Last updated January 19, 2023
TkMidt processes personal data as part of our operations. We are committed to protecting the privacy of patients, employees, job applicants, course participants, partners, research participants, and other individuals we come into contact with through our work.
This privacy policy describes how TkMidt processes personal data, what rights you have, and how you can contact us if you have questions about our processing of personal data
Kompetansesentret Tannhelse Midt Trøndelag FKF (TkMidt) is the data controller for the personal data processed in our operations.
Contact information
TkMidt
Professor Brochs gate 2, 7030 Trondheim
Phone: 941 33 180
Email: post@tkmidt.no
Privacy-related inquiries can be sent to:
Data Protection Officer / Privacy Contact
Hanne Moe Reitan: personvernombudet@trondelagfylke.no
Depending on the purpose, we may process:
We never process more information than is necessary to fulfill the purpose.
We process personal data to:
The processing of personal data in connection with patient care is based on Article 6(1)(c) and/or (e) of the GDPR, cf. relevant health legislation. The processing of health data is based on Article 9(2)(h), cf. Article 9(3), the Patient Records Act, the Health Personnel Act, and the Patient Records Regulations. The processing is necessary to provide, administer, and document appropriate healthcare.
We process personal data to:
Processing of personal data as part of personnel administration is based on Article 6(1)(b) and (c) of the GDPR and, where relevant, points (e) or (f). The processing is necessary to manage the employment relationship, fulfill the employment contract, and comply with the employer's statutory obligations. Special categories of personal data, including health information, are processed when necessary to fulfill obligations and exercise rights in the field of employment and social security law, cf. Article 9(2)(b) and Section 6 of the Personal Data Act.
For hiring purposes, we may process:
Information is deleted or anonymized when it is no longer necessary, unless legislation requires its retention.
Processing of personal data in connection with recruitment is based on Article 6(1)(b) of the GDPR and, where relevant, points (c), (e), or (f). The processing is necessary to receive and evaluate applications, conduct interviews, obtain agreed-upon references, document the recruitment process, and enter into an employment contract. Special categories of personal data are processed only when necessary and permitted under Article 9(2), including point (b), cf. Section 6 of the Personal Data Act. Information regarding criminal convictions and offenses is processed only when the conditions in Article 10 and relevant national legislation are met.
TkMidt participates in research and development projects.
Where applicable, personal data will be processed on the basis of:
Processing of personal data for research purposes is based on Article 6(1) of the GDPR, including points (a), (c), or (e), depending on the nature of the project and its legal basis. Health data and other special categories of personal data are processed based on Article 9(2), particularly point (j), with the necessary safeguards under Article 89(1), cf. the Norwegian Personal Data Act sections 8–10 and, where relevant, the Health Research Act. Processing for professional and quality development is assessed individually and may be based on Article 6(1)(c) or (e) and Article 9(2)(h) or (i). The legal basis for processing is determined and documented for each individual project.
We may process personal data to:
Processing of personal data in connection with courses, training, and events is based on Article 6(1)(b) of the GDPR and, where relevant, points (c) or (e). Processing is necessary to manage registrations, conduct events, communicate with participants, handle payments, and issue course certificates. For certain voluntary purposes, such as publishing identifiable photos or sending marketing materials, processing may be based on consent under Article 6(1)(a). Any special categories of personal data are processed only when there is a valid basis under Article 9(2).
We process personal data to:
Processing of personal data in connection with operations and information security is based on Article 6(1)(c) or (e) of the GDPR, depending on the specific processing activity and the supplementary legal basis. For processing that is not part of the exercise of public authority, Article 6(1)(f) may be used when necessary for a legitimate interest, provided that these interests are weighed against the rights of the data subject. Processing may include access management, operational, login, and security logs, prevention of misuse, troubleshooting, and handling of security incidents. Data is secured in accordance with the principles of integrity and confidentiality under Article 5(1)(f) and the requirements of Articles 24, 25, and 32. Logs are not stored longer than necessary for the documented security purpose.
Personal data may be collected:
TkMidt only shares personal data when necessary and lawful.
