Privacy policy
Last updated: 29 September 2026
This privacy policy describes how Vicuras processes personal data about you when you, as a treater, use Vicuras Behandler App.
1. Data controller
VICURAS DK A/S (also trading as Vicuras Danmark A/S and Vicuras Sundhedscentre A/S)
CVR no. 35807756
Holmbladsgade 133, 2300 København S, Denmark
Phone +45 70 60 24 00 · Email kontakt@vicuras.dk
2. What data we process
- Identity and contact details: name, email, phone number and the other details in your treater profile.
- Sign-in: the email you sign in with. Your password is not stored on the phone – the app only keeps a sign-in token so you stay signed in.
- Work information: shifts, on-call shifts, daily schedule, bookings, shift swaps (Vagtbørs), event sign-ups, tasks, room status and supply orders.
- Journal notes: the notes you type or dictate about treatments. They may contain health data about patients.
- Communication: chat messages, forum posts, comments, poll answers, and the photos and files you choose to attach.
- Device information: a notification token (push token) and your phone’s name and type, so notifications reach the right phone.
The app does not collect your location, your contacts, or usage data for analytics or advertising.
3. Purposes and legal basis
| Purpose |
Legal basis |
| Giving you access to the app and managing your work with Vicuras: shifts, bookings, events and orders |
Performance of your agreement with Vicuras (GDPR Art. 6(1)(b)) |
| Keeping treatment records |
Legal obligation (Art. 6(1)(c)) and Art. 9(2)(h), under the Danish Health Act and the Danish order on medical records (journalføringsbekendtgørelsen) |
| Communication between treaters and administration: chat, forum and notifications |
Performance of agreement (Art. 6(1)(b)) and our legitimate interest in running the business well (Art. 6(1)(f)) |
| Security, troubleshooting and preventing misuse |
Legitimate interest (Art. 6(1)(f)) |
4. Phone permissions
The app only asks for access to features on your phone when you use them:
- Notifications: The app requires notifications, because important messages about shifts and changes are sent that way.
- Microphone and speech recognition: used only when you dictate a journal note. Your speech is turned into text by the phone’s own speech recognition (Apple on iPhone, Google on Android), which may process the audio on their servers. Vicuras receives only the finished text – never the recording.
- Calendar: used only if you turn on “Synchronise calendar”. The app adds your shifts to your phone’s calendar. Your calendar is not sent to Vicuras.
- Face ID / fingerprint: used for quick sign-in. The check happens on your phone, and Vicuras never receives biometric data.
- Photos and files: only the photos and files you choose to attach in the forum or chat.
5. Journal note drafting (Vica)
When you tap “Let Vica compose the note”, your keywords are sent to OpenAI (ChatGPT), which drafts the note. You always review and approve the note before it is saved to the record. OpenAI processes the keywords on its servers in the USA.
Vicuras uses anonymised journal notes, with names and any other details that could identify a person removed, to train and improve Vica.
Never write the patient’s name, CPR number or other identifying details in the keywords.
6. Who we share data with
We never sell your data. We use the following processors, who may only process the data on our instructions:
- Microsoft (Dynamics 365, Azure, SharePoint and Power Automate) – running the app’s server and storing data. The server runs in Microsoft’s data centre in Denmark, and data is stored in Microsoft data centres in the EU.
- Google (Firebase Cloud Messaging) – delivering notifications. Google may process the push token and notification content in the USA. The transfer is based on the EU-US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.
- Apple – delivering notifications to iPhone and speech recognition on iPhone.
- Google – speech recognition on Android.
- OpenAI (ChatGPT) – drafting journal notes, see section 5. OpenAI processes and stores the data in the USA. Vicuras has entered into OpenAI’s standard data processing agreement with OpenAI Ireland Limited. OpenAI is not certified under the EU-US Data Privacy Framework, so the transfer to the USA is based on the Standard Contractual Clauses of the European Commission, which form part of that agreement.
7. How long we keep data
- Profile and work information: while you work with Vicuras and then for 3 years, unless other law requires longer storage, e.g. the Danish Bookkeeping Act.
- Journal notes: at least 10 years after the last entry, as required by Danish law.
- Notification token: deleted when you sign out of the app.
- Data on your phone (sign-in token and settings) is deleted when you sign out or uninstall the app.
8. Security
All communication between the app and our server is encrypted (HTTPS). Access requires signing in, and you can protect the app with Face ID or fingerprint.
9. Your rights
You have the right to access the data we process about you and to have it corrected or deleted. You can also object, have processing restricted, and receive your data in a portable format. Write to kontakt@vicuras.dk and we will reply within one month.
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk.
10. Changes
We update this policy when the app or our processing changes. The date at the top shows when it was last changed.