Terms of use for Helsenorge - processing of personal data

Helsenorge processes personal data in a secure manner and in accordance with the Norwegian Personal Data Act. The information on this page explains what this means in further detail.

kvinne innlogget i min helse — Illustration: Håvard Bøhm

If you want to use the services for which you have logged in at Helsenorge, we require your consent in order to process your personal data.

Consent for the processing of personal data at Helsenorge has been split into different levels. This means that you can choose to consent to a few, more or all services at Helsenorge. You can read more about the different levels of consent here.

The information on this page explains how we process your personal data. Processing will vary depending on the services you want to use and the consent you have given.

The full terms of use of Helsenorge services can be found here (PDF).

Personal data refers to information and assessments that may be linked to you as an individual, e.g. national ID number, IP address, address and your prescriptions. Processing of personal data may refer to collection, storage, registration or disclosure of such data.

Data controller and data processor

The data controller is the party that determines the purpose of the processing of personal data, as well as which tools are to be used.
Norsk helsenett is the data controller for information about you in connection with your use of Helsenorge and its services.

With regard to external services that are available via Helsenorge, the various different service providers will be the data controllers for their respective services. Information about the data controller must be available when the different services are used.

The data processor is the party that processes personal data on behalf of a data controller.

Norsk helsenett (NHN) is the data processor and undertakes the technical operation and maintenance of Helsenorge.

The data that we process

When you log in for the first time, your profile will be created before you can access the services.

The following personal data will be stored in your profile at Helsenorge:

Your national ID number or D number.
Your name, gender, address and information about your parental responsibilities.
The consent you have provided, as well as other settings that govern your use of the services at Helsenorge.
Information you choose to register, such as the setting up of text message notifications, opt-outs and authorisations.
Information about the time of login and the services you use or that other people use on your behalf, but no details of the actual use.

Our processing of your personal data will also vary depending on the type of

consent you have provided.

We store consent and opt-out statuses in situations where we manage consent and opt-out preferences on behalf of external parties.

The data in your profile will be stored for as long as necessary to provide you with the services to which you have access. If you withdraw your consent for the services at Helsenorge, your data will be erased after 30 days. Usage logs are stored for up to two years.

Display

The display services at Helsenorge process health data by presenting you with health information from health enterprises with which you have been in contact.

Data is retrieved from:

The Norwegian National Population Register (name, address, family relations, as well as next-of-kin status and parental responsibility)
The contact and opt-out register (telephone number and e-mail address) of the Norwegian Agency for Public Management and eGovernment
The GP Register
Prescription Intermediary
Summary care record
Other registers with which you have been in contact

Disclosure

Your national ID number may be disclosed in certain cases, as such personal data is necessary in order to identify you in connection with your use of the services. This applies, for example, to the use of video consultations, dialogue services and the mailbox function.

Your national ID number is also stored in technical logs to enable troubleshooting and error rectification in the services. Your national ID number will not be passed on, disclosed or used for any other purpose.

Your privacy settings, such as information about powers of attorney (authorisations) and whether you have consented to or opted out from using certain services, may be disclosed to external parties if the settings also apply to such external parties.

Other personal data is not disclosed.

Anonymous data on service usage

In order to understand usage patterns at Helsenorge, we collect usage data, such as:

Web browser and browser settings
Operating system
Screen resolution and number of colours
Internet connection
Pages visited at Helsenorge and time of the visit
Which page you arrive at Helsenorge from

This data is made anonymous so that it cannot be linked back to you. Statistics are used to quality assure and improve the services.

Data retention

Some of the services at Helsenorge are display services for which we retrieve data from other sources when you log in. Such personal data is not stored at Helsenorge. We also store your data for as long as you use Helsenorge and for as long as is necessary for the purpose for which the data was collected.

Confidentiality

Norsk helsenett employees are subject to a duty of confidentiality.

Employees have access to your personal data only when necessary for the secure operation of the services and in cases where you request assistance from our employees with the use of the services.

How we protect your data

You can rest assured that your data is secured properly. We have implemented a number of security measures to protect the personal data we process against unauthorised access, alteration and destruction.

This includes that we:

encrypt communication to and from our services.
restrict access to personal data for our employees, as well as data processors and subcontractors that process such data on our behalf.
have implemented extensive physical, technical and organisational measures to secure data in the best possible way.

Your rights

Consent may be withdrawn at any time. If you withdraw your consent to the processing of personal data when you use the services at Helsenorge, you will still have access to all content at Helsenorge which does not require login.

As a user, you have the right of access to the personal data we process concerning you, as well as the data we have processed about you in connection with your use of Helsenorge. You also have a right of access to information about the security measures we apply to safeguard your privacy, for as long as such access can be given without reducing the security of our solutions.

You can request the rectification of any data relating to you that is incorrect or incomplete. You can also request erasure of data if you believe that the data is unnecessary for the purpose in question. For rectification and erasure of data in external services that you access via Helsenorge, you will need to contact the enterprise that provides the service, e.g. the Norwegian Tax

Administration concerning data from the Norwegian National Population Regard (such as your address or family relations).