Privacy Policy

1.1 This Privacy Policy (hereinafter referred to as the “Policy”) has been developed in accordance with the Law of Ukraine No. 2297-VI “On Personal Data Protection” dated June 1, 2010 (as amended and supplemented) (hereinafter referred to as the “Law”). It defines the fundamental provisions governing the processing, use, dissemination, protection, collection, accumulation and other necessary actions involving personal data and is entered into between Dr.Zhyvago Clinic (hereinafter referred to as the “Clinic” or “Dr.Zhyvago Clinic”) and natural persons or legal entities (hereinafter referred to as the “Personal Data Subject”) entering into contractual relations with the Clinic.

This Privacy Policy is a contract of adhesion within the meaning of Article 634 of the Civil Code of Ukraine.

The requirements of this Policy apply to all users and visitors of the website https://zhyvago.doctor/en/

1. Definitions

Personal Data Database means a named collection of organized personal data in electronic form and/or in the form of personal data filing systems.

Personal Data Processing means any action or set of actions, including collection, registration, accumulation, storage, adaptation, alteration, renewal, use and dissemination (distribution, sale, transfer), depersonalization and destruction of personal data, including through the use of information (automated) systems.

Blocking of Personal Data means the temporary suspension of personal data processing.

Personal Data Controller means a natural person or legal entity that determines the purpose of personal data processing, establishes the composition of such data and the procedures for its processing, unless otherwise prescribed by law.

Recipient means a natural person or legal entity to whom personal data is provided, including a third party.

Third Party means any person other than the Personal Data Subject, the Personal Data Controller or Processor, and the Ukrainian Parliament Commissioner for Human Rights, to whom personal data is transferred by the Controller or Processor.

Use of Personal Data means any actions of the Controller relating to the processing and protection of such data, as well as actions granting other parties to personal data relations a partial or full right to process personal data, performed with the consent of the Personal Data Subject or in accordance with the law.

Collection of Personal Data means actions involving the selection or organization of information about a natural person.

Accumulation of Personal Data means actions involving the combination and systematization of information about a natural person or group of natural persons, or the inclusion of such data in a personal data database.

Storage of Personal Data means actions intended to ensure the integrity of personal data and an appropriate access regime.

Dissemination of Personal Data means actions involving the transfer of information about a natural person with the consent of the Personal Data Subject.

Cross-border Transfer of Personal Data means the transfer of personal data to the territory of a foreign state, a foreign public authority, foreign natural person or foreign legal entity.

Destruction of Personal Data means actions that make it impossible to restore the content of personal data in a personal data information system and/or result in the destruction of physical media containing personal data.

Depersonalization of Personal Data means the removal of information that makes it possible to identify a person directly or indirectly.

Personal Data Subject means a natural person who voluntarily and with full awareness of the consequences provides their personal data to the Personal Data Controller and/or Processor.

Consent of the Personal Data Subject means a voluntary expression of will by a natural person, provided that the person is informed, granting permission to process their personal data for the stated purpose, expressed in writing or in a form that makes it possible to conclude that consent has been given.

Personal Data means information or a set of information about a natural person who is identified or can be specifically identified.

2. General Provisions

2.1 The Clinic processes, stores and uses personal data and determines the purposes of personal data processing, the composition of the personal data to be processed, and the actions (operations) performed with personal data, namely:

2.1.1. Collection of personal data;

2.1.2. Accumulation and storage of personal data;

2.1.3. Dissemination (distribution, sale, transfer) of personal data;

2.1.4. Use of personal data;

2.1.5. Registration of personal data;

2.1.6. Adaptation of personal data;

2.1.7. Alteration of personal data;

2.1.8. Renewal of personal data;

2.1.9. Depersonalization of personal data;

2.1.10. Other actions involving personal data that are necessary for the purposes of this Policy.

2.2 The Clinic processes personal data in accordance with the Law of Ukraine “On Personal Data Protection” and other laws and regulations of Ukraine.

