Phone +45 86 12 78 24 · Mon–Thu 8–12 · Fri 10–12 · DA Banegaardspladsen 4, 3rd floor · 8000 Aarhus C · Dansk
Aarhus Eye ClinicPrivate cataract surgery
86 12 78 24
Home / Privacy policy

Privacy policy for patients

How Aarhus Eye Clinic (Aarhus Øjenklinik) processes your personal data. The policy also applies to aarhusoejenklinik.dk and graastaer.dk. Version 6 November 2026. This is an English translation; in case of doubt, the Danish version applies.

This privacy policy describes how Aarhus Øjenklinik, Banegaardspladsen 4, 3rd floor, 8000 Aarhus C, Denmark, CVR no. 44995662 (“we”, “us”, “the clinic”) processes and discloses your personal data. When we talk to you, examine, diagnose and treat you, we collect and process a range of personal data about you as data controller.

1. Types of data and purposes

General personal data

Basic details such as name, address, email, phone number, date of birth, CPR number (Danish personal identification number), sex, family and social relations, occupation and education. In addition, information about payment and insurance cover for private treatment, about referral under the extended free choice of hospital, and the information you give us when you book an appointment via the website, email or phone.

Special categories

Health data: medical record information about examination, diagnosis and treatment, medication, test results, vision measurements, images and scans of the eyes (e.g. photos of the retina, OCT scans and measurements for calculating artificial lenses), certificates and referrals. Where relevant: racial or ethnic origin, religious beliefs, sexual matters and criminal matters.

We process your data for:

  • examination, diagnosis and treatment, including the use of images for diagnosis
  • medical statements, certificates, medication orders and prescriptions
  • communication with and referral to other healthcare professionals, hospitals and laboratories
  • reporting to clinical quality databases, the regions and the Danish Health Data Authority
  • statistics and quality improvement
  • appointment booking and communication with you, including via the booking form on graastaer.dk
  • invoicing for private treatment and for treatment paid for by insurance companies or by the region under the extended free choice of hospital
  • administration and compliance with the law, including documentation, IT security, handling of security breaches, complaints, supervision and disputes

2. Sources

In some cases we receive information about you from other healthcare professionals, such as hospitals and your referring doctor, or by looking up electronic record systems.

3. Voluntary provision

Providing us with information is voluntary, but without it we may in some cases be unable to examine or treat you. If processing is based on consent, you can always withdraw it. This does not affect processing carried out before the withdrawal.

4. Legal basis

  • General personal data is processed under Article 6(1)(c) and (d) of the General Data Protection Regulation, special categories under Article 9(2)(b), (c) and (h).
  • We are obliged to keep medical records under the Danish Authorisation Act, the Executive Order on Medical Records and the Danish Health Act, cf. Article 6(1)(c) and 9(2)(b).

The clinic is a training centre for doctors training to become specialists in ophthalmology. Doctors in training who take part in your treatment have access to your medical record to the extent necessary and work under the supervision of the clinic’s ophthalmologist.

5. Disclosure

Your data may be disclosed to:

  • other healthcare professionals on referral, in discharge summaries and when necessary for your treatment (section 41 of the Danish Health Act)
  • clinical quality databases (the Danish Clinical Quality Program, formerly RKKP), e.g. DiaBase (sections 195–196 of the Danish Health Act)
  • public authorities, e.g. the Danish Patient Safety Authority, the Danish Health Data Authority, Statens Serum Institut, the police, the courts and social authorities, when required by law
  • regional payment offices under the agreement on specialist medical care and section 60 of the Danish Health Act, and to the paying region for treatment under the extended free choice of hospital
  • pharmacies and the Danish Medicines Agency via the Shared Medication Record (section 157 of the Danish Health Act)
  • insurance companies and relatives with your consent, or without consent where the law permits (sections 43 and 45 of the Danish Health Act)
  • advisers in connection with a complaint or legal case (Article 6(1)(f) and 9(2)(f))
  • a new doctor if the clinic is transferred or closed (chapter 4 of the Executive Order on Medical Records)

As a rule, we do not disclose your data to recipients outside the EU/EEA.

6. Data processors and secure email

Your data is stored and processed on our behalf by our data processors: EG Clinea, EG A/S (electronic patient records), the clinic’s IT supplier, Danastar (secure email), Google (Gmail, our ordinary email), Simply.com (web hosting), the Region of Southern Denmark (Den Nye Henvisningsformidling, which handles electronic referrals for the whole country), Sundhed.dk and Sentinel, as well as their sub-processors.

Health data is only sent via secure email

We only send documents containing health data via secure email (Danastar). We use our ordinary email, aarhusoejenklinik@gmail.com, only for appointment booking and general enquiries. Please do not send health information to it.

Our ordinary email is provided by Google, and information in it may be transferred to the USA on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework). Our other data processors store data within the EU/EEA.

Websites and cookies

aarhusoejenklinik.dk and graastaer.dk are hosted by Simply.com and set no cookies. If you book an appointment via graastaer.dk, your booking is sent to us by email.

7. Retention

We keep your data for as long as necessary for the purposes. Medical records are kept for at least 10 years after the latest entry (section 35 of the Executive Order on Medical Records), and longer if a complaint or compensation case is pending.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection. These rights are limited by the rules for specialists in private practice: a medical record may not be deleted, only corrected or supplemented. You can complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk.

9. Contact

If you have questions about how we process your personal data, contact Aarhus Øjenklinik, Banegaardspladsen 4, 3rd floor, 8000 Aarhus C, Denmark. Phone +45 86 12 78 24 (Mon–Thu 8–12, Fri 10–12), email aarhusoejenklinik@gmail.com. CVR no. 44995662.

This privacy policy is based on a template from the Danish Association of Private Practising Specialists (FAPS). It is also available on paper at the clinic.