties access to your personal data where those third parties provide relevant services under a contract with OSAIA. Such service providers will only process personal data in accordance with our instructions, under data processing agreements that have been entered into. At present, OSAIA uses the following data processors or categories of data processors:

• Suppliers of a portal for patient records.
• Suppliers of email systems and IT solutions
• Suppliers of marketing services

In some cases it will also be necessary to disclose your personal data to independent controllers. This concerns the following categories of recipients, on the following legal bases:

• Law firms, courts and public authorities, on the basis of our legitimate interest in being able to establish, exercise and defend legal claims (Article 6(1)(f) of the GDPR (ordinary personal data), Article 9(2)(f) of the GDPR (health data) and section 11(2), nos. 2 and 4, of the Danish Data Protection Act, cf. Article 9(2)(f) of the GDPR (CPR numbers)).

If your personal data is transferred to data processors or controllers established in countries outside the EU/EEA that do not have an adequate level of protection, such a transfer will be based on the adequacy decision concerning the EU-US Data Privacy Framework. This will only be the case in particular support situations, and your personal data will not be stored directly in unsafe third countries.

4. Your rights

You have a number of rights in connection with our processing of your personal data.

Among other things, you have the right:

• To have incorrect data corrected
  We update your personal data on an ongoing basis. You always have the right to have the personal data we hold corrected
• To access your personal data and receive a copy
  You can at any time be informed of the purpose of storing your personal data, how long we store it, who we disclose personal data to, and where we obtained the personal data from. This does not apply if you already have this information.
• To have your personal data deleted
  You can at any time demand that the data we hold be deleted. If we no longer have a purpose for holding the personal data, we delete it as soon as possible after your request.
• To have processing restricted
  You can at any time ask us to restrict the processing of your personal data
• To object to processing
  This includes the right to object to our use of the personal data for marketing.
• To withdraw consent
  You may withdraw your consent at any time. You may withdraw your consent at any time in the app by contacting us at kontakt@osaia.dk. Withdrawal of your consent does not affect the lawfulness of processing based on your consent before the withdrawal.
• To be informed about transfers to other countries and organisations outside the EU
  Please note that we pass personal data on to IT companies in the United States that act as our data processors. All our data processors have undertaken to comply with applicable data protection legislation.
• To complain about our processing of your personal data
  If you experience incorrect or unlawful data processing at OSAIA, you can contact us by email: kontakt@osaia.dk

You can also lodge a complaint with the Danish Data Protection Agency (Datatilsynet). You can send your complaint by letter or through their website: https://www.datatilsynet.dk/

If you want to know more, or to exercise your rights, please contact us using the contact details at the top.

5. Storage of personal data

We are obliged to protect your personal data. We use relevant and appropriate technical and organisational security measures to make sure that there is no unauthorised access to the personal data we store. The purpose of this is to make sure that the personal data is not destroyed, altered, published or otherwise misused.