Privacy when using helsedata.no and application for access to data

Personal data is any information that can be linked to you as an individual, either directly or indirectly. This can be your name, date of birth, email or address. Processing of personal data may, for example, be the collecting, storage, registration or disclosure of personal data.

In order for you to be able to safeguard your rights within data protection and privacy legislation, it is important that you know what kind of personal data is processed and how this is done:

• when you apply for access to health data
• when you visit helsedata.no

Privacy when searching for access to health data

This privacy statement provides information on how the Norwegian Directorate of Health, the National Institute of Public Health and the Norwegian Cancer Registry (data custodians) process personal data about you when processing applications for access to health data.

Responsibility for the processing

The data custodian (the Norwegian Directorate of Health, the Norwegian Institute of Public Health or the Norwegian Cancer Registry) is responsible for processing your application. The register container is also responsible for processing personal data in the application process. The data controller decides the purpose behind the processing of data and which means are to be used.

Data processors

The Norwegian Directorate for e-Health is the data processor for the processing of personal data in the case processing system and for the processing of personal data through the use of helsedata.no. Separate agreements between the register administrators and the Norwegian Directorate for e-Health regulate which personal data the Norwegian Directorate for e-Health shall process and how the processing of personal data shall be carried out.

The Norwegian Health Network (NHN) is a sub-data processor and delivers operation and maintenance of helsedata.no. Unless otherwise stated, the information collected will be stored on servers operated by the Norwegian Health Network. An agreement has been entered into between the Norwegian Directorate for e-Health and NHN, which regulates which personal data NHN is to process, and how the processing is to be carried out.

Creating a user account on helsedata.no

When you log in for the first time on helsedata.no, a user account is created for you. Login takes place via the HealthID/ID port and is necessary for you to be able to apply for access to health data from the health registries that are connected to helsedata.no. The following information will be registered and stored in your user account at helsedata.no:

• Name
• Phone number/mobile number
• Email address
  
  

The purpose of the registration is to enable you to apply for access to health data from the registries, and to give you access to services on helsedata.no. For example, you can get an overview of the status and processing time for your applications regarding access to health data. The user account, with the personal information entered there, is maintained and processed until you request that the account be deleted. If you want access / change / deletion in the user account, please contact service@helsedata.no.

Creation and submission of application forms

When you are logged in to helsedata.no, you can use an application form to apply for access to health data from the registries. When filling in the application form, the following information will be registered:

• Name
• Phone number/mobile number
• Email address
• Invoice/postal address
• Organizational affiliation, including organization name and number, your position and the organization's address
• Any information provided in the free text field in the application form
• Any information that is uploaded as part of the attachment
• In addition, personal data about other project staff can be processed, as well as other people/employees who participate in the application process
• Personal data related to a project manager's CV can be processed in certain cases, including project manager for applications for health examinations

We encourage you not to enter sensitive personal data (special categories of personal information) in the application form. If you enter information about anyone other than yourself in the form, we recommend that you inform the person in advance and refer to this privacy statement.

Case processing

After the application has been completed and submitted via helsedata.no, the application will first be sent to Helsedataservice, which is an organizational unit in the Norwegian Directorate for e-Health.

Helsedataservice registers information related to your project and forwards your application to the data custodians (the Norwegian Directorate of Health, the Norwegian Institute of Public Health or the Norwegian Cancer Registry). The data custodians will process the application and decide on access to health data.

In connection with the case processing, in addition to the information provided in the application form, any personal data provided in email correspondence between the applicant and Helsedataservice/data custodians will also be processed. Name, email address and organizational affiliation will be included in an ongoing overview of applications received.

The purpose of the treatment is:

• to decide on applications for access to health data
• ensure that applications have sufficient information
• coordinate the cooperation between different stakeholders during the case processing
• provide guidance to applicants on the application process, data sources and analysis services
  
  

The legal basis for the processing of personal data in connection a user account on helsedata.no, submission of application forms and case processing is the GDPR Article 6 paragraph 1 (e) (the processing is necessary to perform a task in the public interest or exercise public authority as the data controller are required).

