Privacy Policy for Krokket AS

Version 1 of April 21st 2026.

This privacy policy describes how we collect, use, process and share your personal data in connection with your use of our website or one of our services. Krokket processes your personal data in a responsible and transparent manner in accordance with Norwegian legislation, including the Personal Data Act and the Health Personnel Act, and the EU General Data Protection Regulation (GDPR).

Data Controller

Krokket AS
Frysjaveien 33 c, 0884 Oslo
post@krokket.com
Organisation number: 937604181

If you have questions about our processing of your personal data, please contact us by email.

What personal data do we collect, and why?

Below is a description of what personal data we collect about you and why.

Responding to enquiries from you

If you contact us via email or the contact form on our website, we collect the information you share, including your name, email address and any other personal data necessary for us to respond to and assist you. Messages sent via the contact form are transmitted in encrypted form via SMTP/SSL to Krokket's email account at Infomaniak, and are not stored in any database or shared with any third party. A confirmation email is sent to the address you provide. The security of email in transit and at the recipient's end depends on the recipient's email provider. The processing is based on the agreement with you as the person making contact.

Sending newsletters, providing information about our business, and marketing

Name, email address, phone number and any personal data necessary for us to send you the requested information. The processing is based on your consent when you sign up for one of our newsletters.

Registration for courses and similar

Name, phone number, email address, invoice address and any personal data necessary for us to register and coordinate the course and participants. The processing is based on consent given by you upon registration or sign-up.

Recruitment for positions with us

If you apply for a position with us, we collect CVs, applications, references and certificates. The processing is based on your consent provided upon application.

Delivering psychology services

If you receive clinical psychology services from Krokket, this is considered healthcare, and personal data and health information will be collected. This information is subject to particularly strict legislation, and all data collected in connection with the delivery of psychology services is therefore recorded and processed exclusively in a closed case management system that complies with the requirements for processing health information under the Health Personnel Act. Upon establishing a client relationship, basic information is registered to ensure the ability to provide proper healthcare and to communicate essential information to relevant parties in the event of unforeseen incidents or risk to life.

Your name, phone number, email address, national identity number, date of birth, gender and residential address.
Your marital status, occupational status and children.
Next of kin's name, phone number and relationship.
GP's name, practice, address, phone number and email.
Your regular medications.
Any additional information you provide that you consider important for the therapist to know.

Maintaining patient records

Krokket provides healthcare, and for you as a patient with us, we are required to maintain electronic records in accordance with the provisions of the Health Personnel Act Chapter 8 – §§ 39 et seq. and the Patient Record Regulations. The record is maintained in a closed system, and journal information is only accessible to your treating clinician (unless statutory exceptions indicate otherwise). Additional personal data stored in your patient record:

Background information about you relevant to providing you with healthcare.
Assessments relating to your condition or presenting difficulties.
Summaries from your ongoing consultations.
A closing note/discharge summary with an overview of your treatment course.

Children

We ask that persons under the age of 18 do not provide personal data to Krokket. If we discover that we have collected personal data from a child under the age of 18, we will take immediate steps to delete the information as soon as reasonably possible.

Disclosure of personal data to others

We do not disclose your personal data to others unless there is a lawful basis for such disclosure. Examples of such a basis would typically be an agreement with you or a statutory obligation (for example under anti-money laundering legislation) that requires us to provide the information.

Data processors

We use data processors (those who operate our data systems and databases) to collect, store or otherwise process personal data on our behalf. In such cases, we have entered into agreements to ensure information security at every stage of the processing. We use the following data processors:

Konfidens

Konfidens is a comprehensive platform for managing patient records, appointment booking, communication and payment solutions, and handles all personal data related to the delivery of individual psychology services covered by the Health Personnel Act at Krokket AS.

Infomaniak Network SA

Infomaniak is the provider of KSuite, cloud-based services for electronic data processing, including email, website hosting and file management. All communication and file processing not exclusively handled by Konfidens is processed here. Infomaniak is a market leader in privacy.

Luftskip AS

Krokket rents a dedicated area for electronic data processing from Luftskip on Luftskip's Infomaniak KSuite. Luftskip administers access to the system, and only employees of Krokket AS have access to Krokket's area.

Fiken

Fiken is a digital accounting system, and processes personal data related to invoicing to and from Krokket. Fiken receives anonymised transaction data from Konfidens.

Tomcon AS

Tomcon AS is the accountant for Krokket AS, and processes personal data related to invoicing to and from Krokket, as well as payroll processing. An authorised accountant at Tomcon AS has access to the accounting system Fiken and bank accounts at Sparebanken Norge.

All processing of personal data takes place within the EU/EEA area.

Third parties and external links

Our website may contain embedded videos and other content from external services. When you play or view such content, the relevant service provider may receive information about you, including your IP address and browser information. Such content is not loaded automatically — you must actively choose to display it. We currently use the following external services for embedded content:

YouTube (Google Ireland Limited) – policies.google.com/privacy

Our website may also contain links to external websites. Krokket is not responsible for the content or privacy practices of such websites, and we recommend that you read the privacy policy of each website you visit.

Retention periods

We store your personal data for as long as is necessary for the purpose for which the personal data was collected. Personal data that we process on the basis of your consent will be deleted within a reasonable time if you withdraw your consent. Personal data we process to fulfil an agreement will be deleted within a reasonable time once the agreement and all obligations arising from the contractual relationship have been fulfilled.

Your rights regarding your personal data

Under applicable data protection legislation, you have the following general rights in relation to your personal data:

Right of access: You have the right to access your data. You may request a copy of all personal data we hold about you.
Right to rectification: You have the right to request that we correct personal data about you that is inaccurate or incomplete.
Right to erasure: You have the right to request that we delete your personal data. Only where the law requires it will we retain your personal data following such a request, to the extent we are legally obliged to do so.
Right to restriction of processing: You have the right to request that we restrict the processing of your personal data.
Right to object to processing: You have the right to object to the processing of data about you.
Right to data portability: You have the right to request that we transfer your data to another organisation or directly to you.
Right to withdraw consent: You may at any time withdraw any consent you have given to the processing of your personal data.

Patient record rights

Additional rights apply to you as a recipient of healthcare services from Krokket.

You have the right to access your own patient record.
You also have the right to rectification and deletion of your record subject to certain conditions.
You also have the right to object to the disclosure of your record or information contained therein, pursuant to the Patient and User Rights Act Chapter 5.

To exercise your rights, please send us an email.

We will respond to your request as soon as possible, and no later than 30 days.

Complaints

You may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe that our processing of your personal data is inconsistent with what we have described in this privacy policy, or that we are otherwise in breach of data protection legislation. Information on how to contact Datatilsynet is available on their website.

Changes

If our services change or if there are changes to the regulations governing the processing of personal data, the information provided here may be updated accordingly. Up-to-date information will always be available on our website.