Privacy policy - NurseCare ApS

Last updated: 2 October 2026. This is an English translation of our Danish privacy policy (privatlivspolitik). If the two versions differ, the Danish version applies.

1. Data controller

NurseCare ApS is the data controller for the processing of personal data in connection with our health services and our website. The scope of the processing depends on the service. For health checks, personally identifiable health data is not systematically stored, as health data is anonymised from the start. For skin checks, NurseCare is fully the data controller for the personal and health data collected. For vaccination, the vaccination is registered in the Danish Vaccination Register (DDV) - either digitally via our medical record system or via a paper slip that is shredded immediately after registration. At NurseCare's clinic in Copenhagen and when we collect samples for partners, we keep statutory patient records of the services provided.

NurseCare ApS
CVR no.: 10079152
Valdemars Allé 82, 2860 Søborg, Denmark
Clinic: Rømersgade 3, 1362 Copenhagen K
Phone: +45 70 20 22 32
Email: support@nursecare.dk
Website: www.nursecare.dk

2. What data do we collect, and why?

NurseCare provides preventive health services at workplaces throughout Denmark, including health checks, skin checks and vaccination, as well as health services at our clinic in Copenhagen (health checks, blood tests, vaccination and mole checks). NurseCare also collects samples for partners at events outside the clinic. Our approach to data collection depends on the service, and we always aim to collect as little personal data as possible (data minimisation).

2.1 Health checks

Booking (non-sensitive personal data):

• Name, email address and phone number for booking and reminders
• Chosen topic for the health conversation
• Workplace and location

During the health check:

NurseCare uses an anonymised approach to health data. The physiological measurements and biomarkers (blood pressure, cholesterol, blood sugar, BMI etc.) are recorded without being linked to the individual employee's identity. You receive your results in a personal health profile on the day, but NurseCare does not store this data together with your personal data.

The anonymised data is used solely to prepare overall statistics for the corporate customer when there are 20 or more participants in a health check.

Legal basis: Consent (GDPR Article 6(1)(a)) for booking. Legitimate interest (Article 6(1)(f)) for anonymised statistics. Health data processed during the health check itself is processed as part of preventive health services under Article 9(2)(h) (processing necessary for the purposes of preventive medicine, assessment of the working capacity of the employee or medical diagnosis), carried out by health professionals subject to a statutory duty of confidentiality.

2.2 Skin checks

When you take part in a skin check, we collect the following:

Non-sensitive personal data:

• Name, email address, phone number, gender, date of birth

Sensitive personal data (health data):

• Medical history related to the skin
• Medical history and risk factors relevant to skin conditions
• Images of skin and moles (overview images and dermoscopic images)
• Teledermatological assessments, results and diagnoses from a dermatologist

The images are taken by the nurse and assessed digitally by a specialist in dermatology via the Dermloop platform, operated by Melatech ApS. NurseCare is the data controller and Melatech is the data processor. A data processing agreement has been concluded in accordance with GDPR Article 28.

Legal basis: Explicit consent (GDPR Article 9(2)(a)) to the processing of health data.

2.3 Vaccination

When you are vaccinated at your workplace, your CPR number (Danish personal ID number) is collected for the sole purpose of registering the vaccine on sundhed.dk (the Danish Vaccination Register, DDV). The process is as follows:

• The employee writes their name and CPR number on a paper slip, which is handed to the nurse
• The slip stays solely in the nurse's custody until the vaccine has been registered on sundhed.dk
• The slip is then shredded
• For vaccination at the workplace, NurseCare does not use its own digital systems to store CPR numbers

NurseCare therefore does not store sensitive personal data digitally in connection with vaccination at the workplace. For vaccination at the clinic and when collecting samples for partners, however, statutory patient records including the CPR number are kept - see sections 2.5 and 2.6.

Legal basis: Legal obligation (GDPR Article 6(1)(c)) and processing necessary for the purposes of preventive medicine (Article 9(2)(h)), in accordance with Danish health legislation on vaccination registration.

