Privacy Policy

Last updated: 30 July 2026

‍

This Policy describes how Sage Nest ApS ("Sage Nest", "we", "us"), acting as Data Controller, processes the personal data of parents, caregivers and other users ("you", "Parent") who access and use the Platform.

‍

1. Data Controller and Contact Details

The Data Controller for the processing of personal data collected through the Sage Nest platform, website and mobile application (collectively, the "Platform") is: Sage Nest ApS, CVR no. 46566181, Mantuavej 6, 2300 Copenhagen, Denmark. Contact email: [email protected]

Sage Nest has designated an internal privacy contact point responsible for all matters relating to the processing of personal data, which can be reached at [email protected].

The following role allocation applies to your use of the Platform:

• Sage Nest acts as independent Data Controller for all personal data processed to manage your account, your use of the Platform, booking administration, payment facilitation, platform security and compliance with our legal obligations.
• The Expert acts as an independent Data Controller for all personal data you share with them directly, or that we transmit to them for the purpose of providing the Session and the Services. The Expert is required to provide you with their own privacy notice. Sage Nest has no control over, and is not responsible for, the Expert's processing of your personal data. Where a Session is delivered online, the Expert selects and operates the video-conferencing tool used for the Session and sends the connection link to you directly. Sage Nest does not generate, host, transmit or store that link, is not a party to the connection, and has no access to the content of the Session.
• Stripe acts as an independent Data Controller for payment card data and payment instrument data processed through its platform. Please consult Stripe's privacy policy at stripe.com/privacy. Sage Nest retains and processes transaction metadata (booking reference, session date, Expert Fee amount, payment status, refund status) as Data Controller for the purposes set out in Section 2.

‍

2. Types of Data Processed, Purposes and Legal basis

The Controller processes the following categories of personal data through the Platform:

• Registration and contact data: name, surname, email address, telephone number, account credentials. Account creation and management, provision of Platform services (booking, search for Experts). Legal basis: performance of a contract to which you are a party, or pre-contractual measures at your request (Article 6(1)(b) GDPR).
• Booking data and Transaction Metadata: type of Expert requested, session date and time, mode of delivery (in person or online), booking reference, Expert Fee amount, payment status, refund or chargeback status, confirmation logs. Provision of Platform services (booking management, session confirmation, facilitation of payments on behalf of the Expert). Legal basis: performance of a contract (Article 6(1)(b) GDPR). Legal and accounting compliance (see below). Enforcement (see below). Where you book a Session with an Expert who belongs to a regulated health profession, this data also falls within the scope of Article 9 GDPR and is subject to the additional conditions set out under "Data concerning health" below.
• Consumer Rights Documentation: booking reference, session date, timestamp and content of the dual-consent checkbox (express request to perform the Session within the withdrawal period and acknowledgement of loss of the right of withdrawal), confirmation logs, withdrawal request data if submitted. Purpose: management of the right of withdrawal granted under our Terms and Conditions and, where applicable, provided by law, documentation of express consent to early performance, processing of refunds, compliance with consumer protection obligations, and maintenance of proof in accordance with our accountability obligations. Legal basis: performance of a contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR) where the right of withdrawal arises by law, and our legitimate interest in retaining proof of the confirmations you have given (Article 6(1)(f) GDPR).
• Legal, accounting and tax data (practitioners only): full legal name, address, date of birth, tax identification number (CPR or CVR), earnings and transaction data. Purpose: compliance with EU Directive 2021/514 (DAC7) and mandatory annual reporting to Skattestyrelsen (the Danish Tax Agency). Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

• Data concerning health (special categories of data): Some Experts on the Platform belong to regulated health professions. Where you book a Session with such an Expert, the booking record necessarily shows the professional category you have chosen. Sage Nest takes the view that this may indirectly reveal a circumstance relating to your health, and therefore treats such a booking as data concerning health within the meaning of Article 9(1) GDPR — even though we never ask you why you are booking, and receive no clinical information of any kind.
  Data processed: booking reference, session date and time, mode of delivery, the professional category of the Expert booked and the identity of the Expert. Purpose: performing the Booking you have requested and the related payment facilitation. Legal basis: performance of a contract to which you are a party (Article 6(1)(b) GDPR). Condition for the processing of special categories of personal data: your explicit consent (Article 9(2)(a) GDPR), collected in the booking flow by means of a separate, specific and non-pre-ticked consent, distinct from the general privacy information, from marketing consent and from the consumer-rights confirmation described above. This consent relates solely to the individual Booking you choose to make. It is not a condition for creating an account or for using any other feature of the Platform, and you remain free to book Sessions with Experts who do not belong to a regulated health profession. 
  If you do not give this consent, a Booking with an Expert belonging to a regulated health profession cannot be completed. You may withdraw your consent at any time by contacting us at [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Because this consent is the condition on which we may process the data necessary to operate a Booking with an Expert belonging to a regulated health profession, withdrawal will result in the cancellation of any such Booking already confirmed but not yet performed. That cancellation is treated as a cancellation by you under the Cancellation and Rescheduling Policy, which governs any refund due and any amount retained. Withdrawal cannot, however, remove data that we are required to retain under a legal obligation that does not depend on your consent — in particular accounting and invoicing records, records required for reporting under EU Directive 2021/514 (DAC7), and data necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR). Following withdrawal, any such data is retained solely for those purposes, with access restricted accordingly, and is no longer used to operate the Platform or to make Bookings.
  Scope of the health data processed. The booking record described above is the only health-related data processed by Sage Nest. The Platform is designed so that no other health data reaches us: there is no free-text booking notes field, no in-platform messaging or chat function, no intake form or pre-appointment questionnaire, no clinical record, and no storage of session content or of connection links for online Sessions. Sage Nest performs no triage, does not assess your needs on clinical grounds and does not match you to an Expert on clinical grounds. Any information you exchange with the Expert — before, during or after the Session — is processed by the Expert as independent Data Controller under the Expert’s own privacy notice, and does not pass through the Platform.

