Privacy Policy
“APPROVED”
by order of the General Director of KazMed LLP
No. ____ dated “____” __________ 2026
by order of the Director of Parasitology KazMed LLP
No. ____ dated “____” __________ 2026
PRIVACY AND PERSONAL DATA PROCESSING POLICY
This Privacy and Personal Data Processing Policy (hereinafter — the Policy) defines the procedure for collecting, processing, storing, transferring, and protecting the personal data of website users, patients, and other individuals interacting with KazMed LLP and/or Parasitology KazMed LLP through the website https://kazmedclinic.kz, the patient’s personal account, electronic services, feedback forms, and other communication channels.
1. General Provisions
1.1. The operators of personal data under this Policy are KazMed LLP, BIN 060640012550, and Parasitology KazMed LLP, BIN 190640008836, hereinafter jointly referred to as the “Clinic” or the “Provider.” The specific Provider is determined based on the type of service actually rendered, medical documentation, referral, examination results, fiscal receipt, and other documents.
1.2. This Policy applies to all personal data received by the Clinic through the website, the patient’s personal account, mobile and other electronic services, appointment forms, feedback forms, telephone, messengers, e-mail, biomaterial collection and reception points, as well as data obtained during the direct provision of medical services and laboratory tests.
1.3. Use of the website, registration in the personal account, submission of a request, arrangement of a service, transfer of biological material, receipt of test results, or the provision of the corresponding consent means that the user/patient has familiarized themselves with this Policy to the extent applicable.
1.4. This Policy is a public document and is posted on the Clinic’s website in open access.
2. Terms
2.1. Personal data — information relating to an identified or identifiable individual.
2.2. Medical personal data — information about the fact of seeking medical assistance, state of health, test results, diagnosis, prescriptions, biological material, medical documentation, and other information constituting medical confidentiality.
2.3. Processing of personal data — any action or set of actions performed with personal data, including collection, recording, systematization, storage, modification, use, transfer, depersonalization, blocking, and destruction.
2.4. User — a person using the website, personal account, feedback forms, or other electronic services of the Clinic.
2.5. Patient — an individual who has applied for medical services and/or laboratory tests.
2.6. Personal account — a protected section of the Clinic’s website or electronic service intended for user identification, service management, receiving test results, notifications, and other documents.
3. Categories of Data Processed
3.1. Identification data: surname, first name, patronymic, IIN, date of birth, sex, identity document details.
3.2. Contact data: phone number, e-mail address, residential address, delivery address, or other contact address.
3.3. Medical data: information about the state of health, requests, complaints, medical history, information about medications taken, information about biological material, test results, referrals, conclusions, medical documentation.
3.4. Technical data: IP address, cookies, information about the browser, device, operating system, actions on the website, date and time of visit, referral source.
3.5. Personal account data: login, authorization identifiers, login history, request history, selected services, electronic consents, notifications, test results.
3.6. Payment and accounting data: information about the order, payment amount, payment method, payment status, and fiscal receipt, without storing full bank card details, where payment is made through a payment provider.
3.7. Audio and video data, where video surveillance or recording is carried out on the Clinic’s premises for security, quality control, and protection of the rights of patients and employees.
4. Purposes of Personal Data Processing
4.1. Identification of the patient and user.
4.2. Registration and servicing of the personal account.
4.3. Conclusion and performance of the public agreement for the provision of paid medical services and laboratory tests.
4.4. Booking of services, receipt, collection, and accounting of biological material.
4.5. Conducting laboratory tests, generating, storing, and issuing results.
4.6. Sending notifications about appointments, readiness of results, changes in service operation, and technical or organizational messages.
4.7. Processing payments and refunds, fiscalization, accounting, and tax records.
4.8. Ensuring the operation of the website, personal account, medical information systems, and information security.
4.9. Processing requests, complaints, inquiries, and feedback.
4.10. Ensuring internal quality control of services provided.
4.11. Fulfilling the requirements of the legislation of the Republic of Kazakhstan and requests of authorized government bodies.
4.12. Protecting the rights and legitimate interests of the Clinic, patients, employees, and third parties.
4.13. Sending advertising and informational messages only where a separate consent has been given, if such consent is required by law.
4.14. Publishing reviews, images, cases, and other materials involving a patient only with the separate consent of the patient or their legal representative.
5. Legal Grounds for Processing
5.1. Consent of the personal data subject or their legal representative.
5.2. Performance of the public agreement and other agreements with the patient.
5.3. Fulfillment of the Clinic’s obligations established by the legislation of the Republic of Kazakhstan.
5.4. Protection of the life, health, rights, and legitimate interests of the patient, the Clinic, and third parties.
5.5. Maintenance of medical documentation, medical statistics, accounting, tax, and archival records.
5.6. Other grounds provided for by the legislation of the Republic of Kazakhstan.
6. Consent to the Processing of Personal Data
6.1. Consent to the processing of personal data may be given in writing, electronically, by signing a consent form, checking a checkbox, entering a one-time code, registering in the personal account, submitting a request, or by any other means that allows confirmation that consent has been obtained.
6.2. Consent to the processing of personal data for the purposes of providing medical services does not constitute consent to advertising mailings, publication of reviews, images, or medical cases, or to the dissemination of data in publicly available sources. The Clinic obtains separate consent for such actions.
6.3. The patient has the right to withdraw consent to the processing of personal data in the manner prescribed by the legislation of the Republic of Kazakhstan. Withdrawal of consent does not terminate the processing of data where such processing is necessary for the performance of outstanding obligations, maintenance of medical documentation, compliance with legal requirements, protection of the rights and legitimate interests of the Clinic, or in other cases provided for by law.
