Privacy Policy

Version: privacy-v14 Last updated: 2026-10-13 Governing law: Danish law

Who we are

NPG Puls is a patient-feedback platform operated by Nordic Patient Group ApS (CVR 40713352, Fuglebækvej 2C, 1., 2770 Kastrup, Denmark) together with our technical platform provider VEKST Solutions LLC (EIN 98-1931362, 14707 S Dixie Hwy, Suite 402C #186, Miami FL 33176, USA).

For privacy-related inquiries: privacy@nordicpatientgroup.dk.

At-a-glance summary (non-binding)

• When your dental clinic uses NPG Puls to send you a patient-satisfaction survey, the clinic is the data controller and we (NPG) are the processor. Contact your clinic for access or deletion of your data.
• When you visit nordicpatientgroup.dk or log in to app.nordicpatientgroup.dk as clinic staff, NPG is the controller for technical and account data.
• When NPG collects public reviews from Google to provide visibility analytics for the clinic, NPG is the controller under legitimate-interest grounds.
• We do not sell your data and we do not use it for marketing without consent.
• We use sub-processors, the full list is at /subprocessors.

1. Patient data processed on behalf of the clinic

If you have received an NPS or patient-satisfaction survey from your dental clinic via the NPG Puls platform:

• Controller: the clinic (your dentist / your clinic company).
• Processor: Nordic Patient Group ApS (NPG).
• Sub-processor: VEKST Solutions LLC (platform operations).

The clinic has primary responsibility for informing you about what data they hold and how it is used. The relationship between the clinic and NPG is governed by a Data Processing Agreement (DPA), which the clinic accepts in the platform.

Reminders and reviews: If you have not answered the survey, or have not finished it, the clinic may send you a reminder through the platform. If you tap "Remind me later" on the survey page, we send you one email on the clinic's behalf with a link to write a public review. We do this because you asked for it, and we store when you asked. The clinic may also send one request for a review to patients who answered the survey, whatever they answered. This rests on the clinic's legitimate interest in patients reviewing their visits. You write any review yourself at Google or Trustpilot, under their terms. You can always unsubscribe using the link in the email.

Reviews on Google: If you write a review on the clinic's Google profile, the clinic can see in NPG Puls that it is probably from you. We estimate this from the name, the timing, the text and your score in the survey. It is shown only to the clinic, is not stored, and is not used in the clinic's public replies.

For data access, correction, deletion, or objection regarding patient data: contact your clinic directly. The clinic has 30 days to respond. NPG provides export and deletion tooling behind the scenes.

If you cannot reach the clinic, you may also write to privacy@nordicpatientgroup.dk as a backup channel and we will help relay your request.

2. Operator accounts (clinic staff)

If you log in to app.nordicpatientgroup.dk as clinic staff or agency administrator:

Retention: as long as your account is active. On account closure, data is deleted within 90 days; activity logs are anonymised after 12 months.

Your rights: see Section 7 below.

3. Public review data (visibility analytics)

NPG collects publicly available reviews from Google Maps concerning the clinics enrolled in NPG Puls. The purpose is to provide reputation- and visibility analytics for each clinic.

We process only review information that the reviewer has already made public on the relevant platform. We use it to produce reputation and visibility insights for the clinic the review concerns, and we do not combine it with data from other sources to build a profile of the reviewer.

For clinics that officially connect their Google Business Profile to NPG Puls, reviews are retrieved through Google's official API instead of by collection. See Section 11.

How long we keep reviews: we keep a copy of a review for as long as it remains published on the source platform and the clinic is an active NPG Puls customer. If you remove your review at Google, our copy is deleted automatically at the next synchronisation, within 24 hours at the latest. Reviews gathered by automated collection rather than the official API are deleted after 12 months regardless.

Right to object: if you would like your public reviews excluded from NPG's visibility analytics for the clinic, write to privacy@nordicpatientgroup.dk. We will remove your review from our systems within 30 days. Note: this does not remove the review from Google, that must be done directly with them.

