Personal data processing policy

1. Who the operator is

The personal data operator is OOO «IMT» (Intellectual Medical Technologies LLC), OGRN 1269600002770, INN 6679188579, address: 620024, Sverdlovsk Region, Yekaterinburg, Bisertskaya St., 16, bldg 1. Questions about personal data: privacy@healthrating.net.

The policy applies to the website healthrating.net, the account area my.healthrating.net, the HemoTrack app and the platform admin area. It is adopted under Federal Law No. 152-FZ of 27 July 2006 “On personal data”.

2. What data we process and why

Data is processed only for the purposes listed below. Each purpose states its legal basis.

2.1. Account

Email address, account country, one-time login codes, device and session details, member number. Basis: the agreement with the user (public offer) and the community rules. The account cannot work without this data.

2.2. Health data

Lab reports (photos, PDFs, data from lab APIs), home readings (blood pressure, weight, glucose and other readings), conditions the user has marked, age and sex for the check-up calendar. This is a special category of personal data. We process it only with a separate written consent of the user for each purpose: interpreting test results, calculating the level and taking part in the community, family members’ data. The consent texts are published in the Documents section.

Readings are interpreted against the lab’s reference intervals and fixed algorithms. The platform does not diagnose, does not assess risks and does not replace a doctor’s consultation. It is not a medical device.

2.3. Level and care points

Facts of completed calendar tasks (date, source, category), the report file hash and order number to prevent duplicates, regularity of home readings, family composition. Basis: consent to take part in the community. The level has no legal consequences: it does not affect the price or availability of services, is not passed to third parties and is not used for decisions about a person. The user can request an explanation of the calculation and file an objection in the account; we reply within 30 days.

2.4. Enquiries from the website

Forms for partners, press and investors: name, organisation, email, phone, city, message. Basis: the consent the user gives when sending the form. Purpose: to reply to the enquiry. Retention: 12 months after the last message on the enquiry.

2.5. Public calculator “What’s covered for me”

The age and sex entered on the website are used only for the calculation and are not stored: they are not written to logs, cookies or analytics.

2.6. Cookies and analytics on the website

Essential cookies store the site language and your choice in the consent dialog; they cannot be switched off. Analytics (Yandex Metrica) and the advertising pixel (VK Ads) are enabled only after your consent in the cookie dialog; form fields are hidden from analytics. You can change your choice at any time via “Cookie settings” in the footer. The account area my.healthrating.net runs without third-party scripts or counters.

2.7. Partner offers

Information about partner discounts is sent only to those who gave a separate consent to receive it. Selections are not built on health data: the catalogue is the same for everyone.

3. Who data is not passed to

• Partners receive only confirmation that a discount code is valid. No level, no test results, no diagnoses, no segments.
• The level is not passed to insurers, employers or other third parties for decisions about a person.
• Health data is not used for advertising and is not passed to advertising networks.

4. Who helps us process data

• Hosting and storage: Selectel cloud infrastructure, servers located in the Russian Federation, in the personal-data segment.
• Email delivery service for login codes: a mail service located in the Russian Federation under a contract with the operator.
• Laboratories: only at the user’s request, to obtain the user’s own results.
• Text recognition and interpretation service: receives an anonymised text request without name, email, member number or other identifiers. Report images and photos never leave our servers.

All processors act under a contract with the operator and may not use the data for their own purposes.

5. Where data is stored

Collection, recording, systematisation, accumulation, storage, updating and retrieval of Russian citizens’ personal data take place in databases located in the Russian Federation. The operator files the notification of the start of processing with Roskomnadzor before processing begins; details of the notification are available on request at privacy@healthrating.net.

6. How long data is kept

• Account and health data: as long as the account exists. After the account is deleted, data is destroyed within 30 days, except what the law requires to keep longer (for example, payment records).
• Level, points and participation history: until the user leaves the community. On leaving they are erased; test results stay with the user.
• Website enquiries: 12 months.
• Cookies: as set by the browser and counter settings, no longer than 13 months.

7. User rights

The user may:

• obtain information about the processing of their data;
• correct, block or delete data;
• withdraw any consent in the account settings;
• export their data from the account;
• leave the community: the level and participation history are erased, test results remain;
• delete the account;
• get an explanation of the level calculation and file an objection;
• appeal the operator’s actions to Roskomnadzor or a court.

Actions with data in the account require a repeated login code. Requests sent to privacy@healthrating.net are handled within 10 working days.

8. Children and family members

The services are intended for people over 18. A child’s profile is created and managed by their legal representative, who also gives consent to process the child’s data. An adult relative gives consent personally, through their own account or invitation.

9. How we protect data

Access to health data is restricted and logged. Data is transmitted over secure channels and stored encrypted. The account area with health data runs on a separate domain without third-party scripts. Public community statistics are published only for groups of at least 50 people, without names.

In the event of a breach the operator notifies Roskomnadzor within the statutory period and informs the users affected.

10. Changes to the policy

A new edition is published in the Documents section with its effective date. The latest published edition is the one in force; the edition history is available on the website.