PRIVACY AND PERSONAL DATA PROTECTION POLICY
Dokos Medical Centre | https://docos.one/
- General Provisions
1.1. This Privacy and Personal Data Protection Policy (the “Policy”) establishes the procedures for collecting, registering, accumulating, storing, using, disclosing, protecting and destroying personal data of individuals in connection with the activities of Dokos Medical Centre, including the provision of medical services, use of the website and electronic services, telephone communications and advertising forms.
1.2. The controller of personal data is Limited Liability Company “DOKOS MEDICAL” (EDRPOU identification code 40484717; registered address: 3 Oleksiivska Street, Kyiv, 03110, Ukraine; hereinafter the “Company”). Medical services are provided, inter alia, at 52 Hetmana Pavla Polubotka Street, Kyiv, and 20A Volodymyra Ivasiuka Avenue, Kyiv.
1.3. This Policy applies to the personal data of patients, their legal representatives, website visitors and individuals who contact the Company. It covers data held in electronic and paper form, regardless of the medium.
1.4. Data processing is carried out in accordance with the Constitution of Ukraine, the Laws of Ukraine “On Personal Data Protection” and “On Information”, the Fundamentals of Ukrainian Legislation on Health Care and other applicable regulatory acts. The terms for the provision of medical services are governed by separate public agreements published on the website.
- Types and Categories of Personal Data
2.1. Depending on the purpose of the inquiry, the Company may process: surname, given name and patronymic; date of birth; contact telephone number, email address and residential address; information from identity documents; information concerning a legal representative; and information required for registration, appointment booking, payment and organisation of services.
2.2. In providing medical services, the Company processes information on health conditions, complaints, medical histories, diagnoses, examination results, tests and analyses, prescriptions and treatment orders, referrals, medical reports and other medical records. Such information constitutes special categories of personal data and is processed in compliance with applicable special legal requirements and medical confidentiality.
2.3. When the website is used, the Company may process IP addresses, device and browser technical characteristics, event logs, cookies, page-view information, referral sources and advertising campaign parameters. The scope of such data depends on the services actually enabled and the user’s settings.
- Sources of Data and Legal Grounds for Processing
3.1. Personal data are obtained directly from individuals or their legal representatives upon registration, execution of documents, booking of appointments, telephone inquiries, email correspondence and completion of forms on the website or on Facebook and Instagram; data may also be obtained from authorised sources in cases provided for by law.
3.2. The legal grounds for processing include the data subject’s consent, the necessity to enter into or perform a contract, compliance with a legal obligation, protection of vital interests, or another ground provided for in Article 11 of the Law of Ukraine “On Personal Data Protection”. Health data are processed only where an appropriate legal ground exists and the conditions stipulated by Article 7 of that Law are met.
- Purposes of Personal Data Processing
4.1. Personal data are processed for the purposes of identifying patients and their representatives; arranging appointments; providing medical, diagnostic, preventive and telemedicine services; maintaining medical and administrative records; entering information into the Electronic Health Care System (EHCS) where required by law; issuing electronic prescriptions, referrals and reports; processing payments; communicating with patients; handling inquiries and complaints; and fulfilling the Company’s statutory obligations.
4.2. Where an appropriate legal ground exists, contact details may be used to provide information about services, promotions and preventive healthcare measures. Consent to promotional communications is not a prerequisite for receiving medical care and may be withdrawn.
- Medical Information, EHCS and Telemedicine
5.1. Information about a person’s health, the fact that they sought medical care, their diagnosis and examination results is protected by medical confidentiality. Access is granted only to persons who require it to perform their professional duties or who have another lawful ground for such access.
5.2. Medical data are processed in medical information systems and the EHCS in accordance with applicable regulations and established access rules. Disclosure of information to the EHCS, other healthcare facilities, authorities or authorised persons is permitted on grounds provided for by law.
5.3. During video consultations, the Company may process identity and contact details, documents and test results provided by the patient, information communicated to the physician during the consultation, and technical data concerning the video session. Video consultations are not recorded by default; recording is permitted only where there is an appropriate legal ground and applicable legal requirements are met.
5.4. Medical recommendations may be provided in a manner stipulated by the relevant agreement, including by electronic means of communication, taking into account the need to protect confidential information. The terms and procedures for video consultations are governed by a separate Public Agreement (Offer) for the Provision of Paid Medical Services Using Telemedicine (Video Consultations).
