Legal pages
Legal pages
Version 3.1 (August 2026)
We take the privacy of our users seriously. This privacy policy explains how we handle and protect your personal data in accordance with the applicable privacy legislation, including the EU General Data Protection Regulation (GDPR). We only process personal data that is relevant and necessary for the purposes they serve. If you have any questions, our contact details are available below.
Noteless acts as a data processor with respect to any patient or consultation data processed through our platform on behalf of our customers. The processing of such data is governed by the Data Processing Agreement entered into between Noteless and the relevant customer, and is not covered specifically by this privacy policy.
P.1
Although some of our customers are organized as businesses, our service requires processing of certain personal data. Personal data is defined as any information relating to an identified or identifiable natural person, and we only process data of which we have a legal basis.
Sales, marketing and information purposes
For sales, marketing and information sharing purposes, upon your account registration or request for information, we will, with your consent, collect necessary contact information such as email address, name, and phone number. Recipients of newsletters and similar information may withdraw their consent at any time if they no longer wish to receive such information.
Legal basis: Article 6(1)(a) GDPR — your consent.
When entering into an agreement to purchase our services
In order to offer and deliver our services to customers, some personal information is required. This includes personal information which is necessary to manage billing and provide customer support related to the use of the service. When creating a customer account and subscribing to our service, you may be asked to provide your name, professional identifier or organisational ID (such as your healthcare provider registration number or clinic identifier), email address, phone number, mailing address, and associated medical centre. We do not collect national identity numbers from individual users unless specifically required for a regulated purpose and with an appropriate legal basis.
Such information is processed on the basis that it is required to fulfill the contractual agreement with customers who subscribe to and purchase our services.
Legal basis: Article 6(1)(b) GDPR — processing necessary for the performance of a contract to which you are a party.
Analyzing user activity for the purpose of improving our services
To analyze and improve our services, we may process user activity that constitute personal data. This may include information about how you use our platform and website, such as IP address, browser type, visit time, and how you interact on our platform.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in improving the functionality, stability and user experience of our platform. We have assessed that this interest is not overridden by your interests or fundamental rights, given the limited identifiability of the data collected and the technical nature of the processing.
Legal obligations
We may be required to process personal data for the purpose of fulfilling legal obligations, such as duties relating to accounting or tax legislation.
Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation.
Cookies
We use cookies to register and analyze activity on our website, on the purpose of improving the website and our services, as well as for marketing purposes.
If you do not want cookies to be stored, you may change the settings in your browser. You will also be able to delete existing cookies. Please note that you may experience reduced functionality if you choose to delete or reject cookies.
Necessary and functional cookies, as well as cookies for statistics, are processed based on our legitimate interest, as they help us improve our website according to our users' needs and preferences. As such information is less identifiable, we consider our interest in optimization to outweigh the individual interest.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in improving the functionality, stability and user experience of our platform. We have assessed that this interest is not overridden by your interests or fundamental rights, given the limited identifiability of the data collected and the technical nature of the processing.
P.2
In order to offer and optimize our services, we rely on various service providers. In relation to carrying out their service, it may be required that they process personal data. We only use reputable providers who offer sufficient guarantees to ensure protection of personal data. The providers may only use personal data according to our instructions and in accordance with the data processor agreement.
We rely on IT providers, and digital platforms for managing our customer portfolio, sales, marketing, and customer service, as well as login and verification services for our platform.
Furthermore, we use digital service providers for storing and sending invoices, as well as for managing payments from our customers.
To improve our service, we also use digital services to analyze and understand the use and experience of our website and platform.
International transfers of personal data
Some of our service providers are located outside the European Economic Area (EEA), or may process data on servers located outside the EEA. Where personal data is transferred to a country that has not been granted an adequacy decision by the European Commission, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR. These safeguards typically take the form of Standard Contractual Clauses (SCCs) approved by the European Commission.
Patient data that is processed through our service are subject to no international transfers outside of EU/EEA, and are processed exclusively in European data centers.
You may request further information about the safeguards in place for international transfers by contacting us at the address below.
P.3
Storage duration
We will store the information during the time in which it is required to allow you to use our services as a customer, and for the time it is necessary for the purpose of which it was collected. The retention period is determined based on the following criteria: to what extent the information is required to fulfill our legal and contractual obligations, and whether the information constitutes information necessary for our business. Once our legitimate and practical demand for the information ceases, the information will be deleted promptly.
If we no longer have a relevant legal basis for processing, such as upon withdrawal of your consent or we no longer have a legitimate interest in processing the personal data, we will delete it. In some cases, we may be legally required to retain personal data for a longer period, such as under accounting laws. In such cases, the data will be deleted when this obligation ceases.
Security
We implement both technical and organizational security measures to protect and manage your information. The information will only be accessible to employees which require access in relation to performing their tasks. The information is protected from unauthorized access by requiring identity verification during login. However, it is also the customer`s responsibility to prevent unauthorized access to their account.
P.4
We may change the privacy policy upon our own discretion. In the case of material changes, we will notify our customers. The latest version of our privacy policy will always be available on our website.
P.5
In relation to the processing of your personal data, you have the right to:
To exercise these rights, you can contact us through the information below. We will respond to your request within one month of receipt. In cases of complexity or high volume of requests, this period may be extended by a further two months, in which case we will inform you within the first month.
P.6
If you believe we have processed your personal data in violation of applicable data protection legislation, you have the right to lodge a complaint with a data protection supervisory authority. You may contact the supervisory authority in your country of residence, place of work, or the country where the alleged infringement occurred.
In Norway, the relevant authority is the Norwegian Data Protection Authority (Datatilsynet): www.datatilsynet.no
In Denmark, the relevant authority is the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk
For other nationalities, refer to official information on supervisory authorities relevant to that jurisdiction.
P.7
Feel free to contact us if you have any questions, comments, or wish to exercise your rights.
Noteless AS
Storgata 5, 0155 Oslo
Organization number: 932 320 061
E-mail: post@noteless.com
Tel: + +47 23 50 74 76
Last updated 05.08.2026