• Marketing Communications email address. Purpose: sending newsletters, tips, expert advice and updates about Sage Nest services. Legal basis: your specific, freely given, informed and unambiguous consent (Article 6(1)(a) GDPR), collected via a clearly separate, non-pre-ticked checkbox at registration. Retention: until you withdraw your consent or unsubscribe. You may withdraw your consent at any time, without affecting the lawfulness of any processing carried out before withdrawal, by clicking the unsubscribe link in any marketing email or by contacting us at [email protected].
• Payment data: The Platform does not collect or store payment card data. Payment processing is handled by Stripe, who acts as an independent data controller. Please consult Stripe’s privacy policy for further information.
• Navigation data and cookies: IP address, browser type, pages visited, session duration, technical identifiers. Purpose: technical operation of the Platform, security, anonymous statistical analysis. Legal basis: legitimate interest (Article 6(1)(f) GDPR) for strictly necessary cookies; your consent for non-essential cookies. For full details, please consult our Cookie Policy.
• Platform Security, Fraud Prevention, Enforcement and Complaints: navigation data, IP address, usage logs, account activity, booking history, payment metadata, communication records relating to disputes or complaints (namely email correspondence, the Platform providing no messaging function). Purpose: detecting, preventing and responding to fraud, unjustified chargebacks, payment abuse, and attempts to compromise Platform security; enforcing our Terms and Conditions, including account suspension and termination where a serious breach occurs; managing complaints and disputes, and defending or exercising legal claims. Legal basis: legitimate interest of Sage Nest (Article 6(1)(f) GDPR) in protecting the security and integrity of the Platform, protecting the Experts and users, and in the exercise or defence of legal claims. Where account suspension or termination is involved, processing is also necessary for the performance of the contract (Article 6(1)(b) GDPR).

‍

3. Automated decision making (ADM)

Sage Nest does not make decisions with significant legal or similarly significant effects on you based solely on automated processing. Any account suspension or termination involves human review, in accordance with the procedure described in clause 4.3 of the Consumer Terms.

Sage Nest carries out no clinical assessment and no triage, and does not select, rank or recommend Experts on clinical grounds. Search results and listings are generated on the basis of the filters and criteria you choose and of the ranking parameters disclosed in our Terms and Conditions.

‍

4. Nature of Data Provision

Providing personal data for account, booking, legal compliance, security and enforcement purposes is necessary to use the Platform. Refusal will make it impossible to create an account, make bookings or access the Platform's core features.

Where you book a Session with an Expert belonging to a regulated health profession, the explicit consent described in Section 2 is necessary to complete that Booking. Refusing it does not prevent you from using the Platform or from booking Sessions with other Experts.

Providing data for marketing is entirely optional and does not affect your ability to use any feature of the Platform.

Children's data. The Platform is intended for adults. An account may be created, and a Booking may be made, only by a person aged 18 or over acting in their own name. Sage Nest does not request personal data concerning a child and the Platform provides no field in which such data can be entered: we collect no name, date of birth, health information or other personal data of a child. Where a Session concerns a child, any information about the child is exchanged directly with the Expert, who processes it as independent Data Controller under their own privacy notice.

‍

5. Data Retention Period

Personal data is stored for a period not exceeding the achievement of the purposes for which it is processed, in compliance with the principle of storage limitation. Specifically:

‍

‍

Where data is retained after the service relationship has ended, it is retained exclusively for the purpose of compliance with legal obligations, the exercise or defence of legal claims, or the resolution of pending disputes, and access is restricted accordingly.