6.4. Withdrawal of consent may result in the impossibility of providing certain electronic services, receiving results through the personal account, sending notifications, or providing services for which the corresponding data processing is necessary.
7. Transfer of Personal Data to Third Parties
7.1. The Clinic has the right to transfer personal data to third parties only to the extent necessary to achieve the legitimate purposes of processing, where there is a legal basis, and subject to compliance with the confidentiality regime:
7.2. To medical information systems and electronic service operators.
7.3. To partner laboratories, reference laboratories, and subcontractors, where necessary for performing the test.
7.4. To payment organizations, banks, fiscalization operators, and payment providers.
7.5. To SMS, e-mail, push, call-center, and other notification services.
7.6. To courier and logistics services, where necessary for the delivery of documents or biomaterial.
7.7. To insurance organizations, where the service is provided under an insurance program.
7.8. To hosting providers, IT contractors, and developers of the website and personal account, where necessary for technical support.
7.9. To government bodies, courts, law enforcement, and other authorized bodies in cases provided for by the legislation of the Republic of Kazakhstan.
7.10. The transfer of medical data, test results, and information constituting medical confidentiality is carried out in compliance with the requirements of the legislation of the Republic of Kazakhstan on medical confidentiality, personal data, and medical activities.
8. Cross-Border Transfer and Storage of Data
8.1. The Clinic ensures the storage of personal data bases in the manner prescribed by the legislation of the Republic of Kazakhstan.
8.2. Where cross-border transfer of personal data occurs in connection with the use of certain technical, analytical, cloud, payment, or communication services, such transfer is carried out only where there is a legal basis, including the consent of the personal data subject, and with due regard to the requirements of the legislation of the Republic of Kazakhstan.
8.3. The Clinic has the right to restrict or replace third-party services where their use creates a disproportionate risk to the protection of patients’ personal data.
9. Medical Confidentiality and Medical Data
9.1. The Clinic observes medical confidentiality and takes measures to prevent the unlawful disclosure of information about the fact of a patient’s request for care, state of health, test results, diagnosis, and other medical information.
9.2. Information constituting medical confidentiality is provided to third parties only with the consent of the patient or their legal representative, or without consent in cases directly provided for by the legislation of the Republic of Kazakhstan.
9.3. Publication of a review, image, history of treatment, test result, medical case, screenshot of correspondence, or other material allowing identification of the patient is permitted only on the basis of a separate written or electronic consent of the patient or their legal representative.
10. Use of Data of Minors
10.1. Processing of personal data of minor patients is carried out with the involvement of their legal representatives, unless otherwise provided by the legislation of the Republic of Kazakhstan.
10.2. Publication of an image, review, history of treatment, test results, or other information about a minor patient is permitted only with a separate consent of the legal representative and subject to compliance with the interests of the minor.
11. Protection of Personal Data
11.1. Restriction of access to personal data based on the need-to-know principle.
11.2. Use of individual logins, passwords, and other authorization tools.
11.3. Maintenance of access and user-activity logs of information systems where technically feasible.
11.4. Backup and recovery of data.
11.5. Antivirus protection, software updates, and control of external media.
11.6. Conclusion of confidentiality agreements with employees and contractors.
11.7. Training of employees on the rules for handling personal data and medical confidentiality.
11.8. Other organizational, legal, and technical measures necessary for data protection.
12. Rights of the Patient and User
12.1. To receive information on whether the Clinic holds their personal data and on the purposes of its processing;
12.2. To request clarification, correction, blocking, or destruction of personal data in cases provided for by law;
12.3. To withdraw consent to the processing of personal data, subject to the restrictions established by law;
12.4. To receive information on the transfer of personal data to third parties within the limits provided for by law;
12.5. To submit requests, complaints, and inquiries on matters relating to the processing of personal data.
13. Cookies and Technical Data
13.1. The Clinic may use cookies, pixels, tags, analytical, and other technical tools to ensure the operation of the website, authorize users, remember settings, analyze visit frequency, improve service quality, and, where consent has been given, personalize informational and advertising materials. The detailed procedure for using cookies is governed by the Cookie and Metric Services Usage Policy.
14. Data Retention Period
14.1. Personal data is stored no longer than necessary for the purposes of its processing, performance of the agreement, maintenance of medical documentation, accounting and tax records, protection of the rights of the Clinic and patients, and compliance with the requirements of the legislation of the Republic of Kazakhstan.
14.2. Medical documentation, test results, electronic data, and archival materials are stored for the periods prescribed by the legislation of the Republic of Kazakhstan and the Clinic’s internal regulations.
14.3. Upon achievement of the processing purposes, or upon the occurrence of other grounds, data is subject to deletion, destruction, depersonalization, or archival storage in accordance with the legislation and the Clinic’s internal procedures.
15. Contact Details for Personal Data Matters
15.1. For matters relating to the processing of personal data, withdrawal of consent, change of contact data, deletion of published material, or other matters, the user/patient may contact the Clinic as follows:
15.2. e-mail: kazmed2006@gmail.com;
15.3. address: Republic of Kazakhstan, Almaty, Аksay-5, 12А;
15.4. tel.: +7(700)511-1017.
16. Amendments to the Policy
16.1. The Clinic has the right to amend this Policy. The new version comes into effect from the moment it is posted on the website, unless a different period is specified in the new version. Continued use of the website, personal account, or electronic services after the posting of the new version means that the user has familiarized themselves with the current version of the Policy.
