How we protect your personal data

How we collect, use and disclose your personal data. Last updated 16 September 2026.

Last updated: 16 September 2026

This policy describes how Caolín collects, uses and discloses your personal data when you visit our website, contact us, book a consultation or receive treatment with us. It also applies when you communicate with us in other ways, for example by phone, email or through social media.

If there is any conflict between our terms of service and this policy, this policy applies to the collection, processing and disclosure of your personal data.

Please read the policy carefully. If you have any questions about it, you are welcome to contact us using the details at the bottom of the page.

When we write "personal data", we mean information that identifies you or can reasonably be linked to you. Anonymous information that cannot be traced back to you is not covered. Depending on how you use our website and our clinic, we may process these categories:

• Contact details such as your name, address, phone number and email address.
• Appointment details about the consultations and treatments you book, and about changes and cancellations.
• Health information that you give us in connection with a consultation or treatment. It forms part of your patient record, which we keep as required by healthcare legislation.
• Payment details such as invoices, receipts and information about completed payments.
• Your communication with us, including what you write when you contact us.
• Device information such as your browser, your network connection, your IP address and other identifiers.
• Usage information, that is, how you move around and use our website.

We may collect personal data from these sources:

• Directly from you, when you contact us, book an appointment, complete a form or receive treatment with us.
• Automatically through our website, including through the use of cookies and similar technologies.
• From our data processors, when they process data on our behalf.
• From others, if you have given your consent.

We use your personal data for these purposes:

• Consultation and treatment. We use the data to book and manage your appointments, to advise you, to plan and carry out your treatment, and to keep the patient record that healthcare legislation requires.
• Communicating with you. We answer your enquiries, confirm appointments and follow up after a treatment.
• Marketing. If you have given your consent, we send you newsletters or other marketing. You can withdraw your consent at any time.
• Security. We use the data to protect our website and our clinic against misuse, and to detect and prevent fraud.
• Legal obligations. We process data to comply with the law, for example the rules on patient records and bookkeeping, and to establish or defend legal claims.

We only disclose personal data when we have a lawful basis for doing so. That may happen in these cases:

• To our data processors, who provide hosting, website operation, booking, email and IT support. They process the data only on our behalf and on our instructions.
• To other healthcare professionals, if you ask us to or give your consent, for example on referral or when your patient record is released.
• To public authorities, where the law requires it, or where it is necessary to establish or defend a legal claim.
• In connection with a business transfer, for example a merger or a sale of the clinic.

We do not sell your personal data.

Our website is hosted by an external supplier, and we use IT suppliers for operations, booking and email among other things. They process personal data only on our behalf and on our instructions, and we have entered into data processing agreements with them.

Some suppliers may process data outside Denmark. Where that happens outside the EU and the EEA, we use a recognised transfer mechanism — see the section on international transfers below.

If you would like to know which data processors we use, you are welcome to contact us.

Our website may contain links to websites or other online platforms operated by third parties. If you follow links to websites that we are not affiliated with or do not control, please read their privacy and security policies and their other terms and conditions. We do not guarantee, and are not responsible for, the privacy or security of such websites, including the accuracy, completeness or reliability of the information on them. Information you provide in public or semi-public places, including information you share on third-party social media platforms, may also be seen by other users of those platforms. Our inclusion of such links does not in itself imply any endorsement of the content on those platforms or of their owners or operators.

Our website is not intended for children, and we do not knowingly collect personal data about children below the age of majority in your jurisdiction. If you are the parent or guardian of a child who has given us their personal data, please contact us using the details below to ask for it to be deleted. Treatment of patients under 18 always requires the consent of a parent or guardian.

Please be aware that no security measure is perfect or impenetrable, and we cannot guarantee "perfect security". The information you send to us may also not be secure while in transit. We recommend that you do not use unsecured channels to send us sensitive or confidential information.

How long we keep your personal data depends on why we hold it. Patient records are kept for at least ten years after the most recent entry, as healthcare legislation requires. Other data is kept for as long as we need it to serve you, to comply with legal obligations, to resolve disputes or to enforce our agreements.

You have the following rights. They are not absolute and apply only on the conditions set out in data protection law, so in some cases we may have to decline a request.

• Access. You can find out what data we process about you and receive a copy of it.
• Rectification. You can have inaccurate data about you corrected.
• Erasure. You can ask us to delete data about you. Please note that patient records must be kept for at least ten years after the most recent entry under healthcare legislation, and therefore cannot be deleted on request.
• Data portability. You can receive the data you have given us in a common format and have it transferred to someone else.
• Objection and restriction. You can object to our processing of your data or ask us to restrict it.
• Withdrawal of consent. Where you have given consent, you can withdraw it at any time. That does not affect the lawfulness of the processing carried out beforehand.
• Marketing. You can unsubscribe from our newsletter at any time using the link in the email. We may still send you practical messages about your appointments.

You exercise your rights by contacting us using the details at the bottom of the page. We may need to verify your identity before we process your request, and we reply within the time limits set by law. You will not be treated less favourably for exercising your rights.

If you wish to complain about how we process your personal data, please contact us first using the details at the bottom of the page — then we will try to resolve it.

You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk. If you live in another EU country, you can complain to the supervisory authority in your own country.

Please note that we may transfer, store and process your personal data outside the country you live in.

If we transfer your personal data out of the EU or the EEA, we use a recognised transfer mechanism, such as the European Commission's standard contractual clauses, unless the transfer is to a country that has been assessed as providing an adequate level of protection.

We may update this policy from time to time, for example to reflect changes in our practices or for other operational, legal or regulatory reasons. We will publish the revised policy on this page, update the "last updated" date and give notice where the law requires it.

If you have questions about how we handle personal data or about this policy, or if you wish to exercise any of your rights, please call +45 71 99 92 92, email info@caolin.com or write to us at Jægersborg Allé 14, 2920 Charlottenlund, Denmark. Under applicable data protection law, we are the data controller for your personal data.