‍

6. Data Recipients

Your personal data may be shared with the following categories of recipients:

• Experts with whom you have booked a Session, to the extent strictly necessary for the provision of the requested Session. The Expert receives your name, contact details and booking information. The Expert is an independent Data Controller for this data. For online Sessions, the Expert uses its own video-conferencing tool and sends you the connection details directly; that tool receives no data from Sage Nest, and Sage Nest is not a party to the connection.
• Stripe: for payment processing. Stripe acts as an independent Data Controller for payment card data. Sage Nest shares booking reference, amount and transaction status with Stripe as necessary to process your payment and manage refunds and chargebacks.
• Third-party service providers acting as Data Processors on our behalf under a Data Processing Agreement (DPA) compliant with Article 28 GDPR. These are, by category: cloud hosting and database providers; transactional and marketing email delivery providers; and file and media storage providers.
• Skattestyrelsen (Danish Tax Agency): for mandatory DAC7 annual reporting of practitioner earnings.
• Public authorities, courts and regulators: to the extent required by law, court order, or to exercise or defend legal claims.
• Acquirers or successors in the context of corporate transactions: in the event of a merger, acquisition, or business transfer, in accordance with clause 14.4 of the Consumer Terms and with prior notice to you as required.

We do not sell your personal data to third parties, and we do not share it for purposes other than those described in this Policy.

‍

7. International Data Transfers

Your personal data is stored on servers located within the European Union. However, some of our service providers (e.g., Stripe, cloud service providers) may be based or have servers outside the European Economic Area, particularly in the United States. Any transfer of data to such countries is carried out in compliance with applicable law, with appropriate safeguards in place, such as an adequacy decision by the European Commission or through Standard Contractual Clauses (SCCs) approved by the European Commission. You may request further information about the specific transfer safeguards applicable to each provider by contacting us at [email protected]. Where SCCs are used, a copy of the relevant clauses (or a link to them) will be provided upon request.

‍

8. Rights of the Data Subject

As a data subject, you have the right to exercise at any time the rights provided by the GDPR, including:

• Right of access (Article 15): Obtain confirmation as to whether personal data concerning you is being processed, and access to that data.
• Right to rectification (Article 16): Obtain the correction of inaccurate personal data without undue delay.
• Right to erasure (Article 17): Obtain the erasure of your personal data in the cases provided for by law. Please note that certain data may be retained to comply with legal obligations (e.g., accounting records).
• Right to restriction of processing (Article 18): Obtain the restriction of processing where certain conditions apply.
• Right to data portability (Article 20): Receive your personal data in a structured, commonly used, and machine-readable format, and transmit it to another controller where applicable.
• Right to object (Article 21): Object at any time to the processing of data based on legitimate interest, and to object to processing for direct marketing purposes.
• Right to withdraw consent (Article 7(3)): Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Where the consent withdrawn is the explicit consent given for a Booking with an Expert belonging to a regulated health profession, withdrawal operates as described in Section 2 and does not displace retention obligations that do not rest on your consent.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. As the Controller is established in Denmark, the competent authority is Datatilsynet (the Danish Data Protection Authority — www.datatilsynet.dk). You may also lodge a complaint with the supervisory authority of your country of habitual residence.

You can exercise your rights by sending a communication to [email protected].

We will respond to your request without undue delay and in any event within one month of receipt. This period may be extended by a further two months where necessary, given the complexity or number of requests, with prior notice to you.

‍

9. Security Measures

Sage Nest implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risk for your rights and freedoms:

These measures include, without limitation:

• encryption of data;
• access controls and role-based authorisation, ensuring that only authorised personnel access personal data on a need-to-know basis;
• additional access restrictions on booking records that reveal the professional category of the Expert booked, so that such records are accessible only to personnel who require them for booking administration, payment reconciliation or the handling of complaints and disputes;
• password storage using industry-standard hashing algorithms;
• logging of access to personal data systems;
• regular review and testing of security measures;
• data breach detection and response procedures, including notification to Datatilsynet within 72 hours where required under Article 33 GDPR, and communication to you without undue delay where a breach is likely to result in a high risk to your rights and freedoms (Article 34 GDPR).

Payment card data is never stored on Sage Nest's servers and is processed exclusively by Stripe.

All third parties that process personal data on behalf of Sage Nest as data processors are bound by a Data Processing Agreement (DPA) that complies with the requirements of Article 28 GDPR covering in particular: the subject matter and duration of processing; the nature and purpose of processing; the type of personal data and categories of data subjects; the obligations and rights of Sage Nest as Data Controller; and restrictions on sub-processing. Sage Nest maintains a record of its data processors and will provide information about specific processors upon request to [email protected].

‍

10. Changes to the Privacy Policy

The Controller reserves the right to update this policy at any time. Any changes will be published on this page with an updated effective date. If the changes are material, we will inform you by email. Continued use of the Platform after such notification constitutes acceptance of the updated policy. If you do not agree with the updated policy, you may close your account directly in your dashboard or by contacting us at [email protected]. Closure does not affect data retained in compliance with our legal obligations.