Supplementary legal basis in accordance with GDPR article 6 paragraph 3 is the Norwegian Health Register Act paragraph 8-11 and relevant regulations for the individual health register.

Support / technical support

If you have questions about the application process or need technical support. The following personal data about you may be processed:

• Name
• Phone number / mobile number
• Email address

The personal data is compiled with information about what the enquiry is about and when the enquiry was received.

Based on enquiries received from applicants, anonymous statistics are compiled. Such statistics are processed to provide good customer service and to improve the processing of applications.

User survey

Once your application has been submitted, you will have the opportunity to participate in a user survey with questions related to your experience of the application process. By participating in the user survey, you agree that the following personal data about you is processed:

• Name
• Email address

The purpose of the processing is to develop and improve the processing of applications for access to health data. The legal basis is the Privacy Regulation (GDPR) art. 6 paragraph 1 (a) (the data subject has consent to the processing of his personal data).

You can withdraw your consent at any time by contacting service@helsedata.no or not responding to the user survey.

You get the opportunity to register your email address in the user survey if you want to contribute with further input. This is voluntary, and it is possible to answer the user survey without giving the email address in the survey.

How long do we store personal data?

The information collected about you in connection with your user account on helsedata.no, application processing and support, is stored for as long as is necessary to deliver the service on helsedata.no and as long as it is necessary for the case processing. The information collected in connection with the user survey will be processed for as long as is necessary to develop and improve the processing of applications for access to health data. The information will be deleted when it is no longer necessary for the purpose for which it was collected, unless further storage of the information is required by law, including the Norwegian Archives Act.

If you have created a user account on helsedata.no, the user account and the personal data entered there will be maintained and stored until you request that the account be deleted.

How we protect your information

You should be confident that your personal data is safe and secure. A number of measures have been implemented to protect your personal data against unauthorized access, alteration or destruction. This includes:

• Encryption of communication to and from the services.
• Restriction of access to personal data for employees, data processors and subcontractors who are to process the information.
• Comprehensive physical, technical and organizational measures to secure the information in the best possible way.
  
  

Your rights

If you want further information about how we process personal data, you can contact us by using the contact information you find here.

As a user, you have the right to access which personal data is processed about you in connection with the case processing and your use of helsedata.no. You can demand that information about you that is incorrect or incomplete is corrected. You may also, in certain situations, require the erasure of information about yourself.

In some cases, you may require restriction of processing. This means that your personal data cannot be used for one or more purposes. Furthermore, you have the right to object to the processing in some cases, so that we can no longer use your personal data. You also have the right to data portability, which means that you can request that your personal data will be transferred to you or to another company in a structured, commonly used and machine-readable format.

You can complain about the processing of personal data to the Norwegian Data Protection Authority, see contact information below. We ask you to contact us before you complain to the Norwegian Data Protection Authority.

Contact information to exercise your rights

Use the contact information below if you wish to contact us regarding the processing of personal data about you in connection with the processing of applications. We remind you that you should never send health data or other sensitive personal data (special categories of personal data) by email.

Access, correction and deletion

To get help with accessing, correcting or deleting personal data, or to exercise other rights as a data subject, you must send an email to service@helsedata.no.

Contact information data controller

You can use the contact information below to get in touch with the registry administrator who is responsible for processing your application.

If you are in doubt about which registry administrator is responsible for processing your application, you can contact service@helsedata.no. You can also get more information about the processing of your personal data, as well as help to exercise your rights as a data subject.

Norwegian Directorate of Health
Email: helseregistre@helsedir.no
Organization number: 983 544 622

National Institute of Public Health
Email: datatilgang@fhi.no
Organization number: 983 744 516

Norwegian Cancer Registry
Email: datautlevering@kreftregisteret.no
Organization number: 993 467 049

Support/technical support

If you need help with logging in, using helsedata.no or want to report technical errors on the site, you must send an email to Helsedataservice to get help with logging in, using helsedata.no or report technical errors on the page.

Email: service@helsedata.no
Organization number: 915933149

The Norwegian Data Protection Authority

You have the right to complain about the processing of personal data to the Norwegian Data Protection Authority. The Norwegian Data Protection Authority is the supervisory authority for the processing of personal data and ensures compliance with the laws and regulations that apply to the processing of personal data.

