Extended privacy policy

Insured by Forsikringsselskabet Dansk Sundhedssikring A/S

For what purposes are personal data used?

Types of personal data

What is the legal basis for processing?

Taking out and administration of health insurance

When you are covered by health insurance with us, we register your basic details in our systems, so that we can see that you are insured by us. We can then identify you, and ensure that you are able to make a claim with us.

General personal data

· Name

· Address

· Email address

· Telephone number

· Workplace

· Job title/position

· Employee group

· Payroll number

· Policy number

· Age

· Gender

· Date of birth

· CPR number (confidential personal data)

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to register you in our systems, to see that you have health insurance with us and can identify you, so that you can report a claim. We believe this interest exceeds consideration for your interest in us not processing your personal data. 

GDPR art. 9 (2), letter f (legal claim) and the Danish Data Protection Act’s Section 7 (1): The need to be able to determine your right to receive insurance products according to the insurance agreement you are covered by.

Claims and health-related processing

When you make a claim with us, we register the details you give us in connection with the actual claim. We use them to perform a healthcare-related assessment of your problem, in which we determine how we can provide the best treatment and course of action for you, and which treatment provider we can recommend for you in our external healthcare network.

If you would rather use your own treatment provider who is not in our external healthcare network, we will send a payment guarantee directly to you, and will then not take any further action with your personal data.

If your problem is not solved with the number of treatments we authorised in the first instance, we can ask for details on your treatment from your treatment provider. We will use those details to assess the status of the problem and your progress before we approve further treatments.

General personal data

· Name

· Address

· Email address

· Telephone number

· Workplace

· Job title/position

· Employee group

· Payroll number

· Policy number

· Cover and options

· Age

· Gender

· Date of birth

· CPR number (confidential personal data)

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

· Sexual problems that can occur if your treatment involves mental issues that concern your sexuality.

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, so that we can see that you have health insurance with us and can identify you, so that you can report a claim. We believe this interest exceeds consideration for your interest in us not processing your personal data. 

GDPR art. 9 (2) letter b (legal obligation) cf. Sections 5, 10 and 15 of the Executive Order on record-keeping As a result of healthcare legislation, our authorised healthcare personnel are obliged to keep records of all contact they have with you.

GDPR art. 9 (2), letter f (legal claim) and the Danish Data Protection Act’s Section 7 (1): The need to be able to determine your right to receive insurance products according to the insurance agreement you are covered by. This applies when making a claim, and regular assessment of an open case.

Disclosure to external treatment providers and pension companies

If you want treatment in our external network of healthcare treatment providers, we will send your personal data to the treatment provider chosen.

If you are covered by mandatory provision of early intervention in the event of a risk of loss of the ability to work, we can forward your details to your pension company with your consent.

General personal data

· Name

· Address

· Email address

· Telephone number

· Payment guarantee number

· Age

· Gender

· Date of birth

· CPR number (confidential personal data)

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

GDPR art. 6 (1), letter a (consent): We disclose your general personal data with your consent.

GDPR art. 9 (2), letter a (consent): We disclose your CPR number and health data with your consent.

Duty to keep records

To comply with our legal obligation to keep patient records in accordance with the Executive Order on authorised healthcare staff’s patient records (the Executive Order on record-keeping) and the Executive Order of the Act on psychologists. We are covered by this obligation, as the treatment and consultancy referred to earlier is provided by Dansk Sundhedssikring’s specialised nurses, psychologists and doctors.

General personal data

· Name

· Address

· Email address

· Telephone number

· Age

· Gender

· Date of birth

· CPR number (confidential personal data)

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

· Sexual problems that can occur if your treatment involves mental issues that concern your sexuality.

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to register you in our systems, see that you have health insurance with us and can identify you, so that you can report a claim. We believe this interest exceeds consideration for your interest in us not processing your personal data. 

GDPR art. 9 (2) letter b (legal obligation) cf. Sections 5, 10 and 15 of the Executive Order on record-keeping As a result of healthcare legislation, our authorised healthcare personnel are obliged to keep records of all contact they have with you.

GDPR art. 9 (2), letter f (legal claim) and the Danish Data Protection Act’s Section 7 (1): The need to be able to determine your right to receive insurance products according to the insurance agreement you are covered by.

Acute crisis help

If you are exposed to an event or incident that subsequently requires acute crisis help, and is covered by your health insurance, we can initiate the treatment and disclose your personal data to relevant treatment providers without your consent, if you are unable to do so as a result of the incident.

