Data security

The following information is stored in Auntie’s data system:
– your name
– your email address
– your phone number
– your answers to the surveys (start and end surveys, session feedback)
– your goals in the follow-up form (if follow-up form is used)
– your package and the language you select
– the name of your Auntie Professional
– the name of your employer

The data can only be accessed with a username of an authorized employee, professional or partner. There are different levels of access and each user is only granted access to information that’s necessary for the task at hand. Access to the information is limited to those for whom it is essential for the provision of the service. All Auntie professionals have signed a non-disclosure agreement and are bound by strict confidentiality. All access rights are checked regularly.

Auntie does not sell or otherwise pass on any personal information. Your personal information is only used to provide the service.

Conversations and video sessions are never recorded or stored anywhere.

No, your information is not transferred to My Kanta.

The information Auntie collects and stores is customer information. For example, Auntie doesn’t ask or store information about medical diagnoses. In addition, it’s possible to have your data removed from Auntie’s data system upon request.

No personal information is ever shared with supervisors, management or authorities. Group-level reports can be formed with only groups consisting of at least ten people and any identifiable information is destroyed before forming such reports which makes it impossible to identify individuals.

We conduct tests and audits using an external, independent security expert(s). Technical audits have been performed in 2019, 2020 and 2021. The ISO27001 certification audit was done in 2021. In addition to audits, information security is taken into account in daily work, both in technology development, employee training and processes.

Both the technical information security, the selected tools and the operational processes meet the requirements of the GDPR of 25 May 2018.