Cookies and privacy policy

Data controller

I process personal data and have therefore adopted this privacy policy, which tells you how I process your data.

Den Kognitive Diamant ApS, represented by psychologist Therese Ejerskov, is the data controller for the information processed about you as a client and for the information processed when you use this website.

To protect your personal data as well as possible, I continuously assess how high the risk is that my data processing affects your fundamental rights negatively. I have taken a number of preventive measures regarding data security, which means the risk of a data breach is assessed as low.

I ensure fair and transparent data processing

When I ask you to make your personal data available to us, I inform you of which data I process about you and for what purpose. You receive this information at the time your personal data is collected.

In some cases it may be necessary to obtain information from an authority or partner, in which case I obtain your consent beforehand. If partners (e.g. an insurance company) or authorities request disclosure of information, you will be asked for consent.

Processing of personal data

I store this type of data about you:

• Ordinary personal data
• Civil registration (CPR) number (if necessary)
• Sensitive data

I collect and store your personal data for specific purposes

I collect and store your data to the extent necessary for your treatment:

• In connection with record-keeping and storage of your information.
• Administration of your relationship with us, e.g. invoicing.
• Compliance with legal requirements, including the duty to keep records.

The basis for my processing of your information

When you are in treatment with me, I process your information in order to provide you with psychological treatment and to comply with my duty to keep records as an authorised psychologist. The legal basis is Article 6(1)(b) of the General Data Protection Regulation, concerning the agreement on your treatment, and Article 6(1)(c), concerning my legal obligation to keep records. For information about your health, the basis is Article 9(2)(h), because the processing takes place as part of health care under professional confidentiality.

I process information for invoicing and accounting under Article 6(1)(c), because the Danish Bookkeeping Act requires it. I only disclose your information if you consent to it or if the law requires it.

I only process relevant and necessary personal data

I only process data about you that is relevant and sufficient for the purposes defined above. I only collect, process and store the personal data necessary to carry out my work. In addition, legislation may determine which type of data is necessary to collect and store for my business operations. The type and extent of the personal data I process may also be necessary to fulfil a contract or another legal obligation.

I check and update your personal data

I check that the personal data I process about you is not incorrect or misleading. I also make sure to update your personal data on an ongoing basis. As my service depends on your data being correct and up to date, I ask you to inform us of relevant changes to your data.

I delete your personal data when it is no longer necessary

I delete your personal data when it is no longer necessary for the purpose that was the reason for my collection, processing and storage of your data. Your records are kept for 5 years after the most recent entry and are then deleted.

I obtain your consent before I process your personal data

I obtain your consent before I process your personal data for the purposes described above, unless I have a legal basis for obtaining it. I inform you of any such basis. Your consent is voluntary, and you can withdraw it at any time by contacting us.

If I wish to use your personal data for a purpose other than the original one, I inform you of the new purpose and ask for your consent before I begin the data processing. If I have another legal basis for the new processing, I inform you of this.

I do not disclose your personal data without your consent

I do not disclose personal data to other parties. I am, however, obliged to break confidentiality if it is assessed that you are a danger to yourself or others. I am also subject to an enhanced duty of notification, whereby I am obliged to notify the relevant authorities if I receive information indicating that a child or young person is at risk. In these cases, where I am legally obliged to break confidentiality, I will always inform you and try to obtain your consent.

Security

I protect your personal data and have internal rules on information security.

I have adopted internal rules on information security, which contain instructions and measures that protect your personal data against being destroyed, lost or altered, against unauthorised publication, and against unauthorised persons gaining access to or knowledge of it.

In accordance with EU data protection law, data processing agreements have been entered into with relevant partners. I also protect the confidentiality and authenticity of your data by means of encryption.

In the event of a security breach that results in a high risk to you of discrimination, identity theft, financial loss, loss of reputation or other significant disadvantage, I will notify you of the security breach as quickly as possible.

Phone calls from my ads

From 1 October 2026 I do not use Google’s call reporting. If you call via a phone number in one of my Google ads, you call the clinic directly, and Google does not record the call itself for me. Google may record that the call button in the ad was pressed; that happens in Google’s own systems under Google’s terms. Until 30 September 2026, calls from the ads went through a forwarding number from Google Ireland Limited, and Google recorded the call’s start time, duration, whether it was answered and the area code, and for calls over 15 seconds also the phone number. You can always call the clinic directly on the number at the bottom of the page.