4. Visitors to nordicpatientgroup.dk and app.nordicpatientgroup.dk

When you visit our websites we process the following data:

• Technical logs (IP address, user agent, time of visit, page accessed), retained ~30 days at our hosting provider Vercel. Legal basis: legitimate interest (operations, debugging, abuse prevention).
• Strictly necessary cookies: session cookies to keep you signed in and CSRF protection. No marketing cookies, no tracking pixels, no consent-requiring analytics cookies as of the effective date of this policy.
• Demo booking (the "Book Demo" button on the front page): opens a booking form from our calendar provider HighLevel Inc. (USA). The form and its script load only when you press the button; an ordinary visit sends nothing to HighLevel. What you type into the form (name, e-mail, phone number, preferred time and any message) is sent to HighLevel so we can confirm and hold the meeting. Legal basis: legitimate interest (responding to your enquiry). The transfer to the USA is covered as described in section 6.

We do not show a cookie banner because we do not use cookies that require consent. If this changes (e.g. addition of analytics), we will update the policy and introduce a cookie banner at the same time.

5. Recipients of your personal data

We disclose your personal data only to:

1. Technical sub-processors assisting us in operating the platform (database, hosting, email, AI inference). The full list, with purpose, data location and transfer mechanism, is available at /subprocessors.
2. Authorities if we are legally required to do so (police, tax authority, Datatilsynet on supervisory request).
3. The clinic for patient data processed on its behalf (Section 1).

We do not sell your data. We do not share it with marketing third parties.

6. International transfers

Several of our sub-processors are established in the United States (including VEKST Solutions LLC, Vercel, Postmark, OpenRouter, HighLevel). The transfer is covered by the EU Commission's Standard Contractual Clauses (SCCs): for Postmark and HighLevel supplemented by the EU-US Data Privacy Framework, plus a concrete risk assessment (Transfer Impact Assessment / TIA) per vendor.

Details about the transfer mechanism per vendor are available at /subprocessors. For patient data processed on the clinic's behalf, the clinic DPA's Annex D (TIA) applies, contact your clinic for details.

7. Your rights

Under GDPR you have the following rights, alongside the rights granted under Danish data-protection law:

• Right of access (Art. 15): receive a copy of the personal data we hold about you.
• Right to rectification (Art. 16): correct inaccurate data.
• Right to erasure ("right to be forgotten", Art. 17): where the law permits.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20): receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21): particularly to processing based on legitimate interest.
• Right to withdraw consent: where processing is based on consent.

How to exercise these rights:

• For patient data (Section 1), contact your dental clinic directly. You may also write to privacy@nordicpatientgroup.dk for assistance.
• For account data, review data and website data (Sections 2, 3, 4), write to privacy@nordicpatientgroup.dk. We respond within 30 days as a baseline; for particularly complex requests, the response window may be extended by up to 2 additional months, per GDPR Art. 12(3). You will be notified of any such extension and the reason for it.

8. Complaint to the Danish Data Protection Authority

You have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) if you are dissatisfied with how we process your personal data:

Datatilsynet Carl Jacobsens Vej 35 2500 Valby, Denmark www.datatilsynet.dk Phone: +45 33 19 32 00

9. Changes to this privacy policy

We update this policy when our processing changes (e.g. addition of new sub-processors or new functionality). Material changes are communicated to registered users via email or dashboard notification. The version currently in effect is shown at the top with version number + date.

10. Contact

11. Official Google Business Profile connection

If your clinic chooses to connect its Google Business Profile to NPG Puls, you (as clinic staff) authorize NPG to access certain data from the clinic's Google account through Google's official Business Profile APIs. The connection is opt-in: nothing happens until a user from the clinic clicks "Connect with Google" and grants access on Google's own consent screen.

What we access. Only the Google Business Profile(s) your clinic manages: account and location details, reviews with star ratings, and your own replies to reviews. We do NOT access Gmail, contacts, calendar, Drive files, or any other Google service.

Why. To show the clinic's reviews in the dashboard, and to reply to reviews on the clinic's behalf after the clinic has reviewed and approved each individual reply. An AI feature may suggest a draft reply based on the review text; no reply is ever posted automatically.

Roles and legal basis.

• Connection and access data (encrypted tokens, account/location identifiers, matched Place ID) is processed by NPG as part of the operator relationship with the clinic, under Art. 6(1)(b), performance of contract (the same basis as Section 2).
• Review content (the reviewer's display name, rating, text, timestamp) is processed by NPG as controller under Art. 6(1)(f), legitimate interest (reputation and visibility analytics for the clinic), on exactly the same basis as the public reviews in Section 3. For officially connected clinics, the API access replaces collection.
• Posting a reply is carried out as processing on the clinic's documented instruction, under Art. 28. The reply itself is published on the clinic's own Google profile, which the clinic controls.

