Den Kognitive Diamant
Cookies and privacy policy
In brief
I am bound by professional confidentiality and a duty to keep records. I keep your records for 5 years from the most recent note. I send emails containing sensitive personal information with Proton Mail, which is encrypted.
When you come from one of my ads
I advertise on Google. To know which ads lead to booked sessions, the website itself counts per ad. None of this is sent to Google Ads or any other ad system.
The code in the address
If you come via one of my Google ads, a short code is shown in the address (for example k=f), and it is carried over to the pages you open from there. The code is the same for everyone who comes via the same ad and only shows which ad you came from, and so what kind of search it was shown for (for example online or insurance), not who you are or what you typed. Without a cookie, the server counts, per code, the landings, the views of the price and contact pages, the presses on the buttons for booking and the free phone call, and the pages per ad visit. The code can be seen in your browser history.
The ad cookie – only if you say yes
The first page asks whether your browser may store, for 30 days, which ad you came from. If you say yes, the cookie __Host-dkd_annonce is set with only the code and the version of the question (for example f.3). Only the website’s server can read it, and it is not shared with Google or anyone else. Presses on the buttons for booking and the free phone call, and bookings, are then counted on the code. The cookie is deleted after a booking, after 30 days, or when you press “Delete ad cookie” at the bottom of any page. You then get a short confirmation at the bottom of the page. If you come via an ad again, the cookie gets the new code, and the 30 days start again. If you say no, no cookie is set, and the code is removed from the address for the rest of your visit; a cookie from an earlier yes is deleted. Your no is not stored, so the page asks again next time. If you do not answer, no cookie is set, but the code stays in the address. You can book in the same way whatever you answer.
Legal basis and your rights
The ad cookie and the counting on the code from the cookie are based on your consent (section 3 of the Danish executive order on cookies and Article 6(1)(a) and Article 9(2)(a) of the General Data Protection Regulation). You can withdraw it at any time with “Delete ad cookie”; this applies from then on. Records already stored have no ID, so I cannot see which of them are yours. The code in the address and the counting without a cookie are based on my legitimate interest in knowing which ads work (Article 6(1)(f)). You can remove the code with “No thanks” or “Delete ad cookie” and object by contacting me.
Phone calls from my ads
If you call the number in one of my Google ads, you call the clinic directly. I have not used Google’s call reporting since 1 October 2026. Google itself may record views of and clicks on the ads under its own terms.
The website’s own statistics
The website’s server does its own counting, without statistics scripts and without a visitor ID. It counts deliveries of selected pages, video starts and presses on the buttons for booking, the free phone call, the map and Trustpilot. These buttons go through this website’s own addresses, and so does the Book button on my Google profile. It also counts answers to the voluntary question after booking (“Where did you first hear about the clinic?”, asked in Danish), landings from my ads, how many pages a visit from an ad opens, and the answers to the question about the ad cookie (yes with the code, no without).
What is stored
Each count is stored as a small event record at Cloudflare with a fixed name (page, button, video or answer), the language and the time. For a page delivery, a source category is also stored (for example Google, Google ad, AI service, internal or unknown), derived from the page you came from, Google’s ad marker or the ad code; the address itself is not stored. For a press on a button or a video, the fixed name of the page you pressed it on is stored too. If the visit came from an ad, the code is stored as well, and at the landing whether the question was shown or you already had the ad cookie. After a booking, the kind of session is stored (free phone call, session in the clinic, online session, session via a partner, or other), never its name, time or price. If a request looks automated, it is marked; the browser’s identification is not stored. No full web address is stored.
How long
The event records stay at Cloudflare, which deletes them after about three months. After that I keep only monthly totals, for the ads monthly totals per code, in my own files in a private repository on GitHub and on Google Drive. Automatic checks use grouped totals over at most a month, never single records, and nothing below monthly level is kept beyond about three months.
Legal basis
The counting without a cookie stores no ID, no IP address and nothing else about who you are. I only read the records as totals, never piece a visit together and never compare them with the booking system, including the records of bookings. The legal basis is my legitimate interest in knowing whether the website and its buttons are used (Article 6(1)(f) of the General Data Protection Regulation), and you can object.