2.4 Website and booking

When you visit www.nursecare.dk or use our booking platform, we collect:

• Technical data such as IP address, browser type and operating system via log files
• Usage data via Google Analytics (anonymised)
• Booking data via Microsoft Bookings: name, email, phone number, chosen service and time
• Booking data via Gecko Booking (the clinic in Copenhagen): name, email, phone number, chosen service and time
• Satisfaction surveys via Microsoft Forms after a completed service

Legal basis: Consent (cookies) and legitimate interest (operation of the website).
Newsletter: If you sign up for our newsletter, we process your name and email address to send you news and offers. The legal basis is your consent, which you can withdraw at any time via the unsubscribe link in every email.

2.5 The clinic in Copenhagen

When you book and receive services at NurseCare's clinic (Rømersgade 3, 1362 Copenhagen K), we process the following data:

Booking: Name, email address, phone number, chosen service and time are registered in our booking system Gecko Booking (GECKO ApS, data processor). We send confirmations and reminders by email and SMS.

Medical records: Our nurses are authorised health professionals and are required to keep patient records of treatments at the clinic (the Danish Authorisation Act and the executive order on medical records). The records are kept in the certified medical record system Vena (Vena ApS, data processor) and may include name, CPR number, contact details, health information, measurements, test results, vaccination information and relevant medication information via the Shared Medication Record (FMK).

Blood tests: Samples are sent to an accredited laboratory in Denmark for analysis. Requisitions and results are exchanged via the national health data networks, and the result is recorded in your medical record. You can see your results yourself on sundhed.dk, and if follow-up is needed, we will call you.

Personal results letter: After a blood test or a health check at the clinic, you receive a personal results letter that explains your numbers and the next steps. The letter is prepared from your test results, your measurements and your answers from the health conversation. The letter is prepared according to a fixed, clinically approved template, and our health professionals review it before it is sent. You receive the letter by email as a PDF locked with a code you agree with us when you attend. The code is recorded only in your medical record and is never sent by email or SMS, and the email itself contains no health information. A copy of the letter is kept in your medical record in Vena.

Vaccination at the clinic: The vaccination is registered in the Danish Vaccination Register (DDV) via the medical record system, as required by law.

Payment: Purchase data is processed in the clinic's point-of-sale system and stored in accordance with the Danish Bookkeeping Act. Payment card data is processed by the card acquirer and is not stored by NurseCare.

Legal basis: Performance of the agreement with you (GDPR Article 6(1)(b)), legal obligations such as medical record keeping and bookkeeping (Article 6(1)(c)) and processing of health data as part of healthcare (Article 9(2)(h)), carried out by health professionals subject to a statutory duty of confidentiality.

2.6 Sample collection for partners outside the clinic

In some cases, NurseCare collects blood samples on behalf of another clinic or company, for example at events outside our own clinic. The partner supplies the sample kit, requisition and labels, and NurseCare carries out the sample collection.

Medical records: Our nurses are authorised health professionals and are required to record the treatment they carry out (the Danish Authorisation Act and the executive order on medical records). We therefore register name, CPR number and a short note that a blood sample has been taken - when and by whom. The note is kept in the medical record system Vena (Vena ApS, data processor). You provide your CPR number on site, and we do not collect it in advance.

Planning: Before the event, we may receive a list of participants with names and appointment times from the partner, so we can plan staffing and times.

Test results: NurseCare does not receive test results for this type of assignment and does not use the data for any other purpose. The partner is an independent data controller for the requisition, sample material, analysis and results, and questions about your result should be directed to them. NurseCare is the data controller for the medical record note.

Legal basis: Legal obligation (GDPR Article 6(1)(c)) and processing of health data as part of healthcare (Article 9(2)(h)), carried out by health professionals subject to a statutory duty of confidentiality.

3. Cookies and tracking

NurseCare uses the following cookies and tracking technologies on www.nursecare.dk:

Necessary cookies: Technical cookies required for the website and the booking system to work correctly.