Recipients may include:
All data processors are subject to data processing agreements that regulate security and privacy. We do not sell personal data.
Personal data is not stored longer than necessary.
Retention periods are determined by:
When the obligation to store data ceases, the information is deleted or anonymized in a secure manner.
Patient record information is kept for as long as necessary for the provision, documentation, and verification of healthcare, and otherwise in accordance with health and archival legislation. Information is not deleted or transferred in violation of statutory retention requirements. Research data is kept for as long as necessary for the individual project and in accordance with the approved research protocol, decisions from REK (Regional Committees for Medical and Health Research Ethics), and other relevant regulations. Documentation necessary for follow-up control may be kept for five years after the final report, or longer if required by REK or other legislation. Thereafter, the information is deleted, anonymized, or archived according to applicable rules.
Legal sources: the Medical Records Regulations, the Health Personnel Act, the Patient Records Act, the Health Research Act Section 38, GDPR Article 5(1)(e), and archival regulations.
Personal data processed in connection with recruitment is stored until the hiring process and any appeal or objection processes have concluded, and is then deleted or anonymized unless further retention is necessary under archival regulations, to document or defend legal claims, or if the data subject has consented to retention for future positions. For those hired, necessary information is transferred to the personnel file and kept for as long as it is necessary for the employment relationship or required by statutory documentation and archival requirements.
TkMidt works systematically with information security.
We implement, among other things:
All employees are obligated to treat personal data confidentially.
You have the right to:
As a patient, you have the right to access your own medical records and to receive a copy and a simple explanation of technical terms. You may request that incorrect or incomplete information be corrected, and in special cases, that record entries be deleted. You can also obtain information about who has accessed your data and object to sharing when permitted by law. Certain rights may be limited for the sake of providing proper healthcare, protecting other individuals, and complying with mandatory documentation requirements.
Information about you should be easy to find and understand.
Link to the Norwegian Data Protection Authority regarding information
Know what personal data we process about you.
Link to the Norwegian Data Protection Authority regarding access
Have incorrect information corrected.
Link to the Norwegian Data Protection Authority regarding rectification
You can request to have personal data about you deleted.
Link to the Norwegian Data Protection Authority regarding erasure
Request restriction of processing in certain situations.
Link to the Norwegian Data Protection Authority regarding restriction
Object to processing where the law permits it.
Link to the Norwegian Data Protection Authority regarding objection
Receive information you have provided yourself in a structured format when the conditions are met.
Link to the Norwegian Data Protection Authority regarding data portability
If you believe your privacy rights have been violated, you should first contact TkMidt or TkMidt's Data Protection Officer before contacting the Norwegian Data Protection Authority (Datatilsynet). A Data Protection Officer is a contact person for questions regarding the processing of personal data and the rights you have under data protection regulations. Often, this will be sufficient to resolve the matter.
TkMidt may use cookies and similar technology on our websites to:
Further information is provided in the organization's cookie policy, which is available on TkMidt's website.
If personal data is processed outside the EEA, this shall be done in accordance with applicable privacy legislation and with necessary security mechanisms.
TkMidt may use digital analysis tools, automated systems, and artificial intelligence to support its operations. When such solutions process personal data, the following must be ensured:
Automated solutions shall not be used in a way that undermines the rights or legal protections of individuals. TkMidt uses artificial intelligence only as a support tool, not for making automated decisions.
TkMidt may update this statement as needed.
The current version is published on TkMidt's website.
Contact us regarding privacy questions
TkMidt
Hanne Moe Reitan
personvernombudet@trondelagfylke.no
Tel: 408 72 380
TkMidt's processing of personal data shall be conducted in accordance with applicable national and European regulations. This includes, but is not limited to, the General Data Protection Regulation (GDPR), the Personal Data Act, the Patient Records Act and Medical Records Regulations, other relevant health legislation, the Health Research Act, archival regulations, and national guidelines from relevant authorities. When using artificial intelligence and digital tools, applicable EU regulations and national recommendations shall also be followed where relevant.
GDPR
Patient Records Act
Medical Records Regulations
Health Research Act
Archives Act
EU AI Act