Personal data processing policy

1. General provisions

1.1. This Policy sets out how Intellectual Medical Technologies LLC (OOO «IMT», OGRN 1269600002770, INN 6679188579, address: 620024, Sverdlovsk Region, Yekaterinburg, Bisertskaya St., 16, bldg 1; the Operator) processes and protects the personal data it receives through the website healthrating.net, the account area my.healthrating.net, the HemoTrack app and the platform management panel (together, the Platform).

1.2. The Policy is drawn up under Federal Law No. 152-FZ of 27 July 2006 “On personal data” (the Personal Data Law), Federal Law No. 149-FZ of 27 July 2006 “On information, information technologies and information protection”, Federal Law No. 63-FZ of 6 April 2011 “On electronic signatures”, Law No. 2300-1 of 7 February 1992 “On consumer protection”, Government Decree No. 1119 of 1 November 2012 and Roskomnadzor regulations. It is published under Article 18.1(2) of the Personal Data Law.

1.3. The Operator has appointed a person responsible for organising personal data processing (Article 22.1 of the Personal Data Law). Personal data enquiries are accepted at privacy@healthrating.net and at the Operator’s postal address.

1.4. The Operator filed a notification of personal data processing with Roskomnadzor before processing began (Article 22 of the Personal Data Law). Details are available on request.

1.5. The terms “personal data”, “operator”, “processing”, “anonymisation” and “special categories of personal data” have the meanings given in Article 3 of the Personal Data Law. User means any individual using the Platform; Member means a user who has joined the HealthRating community.

2. Processing principles

The Operator processes personal data lawfully and fairly, limits processing to specific, predefined and lawful purposes, does not merge databases kept for incompatible purposes, processes only data that meets the purposes, keeps it accurate and sufficient, retains it no longer than the purposes require, and destroys or anonymises it once the purposes are achieved (Article 5 of the Personal Data Law).

3. Data subjects, data, purposes and legal bases

3.1. Platform users (account). Data: email address, account country, one-time login codes, device, session and IP address details, member number, account activity history. Purposes: concluding and performing the agreement with the user, identification, account security. Legal basis: the agreement to which the subject is a party (Article 6(1)(5) of the Personal Data Law) and the Operator’s legitimate interest in security (Article 6(1)(7)).

3.2. Users who upload health data. Data: laboratory reports (images, PDFs, data from laboratory systems), reading values and reference intervals, home readings (blood pressure, weight, glucose and other readings), conditions marked by the user, age and sex, and the full name, address and identity document details given in the consent. Health data is a special category of personal data. Purposes: storing reports, interpreting readings against the laboratory’s reference intervals, showing trends, the age- and sex-based check-up calendar. Legal basis: the subject’s written consent drawn up as a separate document (Articles 10(2)(1), 9(1) and 9(4) of the Personal Data Law) and signed with a simple electronic signature under Section 5 of the Public Offer.

3.3. Community members. Data: facts of completed calendar tasks (date, source, category), report details (laboratory, order number, file hash), regularity of home readings without values, family composition on the Platform, level, points, participation history. Purposes: calculating the level and care points, the family level, member privileges, seasonal events. Legal basis: the subject’s separate consent (Article 6(1)(1)).

3.4. Family members. A child’s data: name or profile label, date of birth, sex, health data, facts of completed tasks. An adult relative’s data: calendar completion share in a form anonymised for the family, the fact of family membership. Purposes: family profiles, family level. Legal basis: the legal representative’s consent for the child (Article 9(6)) and the adult relative’s own consent.

3.5. People who send an enquiry through the website (partners, press, investors). Data: name, organisation, email, phone, city, message text. Purpose: replying to the enquiry. Legal basis: consent expressed by a separate action when sending the form.

3.6. Draw winners. Data: full name, date of birth, INN, identity document details, address, contact details. Purposes: delivering the prize and performing tax agent duties. Legal basis: law (Article 6(1)(2); Articles 226 and 230 of the Tax Code). A winner’s city is published only with a separate consent to dissemination (Article 10.1).

3.7. Website visitors. Data: cookies, device and browser identifiers, IP address, pages viewed. Purposes: website operation, web analytics, advertising campaign measurement. Legal basis: for essential cookies, the Operator’s legitimate interest in running the site; for analytics and advertising cookies, the user’s consent given in the consent dialog before the relevant scripts load (Section 6).

3.8. Age and sex entered into the public “What’s covered under OMS” calculator without logging in are used only for the calculation at the time of the request, are not stored and are not passed to analytics.

4. Processing conditions

4.1. The Operator processes personal data with and without automation: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion, destruction.

4.2. The Operator makes no decisions that have legal consequences for the subject or otherwise affect their rights and legitimate interests solely on the basis of automated processing (Article 16 of the Personal Data Law). A member’s level does not affect the price or availability of services, is not passed to third parties and is not used for decisions about a person. A member may obtain an explanation of the level calculation and file an objection; an authorised employee of the Operator reviews it within 30 days.

4.3. Health data is not used for advertising or marketing and is not passed to advertising networks or partners. Messages about partner offers are sent only with a separate consent (Article 15(1) of the Personal Data Law, Article 18(1) of Federal Law No. 38-FZ “On advertising”).

