Privacy notice
How Ablement uses your information, including your medical records
In short
- We hold only what we need, step by step: your name, telephone number, e-mail address and the treatment you chose when you schedule a free call or chat; information about your health only after you have signed the Consent Form and given your separate consent.
- Medical records travel only through our secure upload tool, hosted in the European Union, never by e-mail, chat or telephone, and only our patient coordinators can open them at Ablement.
- The hospitals we ask see a summary of your case without your name; only the hospital named in your signed agreement ever receives your records, and your country's public health service receives only the forms you have signed.
- Every company that handles your information for us is named in the full text: the chat tool, the secure form and upload tool, the electronic signature service, the booking tool, the e-mail and customer systems and the website hosting.
- You can see, correct or delete your information and withdraw your consent at any time, and you can complain to the data protection authority in your country or to the Danish Data Protection Agency.
Full text
This notice tells you what information we hold about you, why, who sees it, how long we keep it and what your rights are. It applies to anyone who contacts us, to patients, and to a family member a patient has named. If anything is unclear, schedule a call with us and we will go through it with you.
01Who we are
Ablement ApS, Rådhusstræde 15, 1466 Copenhagen K, Denmark. Company registration number (CVR) 46802160. E-mail hello@ablement.eu. Website www.ablement.eu.
You reach us by scheduling a call on our website (by video or by telephone, at a time you choose), in the chat or through the message form on our website, by e-mail or by post.
Ablement ApS is the controller of your information: we decide how it is used and we are responsible for it under the General Data Protection Regulation (Regulation (EU) 2016/679). We are a private company registered in Denmark. We are not part of the public health service in your country. For any question about your information, write to us at the e-mail or postal address above.
02The information we hold, step by step
Our service runs in steps, and the information we hold grows with them. Before you sign the Consent Form we hold no medical records.
| When | What we hold | Where it is held |
|---|---|---|
| You schedule a call, chat with us or send us a message | Your name, e-mail address and telephone number; the treatment you need, in your own words; your message, or short notes from our call. We use your telephone number to call you at the time you booked if you chose a telephone call, if you cannot join the video call, and for text-message reminders of your booking. A family member you invite may join the call. Please do not send letters or records at this step. | Our booking tool (Cal.com), our chat (Crisp), our message form (Netlify Forms), our e-mail and documents (Google Workspace). We do not record calls. |
| You complete the Consent Form | Your answers on the form: who you are, the treatment you need and the waiting list you are on, your entitlement declaration, the practical questions, your family doctor's name, a family member you name, and a referral letter if you uploaded one. Your consents and your authority to us. | Our secure form and upload tool, hosted in the European Union. |
| We complete your file | Your referral letter, recent scans and reports, a medication list, and what you tell us about your condition. | The secure upload tool only. Never e-mail, chat or telephone. |
| We ask hospitals | A summary of your case without your name: age, procedure, relevant conditions and findings. | Sent to one to three private hospitals in the receiving country. |
| You sign the treatment proposal and agreement | Your signed agreement; then your full medical records go to the one hospital named in it. | The electronic signature service; the named hospital. |
| Before, during and after treatment | The hospital's assessment, its confirmation of dates, its pro forma and final invoices, your receipt, the discharge report, and the forms for your claim. | The secure tool; your public payer, as section 4 says. |
| Your claim | The claim pack and, if needed, your appeal; our correspondence with your payer; its decision. | Your public payer; the secure tool. |
Most of this comes from you. Some comes from the hospital, from your public payer, from a family member you have named, or from your family doctor when we ask them, or you ask them, to send something.
If a family member contacts us first. We take only the details we need to contact you. Nothing about your health is kept, and nothing is sent to a hospital, until you have completed the Consent Form yourself.
03Why we use it, and what allows us to
| What we do | What allows us to (General Data Protection Regulation) |
|---|---|
| Answer your enquiry, book your call, and tell you whether we can help | Steps taken at your request before an agreement (Article 6(1)(b)), and our legitimate interest in answering people who contact us (Article 6(1)(f)) |
| Measure how visitors use our website (Google Analytics, Contentsquare), and measure our advertisements and show them again to people who have visited our website (Google Ads) | Your consent in the cookie banner (Article 6(1)(a)). Nothing is measured before you agree, and you can change your mind at any time. |
| Check your eligibility, describe your case to hospitals, find a hospital and prepare your proposal | Your explicit consent on the Consent Form (Article 9(2)(a)) for information about your health; for the rest, steps taken at your request (Article 6(1)(b)) |
| Send your full medical records to the hospital named in your agreement | Your explicit consent given by signing the agreement (Article 9(2)(a)) |
| Ask your family doctor for your referral letter or for information about your treatment | Your authority on the Consent Form; for information about your health, your explicit consent (Article 9(2)(a)) |
| Correspond with your public payer; prepare the advance indication, the claim and any appeal, and send them where the payer allows it | Your authority on the Consent Form; our agreement with you (Article 6(1)(b)); for health information, your explicit consent (Article 9(2)(a)) |
| Deal with a family member you have named | Your permission on the Consent Form; for the family member's own details, our legitimate interest in dealing with them (Article 6(1)(f)) |
| Keep our accounts, including a record of which patients were treated and the referral fee invoiced | A legal duty under the Danish Bookkeeping Act (Article 6(1)(c)) |
| Answer complaints and deal with legal claims | Our legitimate interest (Article 6(1)(f)); for health information, Article 9(2)(f) |
| Ask you, at the end, for a review and for permission to use an anonymised story of your case | Your separate consent at that time. You can say no and nothing changes. |
We never use information about your health for advertising or measurement, we do not sell your information, and no decision about you is made by a computer alone.
