1. Data Controller

The data controller is:

Behandlingscenter Den Lille Prins v/Davor Mucić

Havneholmen 82, 5th floor, right

1561 Copenhagen V

Denmark

CVR no.: 25320603

Telephone: +45 26 24 32 74

Email: denlilleprins@proton.me

Website: www.denlilleprins.org

2. What Personal Data Do We Process?

Depending on your contact with the clinic, we may process the following information:

• Name, telephone number, email address and other contact details.
• Information you provide through the contact form or in other enquiries.
• Identification information, including your Danish civil registration number (CPR number), where necessary in connection with patient care.
• Health information, previous medical history, diagnoses, treatment information, medication details and other relevant medical record information.
• Information necessary for invoicing and payment.
• Technical information when you visit the website, such as your IP address and information about your browser and device.

Health information is handled with particular confidentiality.

3. Purposes of Processing

We process personal data in order to:

• Respond to enquiries and arrange consultations.
• Carry out psychiatric examinations, assessments and treatment.
• Document patient care and maintain medical records in accordance with applicable legislation.
• Prescribe medication and follow up on medical treatment.
• Prepare medical certificates and other relevant healthcare documentation.
• Communicate with patients and relevant healthcare professionals.
• Administer payments and comply with accounting obligations.
• Ensure the functionality and technical security of the website.

We do not use patient information for marketing without a separate lawful basis.

4. Legal Basis for Processing Personal Data

We process ordinary personal data under the relevant provisions of Article 6 of the GDPR, including where processing is necessary for the performance of a contract, compliance with a legal obligation or the pursuit of a legitimate interest.

We process health information as part of healthcare assessment and treatment under Article 9(2)(h) of the GDPR and relevant Danish healthcare legislation.

Where consent is required, we obtain it in accordance with applicable rules.

5. Medical Records and Retention

As a specialist medical clinic, The Little Prince Treatment Centre is required to maintain and retain patient medical records.

As a general rule, medical records are retained for at least 10 years from the most recent entry, in accordance with applicable regulations.

Information is not deleted where the clinic remains legally obliged to retain it.

Accounting records are generally retained for five years after the end of the financial year to which they relate.

Other personal data is retained only for as long as necessary for the purpose for which it was collected, or for as long as required by applicable law.

6. Confidentiality and Data Security

We protect personal data through appropriate technical and organisational security measures.

Access to patient information is restricted to persons who have a legitimate and necessary need for the information.

Medical records and other confidential information are stored in accordance with applicable requirements for data security, access protection and confidentiality.

We use appropriate security measures for electronic communication and the storage of personal data.

7. Contact Form and Electronic Communication

When you use the contact form on our website, we process the information you enter in order to respond to your enquiry.

We recommend that you do not include your CPR number, diagnoses, detailed health information or other sensitive personal data in the contact form.

If medical records or other confidential information need to be sent, this must be done using a communication method specified by the clinic for that purpose.

The contact form is not intended for urgent enquiries.

8. Telepsychiatry and Digital Communication

Where appropriate, the clinic offers psychiatric assessment and treatment via video consultation.

For telepsychiatry, we use digital communication solutions with due regard for confidentiality and personal data protection requirements.

Personal data from video consultations is processed according to the same fundamental rules as data from in-person consultations.

Relevant information from the consultation is documented in the patient's medical record.

9. Disclosure of Information

Personal data is disclosed only where there is a lawful basis for doing so.

For example, it may be necessary to share relevant information with other healthcare professionals, pharmacies or public authorities as part of treatment or to comply with statutory obligations.

Disclosure of health information takes place in accordance with healthcare legislation governing professional confidentiality, consent and disclosure.

The clinic may use external service providers for its website, IT operations, communications and administration. Where providers process personal data on behalf of the clinic, the necessary legal basis and data protection arrangements must be in place.

Patient information is not sold to third parties.

10. Website and Cookies

The website may use cookies and similar technologies for technical functionality and security.

Certain features, such as map displays and contact form protection, may involve external services that process technical information.

If cookies or other technologies requiring consent are used, visitors must be provided with the necessary information and an opportunity to make a choice about their use.

Any processing or transfer of personal data outside the EU/EEA must take place on a valid legal basis under data protection law.

11. Your Rights

Under data protection law, you have a number of rights, depending on the circumstances, including:

• The right to access the personal data we process about you.
• The right to have inaccurate information corrected.
• The right to erasure where the relevant conditions are met.
• The right to restriction of processing.
• The right to object to certain types of processing.
• The right to withdraw any consent you have given.

The right to erasure is not unlimited. For example, information in medical records cannot simply be deleted where statutory record-keeping and retention obligations apply.

If you wish to access your medical record or have questions about the processing of your personal data, you can contact the clinic.

12. Complaints to the Danish Data Protection Agency

If you believe your personal data is being processed in breach of data protection rules, you are welcome to contact us first.

You also have the right to lodge a complaint with:

Datatilsynet (Danish Data Protection Agency)

www.datatilsynet.dk

13. Changes to This Privacy Policy

We may update this Privacy Policy if our processing of personal data changes or if changes in legislation make an update necessary.

The latest version will be available at www.denlilleprins.org.

Last updated: 25 October 2026