4.4. Anonymisation for statistics and for requests to the external text-processing service uses methods that make it impossible to identify the subject without additional information, which the Operator keeps separately.

5. Transfer and delegated processing

5.1. The Operator entrusts processing to the following persons under contracts containing the terms required by Article 6(3) of the Personal Data Law:

• Selectel JSC (INN 7810962785, 196006, St Petersburg, Tsvetochnaya St., 21, lit. A): computing infrastructure and data storage in the Russian Federation;
• an email delivery service operating in the Russian Federation: delivery of one-time login codes and notifications;
• a payment provider: accepting payments for paid services; the Operator neither receives nor stores full bank card details.

The current list of such persons with names and addresses is provided on request.

5.2. Laboratories receive a request for test results only at the user’s initiative and only for the user’s own results.

5.3. Loyalty programme partners receive only confirmation that a discount code is valid. Level, test results, marked conditions and other data are not passed to partners.

5.4. Level, points and health data are not passed to insurers, employers or other third parties for decisions about the subject.

5.5. Personal data may be provided to state bodies on the grounds and in the manner prescribed by federal law.

5.6. No cross-border transfer of personal data takes place. The external text recognition and processing service receives only anonymised text without name, email, member number or other identifiers; report images and photos never leave the Operator’s infrastructure. Should the Operator decide to transfer personal data across borders, it will notify Roskomnadzor before the transfer begins and comply with Article 12 of the Personal Data Law.

6. Cookies and website analytics

6.1. Essential cookies keep the site running: they store the chosen language, the state of the consent dialog and form protection. They are set without consent, and the user is informed of this in the cookie dialog.

6.2. Analytics cookies (Yandex Metrica, Yandex LLC) and advertising cookies (VK Ads pixel, VK LLC) are set only after the user’s explicit consent given by a separate action in the cookie dialog. Until consent is given, the relevant scripts are not loaded. Form field data is hidden from analytics; on calculator pages age and sex are not passed to analytics.

6.3. The user may change or withdraw cookie consent at any time via “Cookie settings” in the site footer, and delete cookies in the browser. Withdrawal does not affect access to the site.

6.4. The account area my.healthrating.net and the management panel run without third-party scripts or counters.

6.5. Cookie retention depends on purpose and does not exceed 13 months.

7. Retention and destruction

7.1. Account and health data are kept while the account exists. After account deletion or withdrawal of consent, data is destroyed within 30 days (Article 21(5) of the Personal Data Law), except data whose retention period is set by law.

7.2. Level, points and participation history are destroyed when the user leaves the community; reports and readings remain in the user’s account.

7.3. Website enquiries are kept for 12 months from the last message on the enquiry.

7.4. Documents relating to payments and prizes are kept for the periods set by tax and accounting law.

7.5. Destruction is documented by an act or logged as Roskomnadzor requires.

8. Data subject rights

8.1. The subject may (Articles 14, 20 and 21 of the Personal Data Law):

• obtain information about the processing of their personal data to the extent of Article 14(7);
• demand that incomplete, outdated, inaccurate or unlawfully obtained data be corrected, blocked or destroyed;
• withdraw consent to processing in full or for a particular purpose;
• obtain an explanation of the level calculation logic and object to it;
• export their data from the account;
• leave the community and delete the account;
• appeal the Operator’s actions or inaction to Roskomnadzor or a court.

8.2. Rights are exercised in the account settings (sensitive actions require a repeated login code) or by request to privacy@healthrating.net. A request must contain details that identify the subject and the substance of the demand. The Operator replies within 10 working days; the period may be extended by no more than 5 working days with notice to the subject (Article 20(1) and (4)).

8.3. Withdrawal of consent does not affect the lawfulness of processing carried out before it. The Operator may continue processing without consent where the grounds in Article 6(1)(2)–(11), Article 10(2) or Article 11(2) of the Personal Data Law apply.

9. Minors and family members

9.1. The Platform’s services are intended for people aged 18 and over. A child’s profile is created and managed by their legal representative, who consents to the processing of the child’s data and confirms their authority.

9.2. An adult relative consents to family membership personally through their own account. Consent given by one adult on behalf of another is not accepted.

10. Protection measures

10.1. The Operator takes legal, organisational and technical measures under Article 19 of the Personal Data Law and Government Decree No. 1119: a protection level is defined, a responsible person appointed, internal regulations adopted, access to health data restricted and logged, encryption in transit and at rest, backups, session control and protection against unauthorised access are applied.

10.2. Databases containing personal data of Russian citizens are located in the Russian Federation (Article 18(5) of the Personal Data Law).

10.3. Public community statistics are produced only for groups of at least 50 people and do not allow a subject to be identified.

10.4. On detecting an unlawful transfer (provision, dissemination, access) of personal data, the Operator notifies Roskomnadzor within 24 hours and reports the results of the internal investigation within 72 hours (Article 21(3.1)), and informs the affected subjects.

11. Final provisions

11.1. The Policy is public and is published in the Documents section. A new edition takes effect on the date stated at publication; the latest published edition is the one in force, and the edition history is available on the website.

11.2. Matters not covered by the Policy are governed by the law of the Russian Federation.