04Who sees your information
The hospitals we ask. One to three private hospitals in the receiving country receive a summary of your case without your name. Only the one hospital named in your signed agreement ever receives your records. That hospital is responsible in its own right for the information it holds about you as its patient; ask it for its own privacy notice. Records we have sent stay with the hospital under its own rules even if you later withdraw. The hospital pays us a referral fee when you are treated there.
Your public payer (named in section 12), under the authority you gave us on the Consent Form: the advance indication where we send one, the claim pack and any appeal. You sign each form yourself; the payer pays only you. In Norway you also send the forms to the payer yourself (section 12).
Your family doctor, when we ask them for your referral letter or for information about your treatment, under the authority you gave us on the Consent Form.
A family member, only if you named them on the Consent Form, and only for what you allowed there.
Our professional advisers (lawyer, accountant), where that is necessary, and authorities or courts where the law requires it.
Companies that provide our tools. They may use your information only on our written instructions:
| Company | What it does for us | Where your information is kept |
|---|---|---|
| Netlify, Inc., United States | Hosts our website, receives what you write in our message form (Netlify Forms) and keeps the record of your choice in the cookie banner (without your internet address) | The record of your choice: European Union (Frankfurt, Germany); the message form: held by Netlify, which may handle it in the United States (section 6); the website itself is delivered from servers around the world (section 6) |
| Google Analytics and Google Ads (Google Ireland Limited) | Measure how visitors use our website and which of our advertisements bring them, and show our advertisements again to people who have visited our website, only if you agree | European Union and the United States (section 6) |
| Content Square SAS, France (the company behind Hotjar) | Shows how visitors use our pages, only if you agree. It never records what you type, and the text on the pages is hidden in its recordings. | European Union (Ireland) |
| Crisp IM SAS, France | Our chat, which loads only when you open it | European Union (the Netherlands); the connection may pass through servers in the United States, the United Kingdom and Singapore (section 6) |
| Cal.com | Booking your call and reminding you of it | United States (section 6) |
| Google Workspace (Google Ireland Limited) | Our e-mail, documents and calendar | European Union and the United States (section 6) |
| Tally | Our secure form (the Consent Form) | European Union |
| Hetzner Storage Share | Our secure upload tool | European Union |
| Our electronic signature service | Lets you sign your treatment proposal and agreement electronically | European Union |
05Sending us your medical records
You upload records through our secure tool, hosted in the European Union. You get a personal link; you do not need an account. Please do not share the link.
Your records are encrypted while they travel to us and while they are stored. At Ablement only our patient coordinators can open them.
Please do not send medical records by e-mail, chat, WhatsApp or telephone. If you cannot use the upload tool, write to us or tell us in your booked call, and we will agree another safe way.
We confirm each upload within one working day.
06Information sent outside the European Economic Area
Your country, the receiving country and Denmark are all in the European Economic Area, where the same data protection rules apply, so sending your records to the hospital is not a transfer outside it. Some of our suppliers may handle information outside it. Google may handle information for Google Workspace, Google Analytics and Google Ads in the United States; Google's United States company is certified under the European Union-United States Data Privacy Framework, which the European Commission has found gives adequate protection, and the Commission's standard contractual clauses apply besides. Netlify, which hosts our website, may also handle information in the United States under the same framework and clauses. Cal.com, our booking tool, stores your booking and sends its reminders from the United States under the same framework and clauses. Crisp keeps the chat in the European Union, but the connection to the chat may pass through Crisp's servers in the United States, the United Kingdom and Singapore, which keep only connection details (your internet address, the time and your browser), under the European Commission's standard contractual clauses in Crisp's data processing agreement. You can ask us for a copy of the safeguards.
07How long we keep it
| Information | How long |
|---|---|
| Your enquiry, if you never complete the Consent Form: your booking, chat, messages and call notes | Deleted 6 months after our last contact, or within 30 days of your asking. |
| Your Consent Form and anything you sent, if we find we cannot help you | Deleted within 2 working days of our telling you, as the Consent Form promises. |
| Medical records, scans, reports, the hospital's medical documents and the medical parts of your claim | Deleted 3 months after your case is closed. At closing we give you a download link to your whole file so that you keep your own copy. Your case is closed when your repayment has been received or your appeal decided, 12 months after your treatment if no claim has been made, or when you or we end the agreement. |
| Your signed Consent Form and agreement, our correspondence with you, with your payer, with the hospital, with your family doctor and with a family member you named, invoices and proof of payment, any complaint and our answer | 6 years after your case is closed, so that we can answer any later complaint or claim. Medical attachments are removed first. |
| Accounts records (which patients were treated, the fee invoiced and when) | 5 years from the end of the financial year, as the Danish Bookkeeping Act requires. |
| Website measurement (Google Analytics, Contentsquare) | Kept by Google for 14 months and by Contentsquare for 13 months at most, as set in the tools. |
| The record of your choice in the cookie banner | 3 years after the choice has expired; then deleted automatically. |
08How we keep it safe
Medical records are stored encrypted with a provider in the European Union. Access is limited to our patient coordinators, each protected by a password and a second security step. If something went wrong that put your information at risk, we would tell the data protection authority within 72 hours and, where the risk to you is high, tell you without delay.
