Consent to processing health data for interpreting test results

The consent is drawn up as a separate document (Article 9(1) of Federal Law No. 152-FZ of 27 July 2006 “On personal data”) and is requested once, when you first upload a lab report. Without this consent the app stores reports as files and does not interpret readings; all other functions remain available.

1. Data subject

Full name: entered by the user at signing. Address: entered by the user at signing. Identity document: type, series and number, date of issue, issuing authority, entered by the user at signing. Account email address: filled in automatically.

2. Operator

Intellectual Medical Technologies LLC (OOO «IMT»), OGRN 1269600002770, INN 6679188579, address: 620024, Sverdlovsk Region, Yekaterinburg, Bisertskaya St., 16, bldg 1, email privacy@healthrating.net.

3. Purpose of processing

One purpose: storing the results of my laboratory tests and home readings, interpreting readings against the reference intervals of the laboratory that issued the report, and showing how readings change over time.

4. Personal data

Special categories of personal data (health):

• laboratory reports: images, PDF files, data obtained from the laboratory’s information system at my request;
• reading values recognised from reports, units of measurement and the laboratory’s reference intervals;
• home readings I enter myself: blood pressure, weight, glucose and other readings;
• conditions I mark myself, to see what is usually monitored for them.

Other personal data: full name, date of birth, sex, address, identity document details, email address.

5. Actions and methods of processing

Collection, recording, systematisation, accumulation, storage, updating (refreshing, amending), retrieval, use, anonymisation, blocking, deletion, destruction. Processing is automated, in the Operator’s information systems located in the Russian Federation.

For text recognition and explanations of readings the Operator sends the external text-processing service only anonymised text without full name, email, member number or other identifiers; report images and files never leave the Operator’s information systems.

6. Persons processing data on the Operator’s instructions

Selectel JSC (INN 7810962785, 196006, St Petersburg, Tsvetochnaya St., 21, lit. A): computing infrastructure and data storage. Other persons entrusted with processing are named in the Personal data processing policy and disclosed on request.

7. What the Operator does not do

• It does not diagnose, assess disease risks or prescribe treatment. Interpretation of readings is for reference, is not a medical service and does not replace a doctor’s consultation. The Platform is not a medical device.
• It does not pass health data to third parties, including loyalty programme partners, insurers, employers or advertising networks. A laboratory receives a request only for my own results and only at my initiative.
• It does not use health data for advertising or marketing and does not transfer it across borders.

8. Term and withdrawal

The consent is valid from signing until the account is deleted or the consent is withdrawn. It can be withdrawn in the account settings (“Consents”) or by a request to privacy@healthrating.net. After withdrawal, new reports are no longer interpreted; reports uploaded earlier remain in the account as files until I delete them; data processed on the basis of the consent is destroyed within 30 days of withdrawal unless the law provides otherwise. Withdrawal does not affect the lawfulness of processing carried out before it.

9. Signing

The consent is signed with a simple electronic signature: by pressing “I consent” in an account whose access was confirmed by a one-time code sent to my email address. The rules for using the simple electronic signature, for identifying the signatory and the duty to keep the key confidential are set in Section 5 of the Public Offer I accepted at registration (Article 6(2) and Article 9 of Federal Law No. 63-FZ of 6 April 2011 “On electronic signatures”).

The Operator stores the date and time of signing, the edition of the consent text, the account identifier and the details in Section 1. A copy of the signed consent is provided to the subject on request.

By signing, I confirm that I act freely, of my own will and in my own interest, that I have read the Personal data processing policy and that I am aware of the consequences of withdrawal.