Analytics cookies: Google Analytics is used to understand how visitors use our website. Data is anonymised, and IP addresses are truncated before being sent to Google.

Marketing cookies: Google Ads and Bing Ads are used to measure the effect of our advertising and to show relevant ads. These cookies are only set with your consent.

You can change your cookie preferences at any time via the cookie banner on the website.

4. Storage and deletion

We keep your personal data for as short a time as possible:

When the retention period expires, the data is deleted automatically or by active deletion.

5. Where is your data stored?

As a rule, we store your personal data within the EU/EEA:

• Skin check data (Dermloop): Hosted by ScanNet A/S in Denmark (EU). Until the migration is completed in Q4 2026, backups may still be held by OVHcloud in France (EU)
• Booking data and satisfaction surveys: Stored in Microsoft 365 (EU data centre)
• Paper documents (vaccination): Not stored - shredded after use
• Booking and point-of-sale data (Gecko Booking): Hosted in Denmark by team.blue Denmark A/S
• Medical record data (Vena): Hosted in Denmark with encrypted backup within the EU (Scaleway, France)

6. Disclosure to third parties

NurseCare only discloses personal data to third parties when necessary to provide our services, and always with the proper legal basis:

The health insurance society "danmark" (for vaccination): When you book a vaccination online, you do not enter your CPR number in the booking. We collect your CPR number at the clinic/at the vaccination and use it - whether or not you are a member of "danmark" - for statutory medical record keeping and for registration in the Danish Vaccination Register (DDV); this is required by law (GDPR Article 6(1)(c) and Article 9(2)(h), and section 11(2)(1) of the Danish Data Protection Act). If you are also a member of "danmark", you can give voluntary consent for us to report your vaccination automatically, so you receive your subsidy without sending the bill yourself. With your consent, we disclose your CPR number, date of treatment, which vaccination you received ("danmark"'s treatment code), the amount paid and practitioner and clinic details to "danmark", which is an independent data controller for its further processing of the data. The legal basis for the report is your explicit consent (GDPR Article 6(1)(a) and Article 9(2)(a), section 11(2)(2) of the Danish Data Protection Act, and section 43(1), cf. section 44, of the Danish Health Act). The consent applies only to the booked vaccination, is noted in your medical record and lapses no later than one year after it was given. You can withdraw your consent at any time by writing to support@nursecare.dk; this does not affect a report we have already sent, and you can always send the bill to "danmark" yourself. When we report to "danmark", our point-of-sale system stores your CPR number on the sale as documentation of the report, so it can be credited or cancelled. We delete it from your customer profile immediately after the report. Your CPR number is not used for booking. The statutory registration is kept in your patient record and in the DDV.

Data processors (acting on behalf of NurseCare):

• Melatech ApS (the Dermloop platform): Processes data in connection with skin checks. Data processing agreement concluded.
• ScanNet A/S (sub-processor under Melatech): Hosting of Dermloop in Denmark
• OVHcloud (sub-processor under Melatech): Hosting and backup of Dermloop in France (EU) - being phased out in Q4 2026
• InMobile ApS (sub-processor under Melatech): Sending SMS notifications in connection with skin checks
• Microsoft (Microsoft 365): Booking, email reminders, satisfaction surveys and the email with your locked results letter (the working copy is deleted after no more than 30 days). Data is stored in an EU data centre.
• GECKO ApS (Gecko Booking): Booking, point-of-sale system, SMS reminders and newsletter for the clinic in Copenhagen. Data processing agreement concluded. Sub-processors include team.blue Denmark A/S (hosting), InMobile ApS and OnlineCity ApS (SMS) and ePay ApS (payment gateway) - all within the EU.
• Vena ApS (medical record system): Statutory patient records, laboratory results and vaccination registration for the clinic. Data processing agreement concluded. Sub-processors include PLSP A/S, MedCom, team.blue Denmark A/S, Datagruppen MultiMed A/S and Scaleway (backup in France, EU).

