Privacy policy – Nordic Donors

Who is responsible

Sellmer klinik ApS (CVR 32478492, Arne Jacobsens Allé 16, 3., 2300 København S, Danmark) is the data controller for donor data in Nordic Donors, including your account in the app. Phone +45 30 30 70 80, email info@sellmerklinik.dk. You can find Sellmer's own privacy policy on Sellmer's website.

Archolm ApS (CVR 46220374, Helmsvej 49, 2880 Bagsværd, Danmark) develops and runs the app and the server as Sellmer's data processor under a data processing agreement. Archolm is the controller itself for two things only: crash reports and masked server logs, which Archolm uses for its own operation and security. The basis is Archolm's legitimate interest in keeping the app secure and stable (GDPR article 6(1)(f)).

You can send privacy questions to Archolm at privacy@archolm.dk or to Sellmer at info@sellmerklinik.dk. Questions about the app go to info@nordicdonors.dk.

What we store, and for how long

The table shows what the server stores, why, and when it is deleted from the server. The answers in the questionnaire are sensitive data: they can concern your health and other special categories of personal data under article 9, for example ethnic origin or genetic data. The compensation overview is financial data. You can delete your account whenever you want (see “Delete your account”).

Data on the server
Data	Why	Deleted from the server
Account: email address, password (stored as a one-way hash, not in plain text) and login sessions. Codes you receive by email are valid for 15 minutes.	So you can create an account and log in.	When you delete the account. A session expires after 90 days without use and after 365 days in total at the latest.
Donor number, first name, your status in the programme, dates for your next donation and next contact, the clinic's contact details and consent text, and whether you have given or withdrawn consent.	So the app can show your progress and the clinic's contact details.	When you delete the account. The donor number and first name are removed. What remains is a technical id with no information about you and a mark that the account is deleted, so the clinic's system can register the deletion.
Sensitive data: your unfinished answers in the questionnaire, which can include health data and other special categories, for example ethnic origin or genetic data.	So you can stop and continue later.	When you submit the questionnaire, and when you delete the account.
Sensitive data: your answers in the questionnaire once you have sent them, and answers to questions the clinic has changed later. The answers can include health data and other special categories, for example ethnic origin or genetic data.	So the clinic's system can fetch and store them.	When the clinic's system has confirmed that it has stored them. After that the app only shows that the answers were sent, and when.
Photos you send to the clinic, and the photo's status (Submitted, Approved or Rejected with a reason).	So the clinic's system can fetch and store them, and so you can see whether they are approved.	The photo itself is deleted when the clinic's system has confirmed that it has stored the file. The status stays until you delete the account.
A new phone number, if you send one.	So the clinic's system can fetch and store it.	When the clinic's system has confirmed that it has stored it.
Requests to book, cancel or move an appointment and to report your arrival.	So the clinic's system can process them, and so you can see whether they were processed.	The content is deleted when the clinic's system has confirmed that it has stored the request. Only the status and a technical id for the appointment the request concerns stay until you delete the account.
Your appointments (time, type and place) and the clinic's free times that you can choose from.	So you can see your appointments, book and get reminders.	Your appointments are deleted 90 days after they end, and when you delete the account. Free times are deleted once they have passed. Both happen in a daily clean-up.
Messages between you and the clinic, in both directions. Messages you send are also stored in the clinic's own system.	So you can scroll through the conversation with the clinic in the app.	When you delete the account.
Financial data: compensation overview with date, amount, status and label, and what is owed to you. The app stores no payment card or bank account.	So you can see your compensation in the app. The overview comes from the clinic's system.	When you delete the account.
Your phone's push token, if you turn reminders on.	So the server can send you reminders about appointments.	When you log out, turn reminders off, or delete the account.

Where the data is

Archolm runs the server at Hetzner Online GmbH (Germany). Hosting is therefore inside the EU and EEA, with no transfer to a third country.

Your donor data is stored permanently only in the clinic's own system. The server is an intermediary that gives the app what it needs. The clinic's system connects out to the server through an encrypted tunnel. Nothing can connect in to the clinic, neither from the server nor from the internet.

Answers, photos and phone number are deleted on receipt

Questionnaire answers, photos and a changed phone number are deleted from the server once the clinic's system has confirmed that it has stored them. This happens when the clinic's system next fetches them, not at the moment you send them. For booking requests only the status remains.

Delete your account

You can delete your account in the app under Profil, Slet konto, on the website, or by writing to info@nordicdonors.dk from the account's own email address. You get a confirmation by email when the account is deleted.

What we delete on the server

Your account with email address, password, login sessions and codes.
Your answers, photos and phone numbers that the clinic's system has not yet fetched.
Your messages, appointments, compensation overview and push tokens.
Donation appointments that you booked in the app are cancelled. Appointments that the clinic created are not cancelled. The clinic will contact you about them.

What the clinic keeps

The clinic keeps your patient record, your contact details and the records of your donations. By law the clinic must always be able to contact you. The clinic only marks your app account as deleted, and can invite you again later.

What remains right after the deletion

Deleted and overwritten versions of data are physically removed from the server's database after 2 days. The database file is compacted every night, so the remains disappear from the file at most 1 day later.
Your email address stays for at most 9 days in the server's record of the scheduled confirmation email, and the remains disappear from the file at most 1 day later.
Encrypted backups of the server keep deleted data for at most about 5 weeks. They are used only to recover after a serious failure, and after a restore every deletion is applied again.

Who receives data

Archolm's email provider in the EU sends email from system@archolm.dk: the code to confirm your email, the code to reset your password, a notice that the address already has an account if someone tries to create a new account with it, and the confirmation that the account is deleted. Emails contain no health information.
If you turn reminders on, the server sends a push notification through Expo (650 Industries, Inc., USA). Expo receives your phone's push token and the text of the notification, not your name or email address. The transfer to the USA relies on Expo being self-certified under the EU-US Data Privacy Framework (article 45).
Expo passes the notification on to iPhones through Apple's notification service, Apple Push Notification service.
Expo passes the notification on to Android phones through Google's service Firebase Cloud Messaging.
Crash reports are sent to GlitchTip, which Archolm runs itself on the same server. They contain the app version and build, the phone model, the operating system version and a technical error trace (stack trace). They are not linked to you: no email, donor number, name or IP address, and no screenshots. They are kept for 90 days.

The content of a reminder is always the same text, in Danish: “Du har en påmindelse i appen.” It contains no information about the appointment.

Logs and security

The server's access log stores a masked IP address (/24 for IPv4 and /48 for IPv6) and no request contents: no messages, answers, passwords, headers or parameters in the address. Log files are overwritten continuously, because each file has a fixed size and the oldest are deleted.

Counters that limit attempts at login, codes and deletion store a one-way hash of the email address and of the IP address for 15 minutes. After wrongly entered codes the login system also stores the address in a counter. All counters are deleted automatically, within 2 hours after they have expired at the latest.

Your rights

You can ask for access, rectification, erasure, restriction and data portability, object, and withdraw your consent. You do this towards Sellmer (info@sellmerklinik.dk), which is the controller. Archolm assists Sellmer. You can also write to Archolm at privacy@archolm.dk, and Archolm forwards your request to Sellmer. You can withdraw your consent in the app under Profil.

Crash reports and server logs are not linked to you and cannot be looked up by your name or email.

Sellmer's privacy notice and consent are shown in the app before you fill in the questionnaire, and are available on Sellmer's website.

You can complain to the Danish Data Protection Agency, Datatilsynet: datatilsynet.dk.