Privacy
Security, data flow and storage
How we protect your information, where it goes when you book or contact us, and where it is stored.
Last updated 6 November 2026.
In short
- All traffic to the website is encrypted (HTTPS).
- Information is stored by Simply.com in Denmark, inside the EU/EEA.
- No advertising or tracking. Google Analytics only loads if you accept statistics. The fonts are on our own server.
- Only clinic staff have access, using personal logins.
- Old information is deleted automatically.
How the information flows
- When you bookYour browser sends the booking encrypted to our website at Simply.com, where it is saved in the database. The server then sends a confirmation e-mail to you and a copy to the clinic.
- Contact form, business form and access requestsWhat you write is saved in the database and e-mailed to the clinic so we can reply.
- Company search on the business pageOur server asks the Brønnøysund Register Centre about the company name or organisation number you type. Your IP address is not passed on.
- Weather under ContactOur server fetches the weather from the Norwegian Meteorological Institute using the clinic's location. Nothing about you is sent.
- The map link“Open in maps” opens Google Maps. Google only learns about the visit if you click the link.
- Statistics (only if you accept)Your browser sends information about the visit to Google Analytics: which pages you view, approximate location, language and device. Google Ireland processes the data, and it may be transferred to the USA. You can withdraw consent under “Cookies” at the bottom of the page.
Where information is stored
- The website and database are hosted by Simply.com (Denmark). Simply.com is our data processor and keeps backups with a subcontractor in Denmark.
- E-mail to and from the clinic is kept in the clinic's mailbox.
- Payment takes place at the clinic. We do not store card numbers or payment details on the website.
How we protect the information
- Encryption: All traffic uses HTTPS.
- Passwords are stored encrypted with a one-way algorithm (bcrypt). Nobody can read them, not even us.
- The forms are protected against forged submissions from other websites, have a trap for spam robots, and limit how many submissions can be sent per hour.
- The database is only used through safe queries that protect against SQL injection.
- Login: Each staff member has their own user. Wrong passwords cause a delay, and the login uses a secure cookie that scripts cannot read.
- The admin pages cannot be shown in frames on other websites and do not appear in search engines.
- Files with passwords and settings are blocked so they cannot be opened from the internet.
Retention
| Information | What happens |
|---|---|
| Bookings | Name, phone, e-mail and comment are removed 24 months after the appointment |
| Messages from the contact form | Deleted after 12 months |
| Business requests | Deleted after 36 months |
| Closed privacy requests | Deleted after 36 months |
The clean-up runs automatically. You can ask for your information to be deleted earlier at any time: access and deletion.
If something goes wrong
If there is a security breach involving personal data, we report it to the Norwegian Data Protection Authority within 72 hours when the law requires it. If there is a high risk to you, we will tell you directly.
Report a vulnerability
If you have found a bug or security hole on the website, we would really appreciate an e-mail to postnirvana@nirvana.no. Please do not try to access other people's information.