General personal data

· Name

· Address

· Email address

· Telephone number

· Payment guarantee number

· Policy number

· Cover and options

· Age

· Gender

· Date of birth

· CPR number (confidential personal data)

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

GDPR art. 6 (1), letter d (vital interest):

GDPR art. 9 (2), letter c (vital interest):

In the event of a situation that requires acute crisis help, we have found that there can be vital consequences for you and your health if you do not receive treatment.

Communication and sending out service notifications

Physical or digital communication, including service notifications via letter, email, e-Boks or via our customer portal Mit DS-Sundhed.

General personal data

· Name

· Address

· Email address

· Telephone number

· CPR number (confidential personal data)

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to communicate with you on your health insurance, your claims and changes to your health insurance. We believe this interest exceeds consideration for your interest in us not processing your personal data.

GDPR art. 9 (2), letter f (legal claim) and the Danish Data Protection Act’s Section 7 (1): The need to be able to determine your right to receive insurance products according to the insurance agreement you are covered by.

Legal obligations and legal claims, including dealing with complaints

To comply with our legal obligations, and to be able to determine, defend and make legal claims applicable.

General personal data

· Name

· Address

· Email address

· Telephone number

· Workplace

· Policy number

· Cover and options

· Payment guarantee number

· Age

· Gender

· Date of birth

· CPR number (confidential personal data)

· Other relevant details used to comply with a legal obligation or for the purposes of a legal claim

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

· Sexual problems that can occur if your treatment involves mental issues that concern your sexuality.

GDPR art. 6 (1), letter c (legal obligation) cf. Executive Order on complaint responsibility and the handling of complaints by financial undertakings, Section 4.

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to apply or defend a legal claim. We believe this interest exceeds consideration for your interest in us not processing your personal data.

GDPR art. 9 (2), letter f (legal claim)

GDPR art. 9 (2), letter g.

The Danish Data Protection Act’s Section 11 (2), no. 4 cf. the GDPR’s art. 9 (2), letter f (CPR number)

Early intervention in the event of a risk of loss of the ability to work

If you have health insurance with us through your pension company, and are covered by mandatory provision of early intervention in the event of a risk of loss of the ability to work, we will analyse your data to determine whether you are at risk of losing your ability to work.

General personal data

· Name

· Address

· Email address

· Telephone number

· Cover and options

· Age

· Gender

· Date of birth

· CPR number (confidential personal data)

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to analyse whether you are at risk of losing your ability to work. We believe this interest exceeds consideration for your interest in us not processing your personal data. 

The Danish Data Protection Act’s Section 10 (1)

Recording telephone calls

We only record our telephone calls when you contact our Healthcare Team. We do so automatically for the purpose of keeping records, documentation of your claim and our case processing.

General personal data

· Name 

· Telephone number

· CPR number (confidential personal data)

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

· Sexual problems that can occur if your treatment involves mental issues that concern your sexuality.

Executive Order on record-keeping, Section 10, no. 2, letter f.

Reporting to public authorities and legal obligations

According to the law, we are obliged as an insurance company to perform a number of analyses of claims received and cover approved. The results of such analyses are reported to the authorities in anonymised format.

We can use personal data if we have to respond to specific enquiries from the public authorities.

General personal data

· Case number 

· Invoice number

· Treatment date

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

· Sexual problems that can occur if your treatment involves mental issues that concern your sexuality.

GDPR art. 6 (1), letter c (legal obligation)

GDPR art. 9 (2), letter f (legal claim)

Business Intelligence, customer and product analyses

Dansk Sundhedssikring compiles statistics and analyses via Business Intelligence (BI) to improve its products and services, quality-assure, product development and to perform anonymous reporting to our customers (your employer).

General personal data

· Case number 

· Invoice number

· Treatment date

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

· Sexual problems that can occur if your treatment involves mental issues that concern your sexuality.

The Danish Health Act, Section 42d (2), no. 2.

GDPR art. 6 (1), letter e (the interests of society).

The Danish Data Protection Act’s Sections 10 (1) and 11 (2), no. 3.

The processing of personal data contained in your records is performed to compile statistics, conduct quality assurance and to develop and analyse the process.

We also make anonymous reports to customers (your employer) and to Dansk Sundhedssikring’s owners, on the basis of results from BI.

Satisfaction and effect surveys

We regularly conduct customer satisfaction and effect surveys. We do so by sending you links after you have been in contact with us and in partnership with one of our data processors, to our online customer satisfaction and effect measurement forms, which you can opt to respond to.

Customer satisfaction and effect measurement surveys are voluntary.

General personal data

· Case number 

· Invoice number

· Treatment date

Sensitive personal data

· Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to analyse your responses on your satisfaction with your health insurance. We believe this interest exceeds consideration for your interest in us not processing your personal data.

