Privacy Policy

Last updated: [date] · ROIQ

This privacy policy explains how ROIQ collects and processes personal data when you visit roiq.no or contact us. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

Contents

  1. Data controller
  2. What data we process
  3. Purposes and legal basis
  4. Cookies
  5. Who we share with
  6. Transfers outside the EEA
  7. Retention
  8. Your rights
  9. Patient data
  10. Security
  11. Complaints to Datatilsynet
  12. Changes

01Data controller

ROIQ is the data controller for the personal data described in this policy.

  • Business: ROIQ
  • Company reg. no.: [under registration]
  • Location: Oslo, Norway
  • Email: roi@roiq.no

For any privacy questions, or to exercise your rights, contact us at roi@roiq.no.

02What personal data we process

  • Contact form: name, email address, phone number and clinic name.
  • Email to us: the content of your enquiry and the contact details you provide.
  • Site visits: anonymous, aggregated statistics about the visit (see section 4). We use a privacy-friendly solution that sets no tracking cookies and does not identify you as an individual.

We never ask for sensitive personal data or patient data, and you should never send such information via the form or email (see section 9).

03Purposes and legal basis

  • Responding to enquiries and preparing a possible client relationship — legitimate interest (GDPR Art. 6(1)(f)) and/or steps prior to entering a contract (Art. 6(1)(b)).
  • Delivering and administering our services to clients — performance of a contract (Art. 6(1)(b)).
  • Improving the website through anonymous statistics — legitimate interest (Art. 6(1)(f)).
  • Meeting legal obligations, e.g. accounting — legal obligation (Art. 6(1)(c)).

04Cookies

The website uses only strictly necessary cookies required for the site to function. We use a cookieless, EU-hosted analytics solution and set no cookies for analytics, marketing or tracking. For that reason we show no consent banner for such cookies. More information is on our Cookies page.

05Who we share personal data with

We never sell personal data. We share data only with providers who process it on our behalf (data processors), under a data processing agreement:

  • Hosting: HostArmada — servers in Frankfurt, Germany (EEA).
  • Web analytics: [Plausible Analytics – EU] — cookieless, EU-hosted.
  • Email: [email provider] for email correspondence with us.

We may also disclose data where we are legally required to do so.

06Transfers outside the EEA

The personal data we process is stored and processed within the EEA. We do not transfer personal data to countries outside the EEA.

07Retention

  • Enquiries: kept as long as necessary to follow them up, and deleted within a reasonable time if they do not lead to a client relationship.
  • Client data: kept for the duration of the client relationship.
  • Accounting records: kept as long as required by the Norwegian Bookkeeping Act (5 years).
  • Anonymous statistics: contain no personal data and are kept only in aggregated form.

08Your rights

You have the right to request access to the data we hold about you, request rectification of inaccurate data, request erasure, request restriction of processing, object to processing based on legitimate interest, request data portability, and withdraw a consent you have given. To exercise these rights, contact roi@roiq.no. We normally respond within 30 days.

09Patient data

ROIQ never processes patient records or patient health data. When we deliver services to a clinic, we act as a data processor for the clinic's marketing and website data, and the clinic is the data controller. Our work does not involve access to, storage of, or processing of patient data, and such access is expressly outside our services.

10Security

We use technical and organisational measures to protect personal data, including encrypted transmission (TLS/HTTPS), EEA-based hosting and access restrictions.

11Complaints to Datatilsynet

If you believe we process personal data in breach of the rules, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). We appreciate it if you contact us first at roi@roiq.no so we can put things right. More information: datatilsynet.no.

12Changes to this privacy policy

We may update this privacy policy. The current version is always available on this page, with the date of last update shown at the top.