Scope requested. Google offers only a single combined access level (business.manage), whose label ("see, edit, create and delete your business listings") is broader than our actual use. We request the minimum Google makes available and use it solely to read reviews and post approved replies. We do not edit, create, or delete business listings.

How we store it. Access and refresh tokens are encrypted at rest with AES-256-GCM and are never logged or shared. Review content is stored as review history in the dashboard, in the same way as other review data. To improve the reply drafts, we also keep a copy of the reply drafts the platform writes for a review or comment on Google, Facebook or Instagram, of any note the clinic's staff add to a draft, and of the replies the clinic posts through NPG Puls. A draft usually mentions the reviewer's first name. Before a note is stored, we hide the reviewer's name and the treatment words we recognise. We delete them after 12 months, when the clinic's account closes, or when we remove a review after an objection. A reply the clinic has posted is also shown with the review or comment and is kept as long as it is. We use the copies only to improve the drafts for that same clinic or for the clinic chain it belongs to, never for other clinics. Comments from Facebook and Instagram are used only for the clinic they belong to. What the platform learns is a few short guidelines on the clinic's writing style, for example how a reply opens and closes. Each guideline is checked before it is stored and is rejected if we find a name, a treatment, a date or a longer quote in it. No language model is trained on them.

What we never do. We do not sell data received from Google's APIs, do not use it for advertising, and do not share it except as needed to provide the feature (for example, we send the review text, rating and the reviewer's public name to our AI provider to draft a suggested reply, and the clinic's earlier drafts and replies, with the reviewer's name hidden, to learn the clinic's writing style; the text is not retained there and is not used to train models). We do not use data received from Google's APIs to develop, improve, or train generalized AI or ML models. NPG Puls's use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Your control. The clinic can disconnect at any time inside NPG Puls (Settings → Connections), or revoke access directly with Google at myaccount.google.com/permissions. Disconnecting deletes the stored tokens on our side.

12. Official Facebook (Meta) connection

If your clinic chooses to connect its own Facebook Page to NPG Puls, you (as clinic staff) authorize NPG to access certain data from the clinic's Facebook Page through Meta's official Graph APIs. The connection is opt-in: nothing happens until a user from the clinic clicks "Connect with Facebook" and grants access on Facebook's own consent screen.

What we access. Only the Facebook Page your clinic manages: the Page name and id, the clinic's own posts on the Page, and the public comments people leave on those posts. We do NOT access private messages (Messenger), and we do NOT collect Facebook reviews at all (neither via the API, which Meta retired, nor by any other means).

Why. To show the clinic's posts and comments in the dashboard, to reply to comments on the clinic's behalf after the clinic has approved each individual reply, and to publish posts the clinic chooses (for example sharing a positive patient review). An AI feature may suggest a draft; nothing is posted automatically.

Roles and legal basis.

• Connection and access data (encrypted Page and user tokens, Page id) is processed by NPG as part of the operator relationship with the clinic, under Art. 6(1)(b), performance of contract (the same basis as Section 2).
• Posts and comments (the clinic's own posts, plus each commenter's display name, text and timestamp) are read and stored as processing on the clinic's documented instruction, under Art. 28. This is public content on the clinic's own Page, which the clinic controls; we use it only to show the comments in the dashboard, to reply to them after the clinic has approved each individual reply, and to improve reply drafts as described in section 11.
• Replying to a comment or publishing a post is carried out as processing on the clinic's documented instruction, under Art. 28. The reply or post is published on the clinic's own Facebook Page, which the clinic controls.

Scope requested. Meta requires five permissions (pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_engagement, pages_manage_posts), whose labels sound broader than our actual use. We only read the clinic's own posts and comments and only publish content the clinic has approved.

How we store it. Page and user tokens are encrypted at rest with AES-256-GCM and are never logged or shared. Both posts and comments are cached by us (in the EU, Supabase Stockholm) so the inbox loads quickly and can show which comments have been answered. For comments we store the commenter's display name, text and timestamp. We keep posts and comments for up to 12 months and delete them at the end of that window, when the clinic's account is closed, or on a deletion request at any time.