- Telephone Inquiries and Electronic Communications
6.1. The Company may process information concerning inquiries by telephone, email and messaging services in order to book, confirm or reschedule appointments, perform agreements and handle inquiries. Telephone calls may be recorded for service quality control and to confirm the content of inquiries where there is a lawful ground; the individual must be duly informed of the recording.
6.2. Medical documents are transmitted through electronic channels using available protective measures and taking account of the risks associated with the relevant channel. Individuals are advised not to disclose diagnoses in public comments or advertising forms.
- Data Processing via the Website and Advertising Lead Forms
7.1. When forms are completed on https://docos.one/ or in Facebook and Instagram advertising lead forms, the Company may receive a name, telephone number, email address, details of the requested service and other fields completed voluntarily by the individual. Such data are used to process the inquiry, respond and arrange an appointment; promotional messages are sent only where a separate appropriate legal ground exists.
7.2. Data entered in a lead form are transferred to the Company via the relevant platform; the platform may also process such data under its own privacy policy. The Company does not ask for diagnoses, symptoms, test results or other sensitive medical information in such forms. The content and configuration of advertising forms must comply with this Policy.
7.3. Meta Privacy Policy: https://www.facebook.com/privacy/policy/
Google: https://policies.google.com/privacy.
- Cookies, Analytics and Advertising Technologies
8.1. The website may use strictly necessary, functional, analytical and advertising cookies, as well as Google Analytics, Google Tag Manager, Google Ads, Meta Pixel or similar tools, where actually enabled. Their purposes are to support website operation, analyse traffic and evaluate advertising campaigns.
8.2. Non-essential tracking technologies are used subject to applicable requirements concerning notification and consent. Visitors may manage cookies through available website and browser settings. This Policy does not, by itself, replace the technical implementation of consent mechanisms.
8.3. The Company must ensure that information about diagnoses, examination results, the content of medical consultations or other health data is not transmitted to advertising systems, including through page URLs, event parameters, form fields and analytics tools.
- Disclosure of Personal Data to Third Parties
9.1. Personal data may be disclosed to the Company’s employees and duly authorised contractors (including telecommunications operators, providers of medical information systems, hosting, payment and communication services) to the extent necessary for the stated purposes and subject to confidentiality requirements. Disclosure to public authorities, healthcare institutions and other persons is permitted where an appropriate legal ground exists.
9.2. Some technology service providers may process data outside Ukraine. The Company ensures compliance with legal requirements governing cross-border transfers of personal data. The Company does not sell personal data.
- Retention Periods and Termination of Processing
10.1. Personal data are retained for the period necessary to achieve a lawful processing purpose or for mandatory periods prescribed by law. Retention periods for medical, accounting and other mandatory records are determined by the relevant regulations; for applications, call recordings and other communications, by reasonable periods established in the Company’s internal rules.
10.2. Once the processing purpose is achieved, the retention period expires or another statutory ground arises, data shall be deleted or anonymised unless continued retention is mandatory. Withdrawal of consent does not terminate processing carried out on another lawful ground.
- Personal Data Security Measures
11.1. The Company implements organisational and technical measures appropriate to the nature of the data and the risks of processing, including access controls, authentication, secure communication channels, backups where necessary, access logging and employees’ confidentiality obligations.
11.2. Where security incidents are identified, the Company takes steps to mitigate the consequences, restore protection and discharge obligations imposed by law. No method of transmitting data over the Internet is entirely risk-free.
- Rights of Personal Data Subjects
12.1. Data subjects have the rights provided for in Article 8 of the Law of Ukraine “On Personal Data Protection”, including the right to obtain information about the sources and purposes of data collection; access their data; request correction of inaccurate information; object to processing; and exercise other remedies provided by law.
12.2. Requests for access, correction or deletion of data may be sent using the contact details specified in Section 14.
- Minors’ Data and Amendments to the Policy
13.1. Children’s personal data are processed taking account of their age, legal requirements and the authority of their parents or other legal representatives. Appointments for children and the provision of their data are handled in accordance with requirements concerning representation and children’s rights.
13.2. The Company may update this Policy. The current version is published on the website. An amendment to the Policy does not itself replace consent required for a new processing purpose.
- Contact Information of the Personal Data Controller
LLC DOKOS MEDICAL, EDRPOU identification code 40484717.
Registered address: 3 Oleksiivska Street, Kyiv, 03110, Ukraine.
Service locations: 52 Hetmana Pavla Polubotka Street, Kyiv; 20A Volodymyra Ivasiuka Avenue, Kyiv.
Email: info@docos.one.
Website: https://docos.one/.
Licence of the Ministry of Health of Ukraine No. 1296 dated 1 December 2016.