Retention and rights

The clinic decides what is stored about you, and for how long. That follows the rules that apply to the clinic’s profession and to the country the clinic works in. The clinic is responsible for your information, and FlowDule supplies the technology behind it. We store, show and delete the information as the clinic asks us to, or when the period has expired. There is no single period that applies to all clinics, so questions about your own information must be put to the clinic.

It depends on what you use the clinic for. It may be:

• your contact details and your connection to the clinic;
• your bookings, your attendance and your payments;
• the record, notes, plans, measurements and reports;
• messages between you and the clinic and the content the clinic shares with you;
• images, documents and audio recordings that the clinic adds;
• a log of who has seen or corrected your information.

How long a piece of information is stored depends on the clinic’s profession and country. If the practitioner is an authorised healthcare professional, the patient record is as a starting point kept for at least five years from the most recent entry, and for doctors, dentists, chiropractors, midwives, clinical dieticians, clinical dental technicians and dental hygienists for at least ten years. If the practitioner is not an authorised healthcare professional, for example a self-employed psychotherapist, there is no fixed number of years in the law, and the clinic sets its own period, which it must be able to explain to you. If your record is multidisciplinary, that is kept by both professional groups with a five-year period and professional groups with a ten-year period, the multidisciplinary record is kept for at least ten years under the applicable rules.

Bookings, payments, messages and files follow the clinic’s own choice and the bookkeeping and professional rules the clinic is covered by. Backups of the database are overwritten on an ongoing basis and no later than after 30 days.

You can find the exact period for your information in the clinic’s own privacy information, or by asking the clinic.

When the period expires, or the clinic deletes your information, we do not remove it in just one place. We remove it in the client record itself and in the health record, in earlier versions of the notes, in the bookings, messages, shares and links the information forms part of, in images, documents and audio, in the material the search function brings up, and in export files at our end. The backups contain the information until they are overwritten, and they are not used for anything else in the meantime. We keep a receipt showing that the deletion has taken place, but not what was deleted.

Deletion may be postponed if the clinic has an obligation to keep the information in a specific case, for example a complaint, supervisory or compensation case. Only what the case requires is then kept, and only for as long as it lasts.

If the clinic corrects an entry in your patient record, the original text is not deleted. Corrections and additions can be traced: the original text is kept, and the correction is dated, so that it can still be seen what it said. Ordinary master and contact details can be corrected without more.

You can ask for access to and a copy of your information, for inaccurate information to be corrected, for erasure, for the processing to be restricted, for your information to be provided in a commonly used format, and to object to a processing operation. If a processing operation is based on your consent, you can withdraw the consent. Nor do you have to accept decisions that are taken by a machine alone and have a significant effect on you.

The rights do not apply without exception. A request for erasure may, for example, be limited by a statutory record retention period, a pending case, the rights of others or a legal claim. The clinic will then explain to you why.

You contact the clinic, which is responsible for your information. The clinic replies without undue delay and normally no later than one month after it has received your request. If the request is complicated, or if the clinic has many at once, the period can be extended by up to two months, and you are told about it before the first month has passed. The clinic must be sure of who you are before it discloses record or health information, but it must not ask for more than it needs. In FlowDule, the clinic can see who has viewed or corrected your record, and can therefore answer you on that.

If you are unhappy with the way your information is processed, you can complain to the Danish Data Protection Agency (Datatilsynet). You can read about FlowDule’s own processing in the Privacy Policy.

Questions about your record, your bookings, access, rectification or erasure must be put to the practitioner or clinic you are with. The clinic’s name and contact details are stated in the clinic’s own privacy text on the booking and client pages. We do not answer on the clinic’s behalf, but we help the clinic to find, correct, disclose and delete.

If you have questions about the technology behind it, or about the information FlowDule is itself responsible for, you can write to privacy@flowdule.com.

• GDPR Articles 5 and 12 to 23
• The Danish Patient Safety Authority (Styrelsen for Patientsikkerhed) on record retention
• The Danish Executive Order on patient records (journalføringsbekendtgørelsen), Executive Order no. 1361 of 24 November 2025
• The Danish Patient Safety Authority (Styrelsen for Patientsikkerhed) on the authorisation of psychologists from 1 January 2026