What we never do. We do not sell data received from Meta's APIs, do not use it for advertising, and do not share it except as needed to provide the feature (for example, we send comment or review text (for a comment that is only a sticker or GIF, the image itself), and for a review also the reviewer's public name, to our AI provider to draft a suggested reply or post; the text is not retained there and is not used to train models). When a clinic shares a review that a patient published on Google themselves, the post shows only the reviewer's first name and initial (for example "Sandra V.") and that the review comes from Google. The post is removed if the reviewer asks. We never read private messages. We do not use data received from Meta's APIs to develop, improve, or train generalized AI or ML models.

Your control. The clinic can disconnect at any time inside NPG Puls (Settings → Connections), or revoke access directly with Facebook under Business Integrations. Disconnecting immediately deletes the stored Page access key, so we can no longer read anything from the Page or publish to it. The posts and comments already cached are kept, so a clinic that reconnects does not lose the record of which comments it has answered; they are deleted at the end of the retention window above, when the account is closed, or on a deletion request at any time.

13. Official Instagram (Meta) connection

If your clinic chooses to connect its Instagram account to NPG Puls, this happens through the same Facebook authorization as in section 12: the Instagram account must be a professional account linked to the clinic's Facebook Page, and that link is what Meta grants us access through. The connection is opt-in: nothing happens until a user from the clinic clicks "Connect Instagram" and approves the access on Facebook's own consent screen.

What we access. Only the Instagram professional account linked to the clinic's Facebook Page: the account id, username, profile picture and follower count; the clinic's own posts on that account (caption, media link, timestamp, and how many likes and comments each has); and the public comments people leave on those posts. We do not read private messages, and we do not collect the account's followers as individuals.

Why. To publish, on the clinic's Instagram account, the posts the clinic itself chooses to share (for example a positive patient review from Google), in the same click as the post on the Facebook Page; to show the comments on those posts in the clinic's inbox beside its Google and Facebook ones; to reply to a comment on the clinic's behalf after the clinic has approved that individual reply; and to take a post or a reply down again from the same place. Nothing is published automatically.

Roles and legal basis. As in section 12: connection and access data (encrypted tokens, account id) is processed by NPG as part of the operator relationship with the clinic under Art. 6(1)(b). Reading the clinic's own posts and the comments on them, publishing a post, replying to a comment, and deleting a post or a reply are each carried out as processing on the clinic's documented instructions under Art. 28. Everything is published on, or removed from, the clinic's own Instagram account, which the clinic controls.

Permissions used (scope). In addition to the permissions in section 12, Meta requires instagram_basic (read the account and its own posts), instagram_content_publish (publish a post), instagram_manage_comments (read, reply to and delete comments on the clinic's own posts) and instagram_manage_contents (delete a post the clinic published through us). Their labels sound broader than our actual use: we only ever read the clinic's own posts and the comments on them, and only ever publish or remove content the clinic has approved.

How we store it. Tokens are encrypted at rest with AES-256-GCM and are never logged or shared. We store the account id and username; the clinic's own posts (id, caption, link, timestamp and counts); and the comments on them, including each commenter's username, text and timestamp. All of it is cached in the EU (Supabase Stockholm) so the inbox loads quickly and can show which comments have been answered. Posts and comments are kept on the same schedule as the clinic's reviews and are deleted on a deletion request.

What we never do. The same as in section 12: we do not sell data received from Meta's APIs, do not use it for advertising, show only the reviewer's first name and initial in a post as described in section 12, and do not use data received from Meta's APIs to develop, improve, or train generalized AI or ML models.

Your control. The clinic can disconnect at any time inside NPG Puls (Settings → Connections), or revoke access directly with Facebook under Business Integrations. While the connection is live, a post published through NPG Puls can be taken down from the clinic's Instagram account and its Facebook Page together, from the same place it was published. Disconnecting immediately deletes the stored access keys for the Instagram account, and from that moment we can no longer publish, reply or delete anything on Instagram, because doing so needs exactly the access that was withdrawn; anything already published stays until the clinic removes it in the Instagram app or reconnects. The posts and comments already cached are kept on the same terms as in section 12.