Health authorities:

• For vaccination, the vaccination is registered on sundhed.dk (the Danish Vaccination Register, DDV) in accordance with Danish health legislation
• For blood tests, requisitions and test results are exchanged with the accredited laboratory via the national health data networks (MedCom)
• If follow-up is needed, we may, with your consent, send a report or referral to your own doctor

Corporate customers:

• Receive only anonymised and aggregated health statistics (with 20+ participants). No personally identifiable data is shared.

NurseCare never sells your personal data to third parties.

7. Security measures

NurseCare has implemented appropriate technical and organisational security measures to protect your personal data:

• Encryption of data at rest and in transit
• Access control - only authorised staff with a work-related need have access
• Logging of all actions in systems that process personal data
• Regular evaluation of security measures
• Nurses are subject to a statutory duty of confidentiality
• Physical security measures at health checks (discreet premises, closed room)
• Annual review of data processing agreements and security procedures

8. Your rights

As a data subject, you have the following rights under the GDPR:

• Right of access (Article 15): You can request to see what data we process about you
• Right to rectification (Article 16): You can have incorrect data corrected
• Right to erasure (Article 17): You can ask to have your data deleted ("the right to be forgotten"), unless we have a legal obligation to keep it
• Right to restriction (Article 18): You can ask for the processing of your data to be restricted
• Right to data portability (Article 20): You can receive your data in a structured, machine-readable format
• Right to object (Article 21): You can object to processing based on legitimate interest
• Right to withdraw consent: If you have given consent, you can withdraw it at any time by contacting us

For certain services (e.g. health checks), NurseCare does not store personally identifiable health data. In these cases, rights such as access and erasure are limited to the data actually processed and stored (e.g. booking data). For skin checks, where personally identifiable health data is stored, all the rights above can be exercised in full.

Patient records from the clinic and medical record notes from sample collection for partners are subject to statutory retention (at least 10 years after the latest entry) and therefore cannot be deleted on request before the retention period has expired.

You can exercise your rights by contacting us at support@nursecare.dk or on +45 70 20 22 32.

9. Personal data breaches

NurseCare has a fixed procedure for personal data breaches:

1. The breach is registered and assessed internally without delay
2. The Danish Data Protection Agency (Datatilsynet) is notified without undue delay and no later than 72 hours if the breach poses a risk to the rights of natural persons
3. Affected data subjects are notified if the breach is likely to result in a high risk to their rights
4. Corrective measures are implemented to limit harm and prevent recurrence
5. The incident is documented in NurseCare's internal incident log

Our data processors are obliged to notify NurseCare without undue delay and no later than 48 hours after becoming aware of a breach.

10. Complaints

If you are dissatisfied with our processing of your personal data, you are welcome to contact us. You also have the right to lodge a complaint with:

Datatilsynet (the Danish Data Protection Agency)
Carl Jacobsens Vej 35, 2500 Valby, Denmark
Phone: +45 33 19 32 00
Email: dt@datatilsynet.dk
Website: www.datatilsynet.dk

Our processing of personal data follows the General Data Protection Regulation (GDPR) and the Danish Data Protection Act (databeskyttelsesloven).

11. Changes to this policy

NurseCare reserves the right to update this privacy policy in the event of significant changes in legislation, new technical solutions or changed processing activities. The current version is always available at www.nursecare.dk. In the event of significant changes, we actively inform the data subjects concerned.

Follow-up on your blood test results

Your test results are delivered via sundhed.dk, and you also receive a personal results letter (see section 2.5). You choose whether NurseCare may contact you if follow-up is needed (A), or whether you only want your numbers (B). Regardless of your choice, we will always contact you in the case of critical or action-requiring values, for your safety. The legal basis is Article 6(1)(b) and (c) and Article 9(2)(h) of the GDPR, cf. section 7(3) of the Danish Data Protection Act. Your choice is noted in your medical record.