Personal data processing policy

1. Who processes the data

2. What this policy covers

This policy explains what personal data ProfiMed clinic receives through the website, why it is needed, how it is used and what rights the person who provided it has.

The policy applies to data received through the website. Medical records created during a visit and treatment at the clinic are processed separately, in line with legal requirements and the clinic’s internal rules.

3. What data the website receives

The request form may collect:

• your name or how to address you;
• your phone number;
• the specialty or services you selected, if any.

Through this form we do not request passport details, bank details, test results or medical documents.

The form is not intended for sharing information about your health and does not let you attach medical documents or describe your symptoms in free text. Anything relevant to your visit will be discussed with the doctor in person.

4. What the data is used for

Data from the form is used to:

• contact you;
• clarify your enquiry;
• help you choose the right service;
• arrange your visit to the clinic;
• process the request you submitted.

Submitting the form does not automatically confirm an appointment for a specific time. Once we receive your request, a member of clinic staff will contact you.

We do not use the phone number from your request for marketing messages without separate consent.

5. The basis for processing

The principal basis is your consent to the processing of personal data.

Before submitting the form, you review this policy and confirm your consent to the processing of the data you have provided.

Consent may be withdrawn. In cases directly provided for by the legislation of the Republic of Uzbekistan, certain information may continue to be processed or stored after consent is withdrawn.

6. How long data is kept

A request submitted through the website is kept for 90 days from the date it was sent.

After that period the request is deleted, unless it led to a patient relationship with the clinic or unless further storage is required by law.

If, after making an enquiry, a person becomes a patient of the clinic and the necessary information is entered into the medical information system, its further storage is governed separately from ordinary website request data.

7. Who has access to the data

Within the clinic, access to requests is granted only to staff who need it to handle the enquiry and arrange the appointment.

Data is not sold and is not passed to other organisations for advertising or marketing.

To protect against data loss, the clinic’s information system is backed up daily using Google Drive. Backups are kept for 30 days and then deleted. When this service is used, data may be processed using infrastructure located outside the Republic of Uzbekistan. Google Drive is used solely for the technical backup storage of data, not for advertising or marketing purposes.

Requests submitted through the website are received and processed using the following external services: Cloudflare — stores the request data (name, phone number, specialty or selected services) on the server for the period described in “How long data is kept” (90 days); Telegram — receives and stores the same data in a message in reception’s private group chat, where the request is handled, for up to 30 days — after that period messages are deleted automatically. When these services are used, data may be processed using infrastructure located outside the Republic of Uzbekistan. Both services are used solely to receive and process requests, not for advertising or marketing purposes.

If other external services are used to run the website in future, we will add information about them and the purposes of transfer to this policy before they start being used.

Data may also be provided to state authorities in cases provided for by the legislation of the Republic of Uzbekistan.

8. Technical data of the website

The website may store on your device:

• the language you selected;
• the light or dark appearance;
• a note that the intro screen has been shown;
• other settings needed for the interface.

These settings are used to run the website and are not in themselves intended to identify you.

You can remove them by clearing site data in your browser.

To improve the website, we collect anonymous aggregate counts of public page views, section headings entering the screen and button-link actions. Counters include the day in Tashkent time, language, source category and screen-size category. No cookies, persistent visitor identifiers, IP addresses, form contents, names or phone numbers are stored in these statistics. Aggregates are retained on Cloudflare infrastructure for up to 90 days. Browser Do Not Track and Global Privacy Control settings disable collection.

9. Third-party services

The contacts section may use an embedded Yandex map.

When the map loads, your browser contacts Yandex services. Yandex may then receive technical information — for example your IP address and details of your browser and device — in accordance with its own terms.

The booking page uses the Cloudflare Turnstile widget — a service that checks that the request is being submitted by a person, not an automated program. When the widget loads, your browser contacts Cloudflare services, which may receive technical information such as your IP address and browser details, in accordance with their own terms.

As of this version, the website does not use advertising trackers or external web analytics systems.

If analytics systems, advertising tools or other services affecting users’ personal data are connected in future, we will update this policy before they start being used.

10. Your rights

You have the right to:

• find out whether the clinic holds your personal data;
• receive information about what data is processed and for what purpose;
• ask for inaccurate data to be corrected;
• withdraw your consent;
• demand that processing stop in the cases provided for by law;
• demand deletion of your data where there are no grounds for keeping it;
• apply to the authorised state body or to a court to protect your rights.

These rights are provided for, among other sources, by the personal data legislation of the Republic of Uzbekistan.

For questions about processing, correction, deletion or withdrawal of consent, write to the email address given in “Who processes the data”. Please quote in your message the phone number used when submitting the form so that we can find the corresponding record.

11. How data is protected

The clinic takes organisational and technical measures to protect personal data against:

• access by unauthorised persons;
• unlawful use;
• alteration;
• destruction;
• loss;
• disclosure.

Access to information systems is granted only to authorised staff.

The law likewise requires the owner and the controller to take legal, organisational and technical measures to protect personal data.

12. Changes to this policy

The policy may change as the website, the services it uses or legal requirements change.

The date of the current version is always shown at the top of this page.

If the purposes of processing change substantially, we will seek consent that reflects the new purposes.