3. Principles of Personal Data Processing

3.1 The Clinic accepts and ensures compliance with the following principles of personal data processing:

3.1.1. personal data shall be processed only on lawful grounds;

3.1.2. processing shall be performed subject to the Personal Data Subject's consent to such processing;

3.1.3. only personal data that is consistent with the purposes of its processing shall be processed;

3.1.4. the content and scope of the personal data processed shall correspond to the stated purposes of processing;

3.1.5. personal data processing shall ensure the accuracy and adequacy of personal data and, where necessary, its relevance to the purposes of processing;

3.1.6. personal data shall be processed in compliance with data protection requirements;

3.1.7. personal data shall not be transferred to foreign parties to personal data relations where the jurisdictions of such foreign parties do not ensure adequate personal data protection;

3.1.8. processed personal data shall be destroyed or depersonalized once the purposes of processing have been achieved or the need to achieve such purposes no longer exists, unless otherwise provided by this agreement or other laws of Ukraine;

3.1.9. upon gaining access to personal data, the Clinic shall not disclose it to third parties or disseminate it without the consent of the Personal Data Subject, unless otherwise provided by this agreement or other laws of Ukraine;

3.2. By accepting the terms of this Policy, the Personal Data Subject provides their full and unconditional consent to the inclusion and use of their personal data in the User Database and to the processing of their personal data by the Clinic, including collection, registration, accumulation, storage, adaptation, alteration, renewal, use and dissemination, depersonalization and destruction of personal data, including through information (automated) systems, and any other actions that the Clinic may perform with their personal data.

3.3. For the purposes of Clauses 3.1.1–3.1.9, the Clinic is entitled (and the Personal Data Subject grants the Clinic such right) to collect and process the following personal data: first name, last name, patronymic, contact details, electronic identification data such as telephone number and email address, the selected doctor if specified by the user in the appointment form, the text of a question or message submitted through a form, cookies, taxpayer identification number, and other personal data and information provided in compliance with applicable law and/or voluntarily provided by the Personal Data Subject to the Clinic for registration of the Personal Data Subject in the Electronic Healthcare System (where required by law) and in the database of users (clients, patients, etc.).

3.4. The Clinic is entitled to collect and process personal data contained in documents (or copies thereof), messages, photographs, images or other sources provided to the Clinic by Personal Data Subjects where such documents are submitted voluntarily and without a prior request from the Clinic.

3.5. Where a Personal Data Subject provides the Clinic with their photographs or documents containing their image (if the image makes it possible to identify that Subject), the Personal Data Subject gives their full and unconditional consent to the Clinic's use of such documents, photographs or images for the purposes defined in this Policy.

3.6. The Personal Data Subject grants the Clinic the right to use their personal data to send postal and SMS messages and messages via messengers (Viber, Telegram, WhatsApp, Facebook Messenger, etc.), including promotional and informational communications (materials); to process the Personal Data Subject's requests and applications; to establish and perform civil-law and commercial-law relations; to process payments and maintain accounting and tax records; to communicate and maintain contractual relations with public authorities, counterparties and other third parties in the course of business; and for other purposes that do not conflict with applicable law.

4. Conditions and Purposes of Processing

4.1. The Clinic processes personal data in the following cases:

4.1.1. where the Personal Data Subject has consented to such processing in writing or in another form that makes it possible to conclude that consent has been given;

4.1.2. where processing is necessary to exercise the rights and legitimate interests of the Clinic or third parties or to achieve public interests;

4.1.3. where processing is necessary to perform a contract to which the Personal Data Subject is a party, beneficiary or guarantor, or to enter into a contract at the initiative of the Personal Data Subject or a contract under which the Personal Data Subject will be a beneficiary or guarantor;

4.1.4. where processing is necessary for the Personal Data Subject to exercise rights and perform obligations in employment relations in accordance with the law and subject to appropriate safeguards.

4.2. Personal data shall be processed openly and transparently using means and methods consistent with the specified purposes of processing.

