1. General provisions
This policy explains how personal data are processed when you contact Ahvar & Ahvat, use the website, arrange services or communicate with the administration. Personal data are information relating to an identified or identifiable individual. Processing may include collecting, recording, organising, storing, updating, using, necessarily disclosing and deleting that information.
This policy is informational and does not replace separate consent, a service agreement or documents governing medical practice. The scope of processing should correspond to its specific purpose and applicable legal requirements. Questions about who is responsible for processing in connection with your enquiry can be addressed to the administration using the current website contact details.
2. Data that may be processed
Depending on your enquiry and the information provided, the following categories may be processed:
- Surname, first name and patronymic or middle name, if provided; telephone number and email address.
- Date of birth and gender, where necessary for the relevant service and provided on an appropriate basis.
- The content of enquiries, the selected service, appointment details and the history of interactions and services received, to the extent necessary to organise those services.
- Information about giving or withdrawing consent: its type, date, source and supporting evidence, where recorded.
- Technical information that may arise when the website operates: IP address, browser and device information (User-Agent), and operational request logs.
- Other information an individual voluntarily provides for consideration of their enquiry.
This list does not mean that all data are collected from every visitor. Please do not send diagnoses, test results, medical documents or other sensitive information through general website forms or ordinary SMS. This policy does not establish procedures for processing medical records: where necessary, such information is provided separately through a channel agreed with the clinic and on an appropriate legal basis.
3. Purposes of processing
- Considering an enquiry, answering questions and communicating using the contact details provided.
- Arranging appointments, agreeing a time, changing or cancelling appointments and coordinating service delivery.
- Maintaining necessary administrative records of interactions and fulfilling applicable obligations.
- Sending service notifications related to an enquiry where an appropriate basis exists.
- Maintaining website operation and security, identifying technical errors and preventing abuse.
- Sending advertising offers exclusively with separate marketing consent.
Data should not be used for purposes incompatible with the stated purpose without an appropriate basis. For each purpose, the scope of information should be limited to what is genuinely necessary.
4. Service SMS and marketing messages
Service SMS relate to a specific enquiry or service, such as an appointment confirmation, a reminder of an agreed time or notification of an appointment change. They should not be replaced with advertising and are sent where there is a basis for that interaction.
Messages about promotions, discounts and advertising offers are marketing. They require separate consent. Consent to personal data processing, receiving a service or a service notification does not mean consent to advertising. Declining marketing does not in itself prevent you from requesting services.
5. Processing grounds and consent
Processing takes place on the basis of the individual's consent or another applicable lawful basis connected with their enquiry or the fulfilment of contractual or statutory obligations. The specific basis depends on the purpose and circumstances of processing.
Where consent is required, it must be expressed through an informed affirmative action after reviewing information about the purpose and scope of processing. Merely visiting the website, reading this page, having a telephone number in a database or not objecting does not constitute consent. Personal data consent and marketing consent are recorded separately; a system entry alone does not prove that consent is valid.
6. Data sources and administrative records
Information may come directly from an individual through the website, by telephone, during an in-person enquiry or through another agreed channel. An administrator may also record information obtained during such interactions or transfer it from a previously used system or file where an appropriate basis exists.
An administrative entry or import identifies how information was entered, not independent consent from a patient. An existing record does not mean that the individual registered on the website or personally confirmed consent online. The source, currency and processing basis of entered and imported information need to be checked; marketing consent cannot be inferred solely from an import.
7. Storage and retention
Data are retained no longer than necessary for the relevant purpose, taking into account applicable mandatory periods, the fulfilment of obligations and the need to consider substantiated claims. No arbitrary uniform retention period is set for all categories of information.
Once the purpose has been achieved or the processing basis has ended, data should be deleted or anonymised unless further retention is required on another lawful basis. This principle should also be considered for import files, message logs and backups; their removal procedures depend on the actual storage arrangements and applicable requirements.
8. Data protection
Processing arrangements should include proportionate organisational and technical measures against unlawful access, disclosure, alteration, loss and destruction. Access should be restricted to the duties of authorised staff and necessary service providers, and the information available to them should be limited to their operational needs.
This policy does not assert any specific certification, particular encryption method or absolute security. Do not transmit passwords, payment credentials or medical documents through general contact forms.
9. Disclosure to third parties
Where necessary to arrange a service or operate the website, the minimum necessary information may be disclosed to providers performing the relevant function, for example communications, SMS delivery, website hosting or technical support. SMS delivery may require the recipient's number, the service message text and technical delivery information.
Disclosure should have an appropriate basis and be limited to the stated task, taking confidentiality and applicable requirements into account. Information may also be provided to authorised public bodies where required by law. Data are not intended for sale or disclosure to unrelated advertisers without a separate basis. Using an external service does not in itself authorise that provider to market independently to the recipient.
10. Rights concerning your data
To the extent provided by applicable law, you may request:
- Clarification of whether your data are processed, for what purposes, from which sources and to whom they may be disclosed.
- Information about your data and how they are processed.
- Correction of inaccurate information or completion of incomplete data.
- Cessation or restriction of processing, or deletion of data, where grounds exist.
- Withdrawal of consent and an end to marketing messages.
- Protection of your rights through a competent authority or court under the applicable procedure.
To prevent disclosure to unauthorised individuals, the administration may request proportionate confirmation of identity or a representative's authority. Requests are considered in accordance with applicable requirements; some information may be retained where the law requires it.
11. Withdrawing consent
To withdraw consent, contact the administration using the current website contact details. Specify which consent you are withdrawing — personal data processing or marketing — and provide a contact detail that allows the relevant record to be located. Do not include unnecessary or sensitive information in your initial message.
After the request has been received and verified, processing based solely on the withdrawn consent should cease. Withdrawal does not invalidate lawful processing before receipt and does not prevent retention or processing necessary on another lawful basis. If a requested service cannot be arranged without particular data, the administration should explain this separately; declining advertising does not mean declining service communications.
12. Cookies and technical data
The website may use technical cookies and session data necessary for forms to work, to maintain session state and to protect against invalid requests. Technical request information may be processed to maintain operation and security.
This policy does not assert the use of any specific analytics system, advertising pixels or cross-site tracking. If optional technologies are introduced, information about them and any necessary consent mechanisms should be established separately before use. Browser settings allow cookies to be restricted, but disabling technical cookies may affect some functions.
13. Personal data contacts
Address questions about processing, correction or deletion of data, and requests to withdraw consent, to the Ahvar & Ahvat administration. Use the current telephone numbers and other contact methods published on the website's Contacts page. State the subject as “Personal data” and indicate a convenient way to receive a reply.
Contact information is maintained in the website settings. This policy does not replace it or provide unverified legal entity details, an address or an email account. Do not publish personal information in public reviews or comments.
14. Policy updates
This policy may be revised when processing activities or applicable requirements change. The update date of the current version is displayed on the page using the modification date of this CMS record. Review the current version before giving consent; updating the text does not in itself extend previously given consent.