Retention and rights

Document ID: O-08
Version and date: 2026-08-21.1 - 21 August 2026
Provider: FlowDule ApS, CVR 46273397
Contact: privacy@flowdule.com

Important: There is no single lawful retention period that applies to all of FlowDule’s customers. The customer selects a documented profile based on country, profession, authorisation, treatment, data category and purpose. FlowDule does not determine the customer’s professional or legal retention obligation.

1. Roles and responsibilities

The customer - the practitioner or the clinic - is the controller for its own clients, bookings, records, documents and professional purposes. The customer therefore decides:

• why the information is processed;

• which legal basis is used;

• which information is necessary;

• how long it is to be retained;

• how access, rectification, erasure and other rights are determined;

• whether a specific statutory obligation, complaint, dispute or other documented ground requires continued retention.

FlowDule is the processor for this information. We make configuration, export, restriction and erasure features available and act on the customer’s documented instructions in the Data Processing Agreement and the customer annex.

FlowDule is itself the controller for its own contractual, invoicing, support and security purposes. The periods and rights for that processing are described in the Privacy Policy.

2. The customer’s professional profile

Before any real client or record information may be processed, the customer must select and document the correct profile.

The title “psychotherapist” does not in itself document a healthcare authorisation. Similarly, a psychologist’s actual authorisation status must be verified; transitional rules may mean that a person can use the title of psychologist until the end of 2028 without being covered by the new authorisation.

Membership of a professional association, insurance terms, contractual requirements or a professional recommendation may influence the customer’s choice, but must not be presented as law unless it is in fact a binding statutory requirement.

3. The psychotherapist profile

For a self-employed psychotherapist who is not an authorised healthcare professional, the customer must document a specific period or a clear erasure criterion for each relevant category.

The assessment should as a minimum cover:

• why the record or the note is necessary;

• for how long the information is relevant to a current or foreseeable client course of treatment;

• the need to document an agreement, a professional effort or a legal claim;

• the sensitivity of the information and the consequences of long retention;

• whether less intrusive documentation or earlier erasure is possible;

• any documented requirements arising from an agreement, insurance or professional association;

• the starting point of the period, for example a completed course of treatment or the most recent relevant note.

FlowDule does not recommend an arbitrary standard period as a substitute for the assessment. The customer must be able to explain the period in its privacy text and apply it consistently in the system.

4. Authorised healthcare professionals

For an authorised healthcare professional, the relevant minimum period under the applicable record keeping rules applies. The period normally runs from the most recent entry in the patient record.

Patient records that are relevant to an ongoing complaint, supervisory or compensation case must continue to be retained while the case is pending, even if the ordinary minimum period has expired. Public treatment sites may in addition be subject to archiving rules.

The expiry of a health law minimum period does not automatically mean that the record must be kept for longer. The customer must then assess whether another lawful and necessary basis still exists. If not, the information must be erased.

On cessation, transfer, death or bankruptcy, special rules on transfer and continued retention may apply. The customer must have a local cessation plan; FlowDule is not the authority or professional successor that takes over responsibility for the records.

5. Data categories and starting points

The customer’s retention profile must as a minimum cover the following, where the category is used:

A single “erase everything after X years” rule is defensible only if all the categories covered actually share the same purpose, starting point and legal requirements.

6. Rectification and record integrity

Incorrect master and contact details must be capable of being rectified. A rectification must not make it impossible to document relevant earlier actions where the history remains necessary and lawful.

For patient records covered by the authorisation rules, original record information may not be erased or made illegible as an ordinary rectification. Rectifications and additions must be traceable, so that the original version can still be identified in accordance with the applicable requirements.

For a non-authorised psychotherapist, the need for version history depends on the customer’s documented purpose and responsibility. FlowDule must not retain all historical versions permanently without reason.

7. The rights of the data subject

Subject to the conditions in the GDPR, the data subject may have the right to:

• information about the processing;

• access and a copy;

• rectification;

• erasure;

• restriction of processing;

• data portability;

• object;

• withdraw consent, where the processing is based on consent;

• not to be subject to certain decisions based solely on automated processing.