4.3. The Clinic processes personal data to provide users with access to and use of the website and to enable appointments with the Clinic's specialists in accordance with this Policy.

5. Personal Data Processing

5.1. When processing personal data, the Clinic performs the following action(s), using or without using automated means: collection, recording, systematization, accumulation, storage, clarification (updating or alteration), retrieval, use, transfer (dissemination, provision or access), depersonalization, blocking, deletion and destruction, except where a narrower scope of actions is determined by the nature and purpose of personal data processing and agreed with the Personal Data Subject.

5.2. The Clinic does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health, intimate or private life, or information concerning the Personal Data Subject's membership in public associations or trade unions, except where such data is necessary to provide services and is collected and processed by the Clinic's employees or engaged specialists in accordance with this Policy.

5.3. The Personal Data Subject may withdraw this consent by sending a notice to the Clinic at psycliniczhyvago@gmail.com at least 30 (thirty) days before the intended effective date of withdrawal. The Personal Data Subject agrees that during this period the Clinic is not required to discontinue personal data processing or destroy the Personal Data Subject's personal data. Withdrawal shall not have retroactive effect with respect to personal data processed before the withdrawal takes effect.

5.4. Certain categories of personal data processed by the Clinic may be transferred across borders. In such cases, the Clinic complies with the requirements for such transfers established by Ukrainian law and international treaties.

5.5. The Clinic does not transfer personal data across borders without the separate consent of the Personal Data Subject. A cross-border transfer of personal data to countries that do not ensure adequate protection of the rights of Personal Data Subjects may take place only with the Personal Data Subject's consent to the cross-border transfer, given in writing or in a form that makes it possible to conclude that consent has been given, or as part of the performance of an obligation to which the Personal Data Subject is a party.

5.6. In accordance with Ukrainian personal data protection law, the Clinic undertakes to ensure proper protection of personal data against unlawful processing and unauthorized access, including taking the measures necessary to prevent disclosure by employees and/or other authorized persons of the Clinic to whom such personal data has been entrusted or who became aware of it in connection with the Clinic's obligations to Personal Data Subjects.

5.7. The Personal Data Subject has the right to know the sources from which their personal data is collected, the location of their personal data, the purpose of its processing, and the location or place of residence (stay) of the Personal Data Controller or Processor; to receive information about the conditions for granting access to personal data; to access their personal data; and to exercise other rights provided by Ukrainian law.

6. Personal Data Retention and Destruction Requirements

6.1. Personal data shall be deleted or destroyed:

6.1.1. upon expiry of the retention period established by the Personal Data Subject's consent to the processing of such data or by law;

6.1.2. upon termination of the legal relationship between the Personal Data Subject and the Controller or Processor, unless otherwise provided by law;

6.1.3. when a court decision requiring the deletion or destruction of personal data enters into force.

6.2. Personal data shall be retained for a reasonable period necessary for the Clinic to provide services, which shall not exceed 5 (five) years from the date on which the Personal Data Subject gives this consent.

6.3. Upon expiry of the personal data retention period specified in Clause 6.2 of this Policy, the Clinic may automatically extend the retention period by 3 (three) years if, following expiry of the retention period, the Personal Data Subject does not request destruction of the personal data.

6.4. The Clinic is entitled to update personal data periodically.

7. Ensuring Personal Data Protection

7.1. The Clinic protects personal data against accidental loss or destruction, unlawful processing, including unlawful destruction, and unauthorized access.

7.2. The Clinic shall not be liable for any processing of a Personal Data Subject's personal data, or for any failure by third parties, including employees, to maintain access controls or protect such data, if access to such personal data (or any other action creating the possibility of subsequent unauthorized processing by third parties) was granted or performed by the Clinic or another person with the Personal Data Subject's permission outside the performance of obligations arising from this Policy, for personal purposes or other purposes unrelated to the performance of obligations under transactions with the Clinic, using the Clinic's technical facilities or other materials/equipment.

7.3. This Policy applies only to the Clinic's website and to registration, appointment-booking and similar procedures. The Clinic accepts no liability for data processing occurring after a user leaves the website and visits other websites.