Phone 22 39 69 00
Email: postkasse@datatilsynet.no
number: 974 761 467
Website: datatilsynet.no

Privacy when visiting helsedata.no

When you visit helsedata.no, the Norwegian Directorate for e-Health will process personal data about you. Below you will find more information about this processing.

Responsibility for the processing

The Norwegian Directorate for e-Health is responsible for processing personal data related to the operation of helsedata.no. To be responsible for processing means to be responsible for the processing of personal data, to determine the purpose of the processing and to decide which tools are used in the processing.

When applying for access to health data, the relevant data custodians are responsible for processing personal data.

Data processor

The Norwegian Health Network (NHN) is a data processor for the Norwegian Directorate for e-Health and operates and maintains the website. Unless otherwise stated, the information collected will be stored on servers operated by the Norwegian Health Network. A separate agreement between the Norwegian Directorate for e-Health and NHN regulates what information NHN has access to and how the processing of personal data is to be carried out.

Analysis and statistics

When you use helsedata.no, online statistics are collected through the use of cookies. Read more about the use of cookies on helsedata.no here.

When you contact us

If you contact the Norwegian Directorate for e-Health using the contact information provided on this website, we will process your contact information (for example email address or phone number) and any other personal information that you provide to us in this connection.

We will process this information in order to respond to your enquiry. The legal basis for such processing is the GDPR Article 6 paragraph 1 (e) (the processing is necessary to perform a task in the public interest or exercise public authority as imposed on the data controller).

Unless there is a legal obligation to store your personal data for a longer period of time, we will delete your personal data when it is no longer necessary for the purpose for which it was collected.

How we protect your information

You should be confident that your data is safe and secured. A number of measures have been implemented to protect your personal data against unauthorized access, alteration or destruction. This includes:

• We encrypt the communication to and from our services.
• We restrict access to personal data for our employees, data processors and subcontractors who are to process this information on our behalf.
• We have implemented comprehensive physical, technical and organizational measures to secure the information in the best possible way.

Your rights

This privacy statement provides information on how the Norwegian Directorate for e-Health processes personal data related to the operation of helsedata.no. If you want further information, you can contact us by using this contact information.

As a user, you have the right to access which personal data we process about you. You have the right to request that information about you is corrected if the information is incorrect or incomplete. You may also, in certain situations, require the erasure of information about you.

In some cases, you can demand a restriction of processing. This means that your personal data cannot be used for the purposes in question. Furthermore, you may in some cases object to the processing of personal data, so that we can no longer use your personal data. You have an additional right to data portability, which means that you can request that your personal data is transferred to you or to another company in a structured, commonly used and machine-readable format.

You can complain about our processing of personal data to the Norwegian Data Protection Authority, see contact information below. We ask you to contact us before you complain to the Norwegian Data Protection Authority.

Contact information to exercise your rights

Below you will find contact information so you can contact us if needed. We remind you that you should never send health information or other sensitive personal information by email.

Access, correction and deletion

Send an email to Helsedataservice to get help with accessing, correcting or deleting personal information on helsedata.no and at Helsedataservice.

Email: service@helsedata.no
Organization number: 915933149

Support / technical support

Send an email to Helsedataservice to get help with logging in, using helsedata.no or reporting technical errors on the site.

Email: service@helsedata.no
Organization number: 915933149

Privacy official in the Norwegian Directorate for e-Health

If you have questions related to the processing of your personal data in our solutions, you can contact the Norwegian Directorate for e-Health:

Telephone number: 21 49 50 70
Email: security@ehelse.no
Organization number: 915933149

The Norwegian Data Protection Authority

You have the right to complain about our processing of personal data to the Norwegian Data Protection Authority. The Norwegian Data Protection Authority is the supervisory authority for the processing of personal data and checks that laws and regulations that apply to the processing of personal data are complied with.

Phone 22 39 69 00
Email: postkasse@datatilsynet.no
number: 974 761 467
Website: datatilsynet.no