GDPR art. 9 (2), letter a (consent)

Invoicing, bookkeeping and accounts

To invoice, bookkeep and keep accounts, and to calculate financial reserves, etc.

General personal data

· Case number 

· Invoice number

· Treatment date

Sensitive personal data

· Health data in the form of the treatment provided.

GDPR art. 6 (1), letter b (fulfilment of contract).

GDPR art. 6 (1, letter c (legal obligation) cf. the Danish Bookkeeping Act and accounting legislation.

GDPR art. 9 (2), letter f (legal claim)

Disclosure to sister companies

When we perform administrative and financial analysis work for our sister companies PrimaCare A/S and VitalityGuard A/S, we use Dansk Sundhedssikring’s own personal data in the process, to be able to compare our data with those we receive from them.

General personal data

· Payment guarantee number 

· Policy number

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to be able to perform financial analyses for other members of our group. We believe this interest exceeds consideration for your interest in us not processing your personal data.

Disclosure to insurance brokers

If your insurance was taken out through an insurance broker, we will disclose your personal data to the broker when necessary.

General personal data

· Name

· Address

· Email address

· Telephone number

· Workplace

· Job title/position

· Employee group

· Payroll number

· Age

· Gender

· Date of birth

· CPR number (confidential personal data)

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to perform administration of your health insurance along with your insurance broker. We believe this interest exceeds consideration for your interest in us not processing your personal data. 

GDPR art. 9 (2), letter f (legal claim) and the Danish Data Protection Act’s Section 7 (1): The need to be able to determine your right to receive insurance products according to the insurance agreement you are covered by.

Test and development of systems

Dansk Sundhedssikring may use your personal data for testing and developing purposes of our systems, to ensure the continued safe operation.

General personal data

• Name
• Address
• E-mail address
• Telephone number
• Workplace
• Job title/position
• Employee group
• Payroll number
• Policy number
• Cover and options
• Age
• Gender
• Date of birth
• CPR number (confidential personal data)

Sensitive personal data

• Health data in the form of mental or physical ailments, which need to be treated with regard to providing healthcare treatment.
• Sexual problems that can occur if your treatment involves mental issues that concern your sexuality.

GDPR art. 6 (1)(f) (legitimate interest): We have a legitimate interest in processing your general personal data, so that we can develop, test, and maintain our systems functions and security. We believe this interest exceeds consideration for your interest in us not processing your personal data. 

GDPR art. 9 (2)(b) (legal obligation).

GDPR art. 9 (2)(f) (legal claim) and the Danish Data Protection Act’s Section 7 (1).

Anonymising

Dansk Sundhedssikring can anonymise your personal data for the purposes of marketing, development of products and services, machine learning, compilation of statistics, and for sharing, reporting to your employer, sales and publication of completely anonymous data. Your data will be anonymised according to our internal anonymising rules.

The data protection rules do not apply to anonymous data.

The data protection rules do not apply to anonymous data.

Contact personnel at external treatment providers or external treatment providers in the form of sole trader businesses

For what purposes are personal data used?

Types of personal data

What is the legal basis for processing?

Comply with collaboration agreement

Dansk Sundhedssikring processes your personal data with to register your health clinic or treatment location in our network database of approved treatment providers, and subsequently to comply with the collaboration agreement. 

General personal data

· Name

· Address

· Telephone number

· Type of processing offered

· Contract details

GDPR art. 6 (1), letter b (fulfilment of contract).

Invoicing, bookkeeping and accounts
To invoice, bookkeep and compile accounts.

General personal data

· Name

· Address

· Telephone number

· Invoice

· Payment details

GDPR art. 6 (1), letter b (fulfilment of contract).

GDPR art. 6 (1, letter c (legal obligation) cf. the Danish Bookkeeping Act and accounting legislation.

Satisfaction and effect surveys
Dansk Sundhedssikring issues satisfaction surveys after receiving treatment, to get feedback on your treatment. 

General personal data

Details of customer satisfaction with your treatment

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to issue and receive responses to satisfaction and effect surveys, to be able to improve our own products and services, along with Dansk Sundhedssikring’s network of external and our own healthcare treatment providers. We believe this interest exceeds consideration for your interest in us not processing your personal data.

Legal claim
To comply with our legal obligations, and to be able to determine, defend and make legal claims applicable.

General personal data

· Name

· Address

· Telephone number

· Type of processing offered

· Contract details

· Correspondence

GDPR art. 6 (1), letter c (legal obligation).

GDPR art. 6 (1), letter f (weighing of interests): We have a legitimate interest in processing your general personal data, to apply or defend a legal claim. We believe this interest exceeds consideration for your interest in us not processing your personal data.