7.4. Employees and specialists engaged by the Clinic may create and maintain their own professional notes, records or clinical documentation in accordance with applicable professional obligations and Ukrainian law. The collection and processing of personal data in the course of legal relations between patients (clients) of the Clinic is governed by Ukrainian healthcare law and is not subject to this Policy. Relations concerning the protection of personal data and confidential information obtained by employees or engaged specialists of the Clinic in the course of providing services are governed by applicable Ukrainian law.

7.5. This Policy does not regulate the use of information and data constituting medical confidentiality. The Clinic may collect data relating to health where the Personal Data Subject voluntarily provides health information and may use such data only for initial communication, responding to an inquiry or arranging a consultation.

8. Data Transfer

8.1. By accepting the terms of this Policy and for the purposes specified in Section 4, the Personal Data Subject gives their full and unconditional consent to the transfer of personal data to third parties where such transfer corresponds to the purpose of personal data processing and is necessary to provide services/perform work for Personal Data Subjects.

8.2. Personal data may also be transferred to authorized public authorities and Ukrainian law enforcement agencies solely on the grounds and in accordance with the procedure established by Ukrainian law.

9. Use of Cookies and Other Automated Data Processing Services

9.1. When a visitor accesses the website using a computer or other communication device, cookies will be placed on that device. A cookie is a data file that helps identify the visitor's browser. The Clinic is entitled to use cookies.

9.2. The Clinic is entitled to collect and use information about the user's IP address and to collect data using Google Tag Manager, Google Analytics 4, Google Ads, Meta Pixel, Google Maps, Telegram, Viber, WhatsApp and Gmail.

10. Use of Personal Data and Confidential Information by Users

10.1. When visiting and using the website, users shall comply with this Policy and applicable Ukrainian law when using other persons' confidential information or personal data in publications, comments, reviews and other information sources.

10.2. When using personal data and confidential information relating to other persons, users and visitors of the website shall have sufficient authority to do so.

10.3. Unlawful use of personal data and confidential information by website users is prohibited. If the Clinic receives a complaint from another person concerning unlawful use or disclosure of another person's personal data, the Clinic may impose the restrictions or prohibitions specified in this Policy.

10.4. The Clinic shall not be liable to other persons and shall not be responsible for damages (direct damages or lost profits) caused by users' breach, through their acts or omissions, of Clauses 10.1–10.3 of this Policy.

11. Other Terms

11.1. The Personal Data Subject accepts and agrees to this Policy by giving unconditional consent through selecting the relevant checkbox and clicking the “Book an Appointment”, “Send” or other web-form submission button that provides for consent to personal data processing and contains a link to this Policy; during registration or a visit to the website; by taking any action intended to establish a legal relationship with the Clinic (requesting a consultation, registering for an appointment, etc.); or in another form that makes it possible to conclude that consent has been given by the Personal Data Subject and to identify that Subject.

11.2. The Personal Data Subject accepts this Policy of their own free will, without coercion, and with an understanding of the legal consequences of this Policy.

11.3. By accepting this Policy, the Personal Data Subject confirms that its provisions are clear and understandable to them. By accepting this Policy, the Personal Data Subject confirms their agreement with the procedure and conditions for processing their personal data and confirms that the purpose and objective of the personal data processing have been communicated to and understood by them.

11.4. The Personal Data Subject's personal data shall be destroyed if the Personal Data Subject requests its destruction, within the time limits specified in Clauses 6.2–6.3 of this Policy.

11.5. This Policy is deemed concluded and takes legal effect when the Personal Data Subject accepts its terms.

11.6. The text of this Policy is available on the Clinic's website at https://zhyvago.doctor/en/privacy-policy

11.7. This Policy is available for review by an unlimited number of persons.

11.8. The Clinic amends this Policy by publishing a new version, which takes effect on the date of publication.

11.9. The provisions of this Policy apply to all users. Users are not entitled to request amendments to this Policy.