09Your rights
You can ask us at any time, free of charge, to:
give you a copy of the information we hold about you;
correct anything that is wrong or incomplete;
delete your information, or stop or limit our use of it;
send your information to you or to someone else in a commonly used electronic form;
stop using information that we hold on the ground of our legitimate interest.
Write to us by e-mail, by post, in the chat or through the message form on our website, or tell us in a booked call. We answer within one month. We may ask you to confirm who you are first.
Withdrawing your consent. You can withdraw any consent at any time, as easily as you gave it: tell us by e-mail, by post, in the chat, through the message form or in a booked call. It does not affect what we did before. If you withdraw consent to our holding your health information, we cannot go on with your case; we stop, delete your medical records and keep only what section 7 lists.
Do you have to give us this information? No. But without it we cannot find a hospital for you or help with your claim.
10If you want to complain
Please tell us first, so that we can put it right. You also have the right to complain to a data protection authority at any time: to the authority in your country (section 12), or to Datatilsynet, the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark, telephone +45 33 19 32 00, www.datatilsynet.dk. We are established only in Denmark, so Datatilsynet in Denmark is the lead authority for what we do with your information. A complaint you make to the authority in your own country can be passed on to it, and your own authority keeps you informed.
11Our website
Our website has one cookie banner, shown in the language of the section you are in, and a cookie policy for each section. Cookies and tools that are not needed for the site to work run only if you agree: Google Analytics and Contentsquare, which show us how visitors use the site, and Google Ads, which tell us which of our advertisements bring people to us and let us show our advertisements again to people who have visited our website. The advertising tools never run on our pages about individual treatments, and on those pages Google Analytics runs with Google's advertising signals switched off. The company behind each advertising tool also uses this information for its own purposes, for which it is responsible in its own right under its own privacy policy. We keep your choice for 6 months, and we keep a record of it, without your internet address, as proof until 3 years after the choice has expired. When you open ablement.eu, our hosting provider, Netlify, reads your country from your internet address so that we can send you to the section for your country, where we have one. Nothing is stored. If you choose a section in the country menu, a cookie keeps your choice for 12 months (cookie policy, section 3). The chat loads only when you open it; you can always schedule a call or write to us through the message form instead. You can change your choice at any time under "Cookie settings" at the foot of every page.
12Your country
Ireland
Your public payer: the Health Service Executive.
How to reach us: schedule a call at ablement.eu/en-ie/, use the chat or the message form there, e-mail hello@ablement.eu, or write to us at the address in section 1.
Data protection authority: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963; telephone (01) 765 0100 or 1800 437 737; www.dataprotection.ie
Sweden
Your public payer: Försäkringskassan.
How to reach us: schedule a call at ablement.eu/sv-se/, use the chat or the message form there, e-mail hello@ablement.eu, or write to us at the address in section 1.
Data protection authority: Integritetsskyddsmyndigheten (the Swedish Authority for Privacy Protection), Box 8114, 104 20 Stockholm; telephone 08-657 61 00; imy@imy.se; www.imy.se. Complaints are easiest through the authority's e-service on its website.
Norway
Your public payer: Helfo. You sign and send the forms to Helfo yourself; we prepare them with you.
Data protection rules: Norway is not in the European Union but is in the European Economic Area. The General Data Protection Regulation applies in Norway through the Personal Data Act (personopplysningsloven), and you have the same rights as everywhere else in the area.
How to reach us: schedule a call at ablement.eu/nb-no/, use the chat or the message form there, e-mail hello@ablement.eu, or write to us at the address in section 1.
Data protection authority: Datatilsynet (the Norwegian Data Protection Authority), Postboks 458 Sentrum, 0105 Oslo; telephone 22 39 69 00; postkasse@datatilsynet.no; www.datatilsynet.no. Complaints go through the authority's online form, which needs BankID, or by post. The Norwegian and the Danish authorities are both called Datatilsynet.
Another country in the European Economic Area
Your public payer: the public body in your country that repays care received abroad. We name it in your proposal.
How to reach us: schedule a call at ablement.eu, use the chat or the message form there, e-mail hello@ablement.eu, or write to us at the address in section 1.
Data protection authority: the data protection authority in your country. The European Data Protection Board lists them all at www.edpb.europa.eu.
13Changes to this notice
If we change this notice in a way that matters to you, we tell you before the change takes effect. The date and version are at the foot of each page.
Privacy notice, version 7, 9 November 2026.