When you are my client
What information and why
I process general personal data (for example your name, contact details and invoices), your Danish civil registration (CPR) number and information about your health, to the extent needed to keep records, administer your treatment and comply with legal requirements.
Your name and CPR number must be in your records (section 12 of the Danish executive order on patient records). If you do not have a Danish CPR number, I use another unique code. I also need to be able to contact you. Without this information, I cannot provide a course of treatment.
If an insurance company or a partner refers you to me, I receive the information needed for your treatment, for example contact details, case number and what has been approved.
Legal basis and consent
The basis is the agreement on your treatment and my duty to keep records as an authorised psychologist (Article 6(1)(b) and (c) of the General Data Protection Regulation). For information about your health, the basis is Article 9(2)(h), cf. section 7(3) of the Danish Data Protection Act. I process your CPR number under section 11(2)(4) of the Danish Data Protection Act. I process invoices and accounts under Article 6(1)(c), because the Danish Bookkeeping Act requires it.
Your treatment is not based on consent. I ask for your consent before I myself obtain information about you from others, and before I pass on information. Your consent is voluntary, and you can always withdraw it by writing to me or calling me. This applies from then on.
When I pass on your information
I only pass on your information with your consent or if the law requires or permits it. If, for example, your insurance company or an authority asks for information, I ask you first, unless the law requires otherwise. If an insurance company or a partner pays for your treatment, they receive, as agreed with you, the invoice and what is needed to settle it.
I may break confidentiality if it is necessary to protect you or others from serious danger, and in some cases I must. For example, I must notify the municipality if, through my work, I learn of or have reason to believe that a child or young person under 18 may need support. If I have to break confidentiality, I will as a rule tell you first, but not if that could harm a child.
Who receives your information
I use providers that process the information on my behalf under an agreement: booking and patient record system (Terapeutbooking from EasyPractice), video sessions, email (including Proton Mail), accounting and bookkeeping, and running the website (Cloudflare).
Countries outside the EU: Proton is based in Switzerland, which the EU has recognised as a country with adequate protection (an adequacy decision). Cloudflare is described under “Hosting at Cloudflare”.
Retention
I keep your records for 5 years from the most recent note, and then I delete them. If the records are relevant to a complaint, a supervisory case or a compensation case, I keep them for as long as the case is pending (section 35 of the Danish executive order on patient records, Executive Order no. 1361 of 24 November 2025).
I keep accounting records, such as invoices, for 5 years from the end of the financial year (section 12 of the Danish Bookkeeping Act). I delete other information when I no longer need it.
Security and email
Booking, video sessions and the patient record system use encrypted connections. Ordinary emails about, for example, times and practical arrangements are not end-to-end encrypted. I send emails containing sensitive personal information with Proton Mail, which is encrypted. You can always call me instead.
If a security breach is likely to result in a high risk to you, I will tell you without undue delay.
Your rights
You have the right of access and to a copy, to have incorrect information corrected and to have information deleted when I no longer need it or am no longer obliged to keep it (your records only after the retention period). You have the right to have the processing restricted, for example while I check whether a piece of information is correct, and to object to processing that is based on my legitimate interest, for example the website’s statistics. You have the right to receive the information you have given me under the agreement with me or under your consent in a commonly used, machine-readable format.
If you want your records sent to another psychologist or your doctor, this can be done with your consent.
I make no automated decisions about you and do not use profiling.
If you wish to use your rights, write to me at therese@denkognitivediamant.dk. I reply within one month. You can complain to the Danish Data Protection Agency (Datatilsynet).
Data controller and contact
- Data controller
- Den Kognitive Diamant ApS, for client information and this website (contact: psychologist Therese Ejerskov)
- Address
- Danstrupvej 27G, 1st floor, 3480 Fredensborg, Denmark
- CVR no. (company registration number)
- 39625253
- Phone
- +45 31 66 83 88
This privacy policy was last updated 23 October 2026.