The rights are not absolute. A request for erasure may, for example, be limited by a statutory record retention period, a pending case, the rights of others or a necessary legal claim. The customer must document the specific limitation and explain it to the data subject.

8. How to make a request

If you are a client or a patient, you should contact the practitioner or clinic that created the information. The customer’s name and contact details must appear in the local privacy information in the booking or client interface.

FlowDule does not itself answer the customer’s clients on the customer’s behalf without a documented instruction. We assist the customer with searching, export, rectification, restriction and erasure where necessary.

If the request concerns FlowDule’s own account, support or agreement information, you may write to privacy@flowdule.com. Further information is available in the Privacy Policy.

9. Time limit and identity verification

The controller answers a GDPR request without undue delay and normally no later than one month after receipt. Under the rules, the time limit may be extended by up to two months for complex or numerous requests; the data subject must be informed of the extension and the reasons for it within the first month.

Identity is verified proportionately. Neither the customer nor FlowDule may require more documentation than necessary, but nor may they disclose record or health information to the wrong person. Copies of identity documents may be collected only where a less intrusive verification is not sufficient, and must be retained for a short, documented period.

10. Erasure across the entire data chain

An approved erasure process must handle all relevant instances:

• active database records and version relationships;

• files, attachments, images and audio;

• bookings, communication, sharing and access links;

• search indexes, queues, caches and temporary files;

• AI input and output in accordance with the approved supplier configuration;

• export files and integration copies under FlowDule’s control;

• orphaned objects and failed erasure jobs;

• backups in accordance with the documented rotation.

FlowDule may retain a minimal deletion receipt without the erased content. The receipt may state the customer, the instruction, the categories, the time, the responsible party, the outcome, the backup expiry and any lawful exceptions.

11. Backups and restoration

Information may be technically inaccessible in rolling backups until the copies are overwritten in accordance with the documented rotation. During that period it is subject to the same security, must not be used for other purposes and is not reintroduced into normal operations.

If a backup is restored, previously completed erasures and applicable legal holds must be reapplied before the environment is opened. The actual rotation period and the restore process must be tested; internal targets must not be described as a customer guarantee without an express agreement.

12. Legal hold and other exceptions

A legal hold means a temporary, documented block on ordinary erasure for a precisely delimited body of material. It may be relevant in the event of a specific complaint, dispute, regulatory case or other legal obligation.

A legal hold must have:

• a unique reference and a responsible party;

• a documented basis;

• a precise delimitation of person, case, object and data category;

• a start date, a review date and a release criterion;

• the least possible access;

• traceable release and subsequent recalculation of normal retention.

A hold on a single record or event must not automatically block all information about that person or the customer’s entire data set.

13. Export and termination

The customer may export its own data during the agreement and after termination in accordance with the Terms of Service and the Data Processing Agreement. The export must cover the relevant customer data, relationships, files, versions and audit metadata in documented, commonly used and machine-readable formats.

After the agreed export window, FlowDule erases customer data in accordance with the customer’s choice, the DPA, the backup rotation and any lawful exceptions. FlowDule’s own bookkeeping obligation for invoice and accounting data is not a basis for retaining the customer’s client or record data.

14. The customer’s information to the client

Before or at the time of collection, the customer must provide a local privacy text that as a minimum explains:

• the customer’s identity and contact details;

• the purposes, data categories and legal basis;

• relevant recipients, suppliers and transfers;

• the specific retention period or clear criteria;

• rights, complaints and how to make contact;

• any use of AI and human review;

• special rules on record rectification, where the customer is covered by them.

FlowDule’s general documents may support, but do not replace, the customer’s own duty to inform.

15. Legal sources

• GDPR Articles 5 and 12 to 23

• The Danish Patient Safety Authority (Styrelsen for Patientsikkerhed) on record retention

• The Danish Executive Order on patient records (journalføringsbekendtgørelsen), Executive Order no. 1361 of 24 November 2025

• The Danish Patient Safety Authority (Styrelsen for Patientsikkerhed) on the authorisation of psychologists from 1 January 2026