Personal Data Processing Policy

1. General provisions

This Policy defines the procedure for processing personal data and the measures for their protection implemented by the Silkway Med service (hereinafter the "Operator"), available at silkwaymed.ru. The Policy has been developed in accordance with Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006, and applies to all website visitors and users of the service.

By using the website and submitting a request, the user confirms that they have read this Policy and consent to the processing of their personal data in the manner and on the terms described below.

2. Key concepts

Personal data

— any information relating directly or indirectly to a specified or identifiable individual.

Processing of personal data

— any action or set of actions performed with or without the use of automation tools on personal data: collection, recording, organization, accumulation, storage, updating, use, transfer, anonymization, blocking, deletion, and destruction.

Data Subject

— the individual to whom the processed data relates — a website visitor or a customer of the service.

Operator

— the legal entity or sole proprietor that organizes the processing of personal data and determines its purposes and composition.

3. Categories of data subjects

The Operator processes the personal data of the following categories of individuals:

• visitors to the silkwaymed.ru website who have submitted a consultation request;
• customers who have entered into a contract with the Operator for the provision of services for organizing a medical treatment trip;
• individuals who have contacted the Operator by email, via messengers, or by phone.

4. Purposes of processing personal data

• processing the consultation request and contacting the user;
• selecting a suitable partner clinic in China for the user's medical request;
• organizing and supporting the treatment trip (logistics, accommodation, interpreter, contract with the clinic);
• performing the contract concluded between the Operator and the user;
• informing the user about the progress of the selection and the Operator's services;
• responding to the user's requests and resolving claims;
• complying with the requirements of applicable law.

5. Legal grounds for processing

• the consent of the data subject (Article 6(1)(1) of Federal Law No. 152-FZ);
• performance of a contract to which the data subject is a party (Article 6(1)(5) of Federal Law No. 152-FZ);
• fulfillment of obligations imposed by the legislation of the Russian Federation;
• exercise of the rights and legitimate interests of the Operator.

6. Scope and categories of data processed

Within the website's request form, the Operator processes:

• the user's name;
• contact details (phone number, messenger, email — at the user's choice);
• a brief description of the medical request (specialty, diagnosis — in free form, filled in voluntarily by the user);
• technical data about the website visit: IP address, cookie identifiers, browser and device information, the referrer, and statistics on interaction with the pages.

The Operator does not request special categories of personal data (health information in the medical sense, documents, examination results) through the request form. Such data is subsequently provided by the user via a secure channel, which the Operator's manager communicates personally after the first contact.

7. Methods and terms of processing

Processing is carried out both with and without the use of automation tools. The period of processing personal data is determined by the achievement of the purposes of processing or the withdrawal of the subject's consent, whichever occurs first.

The retention period for the data of users who have submitted a request but have not concluded a contract is no more than 12 months from the date of the last contact. The data of customers who have concluded a contract is stored for the term of the contract and for 3 years after its termination in order to comply with the requirements of the law.

8. Transfer of personal data to third parties

To provide clinic-matching and trip-organization services, the Operator transfers a limited amount of personal data to the following categories of recipients:

• partner clinics in China — after obtaining separate consent from the user for the cross-border transfer of data, where medical documents and an agreed treatment program are available;
• transport and service partners (airlines, hotels, interpreters) — to the extent minimally necessary to provide the service;
• government authorities — in cases expressly provided for by the legislation of the Russian Federation.

The Operator does not transfer personal data to third parties for marketing or advertising purposes without the separate consent of the subject.

9. Protection of personal data

The Operator applies legal, organizational, and technical measures to protect personal data:

• encryption of transmitted data using the TLS protocol;
• restricting access to the data by employees and partners to the minimum necessary rights;
• storing medical documents exclusively in secure channels other than the website's request form;
• regular auditing and backup of the data.

10. Cookies and analytics

The website uses cookies and web analytics services (for example, Yandex.Metrica and Google Analytics) for traffic statistics and to improve the website. The user can disable cookies in their browser settings; this will not affect the ability to submit a request but may limit the website's functionality.

11. Rights of the data subject

In accordance with Article 14 of Federal Law No. 152-FZ, the subject has the right to:

• obtain information about which of their personal data is being processed and for what purposes;
• request the updating, blocking, or destruction of their data if it is incomplete, outdated, inaccurate, or not needed for the stated purposes;
• withdraw consent to the processing of data;
• appeal the Operator's actions to Roskomnadzor or in court.

12. Contacts and inquiries

Requests and inquiries regarding the processing of personal data — to the email address: [email protected]. The response time is no more than 30 days from the receipt of the inquiry.

13. Changes to the policy

The Operator has the right to amend this Policy. The current version is published on the website at silkwaymed.ru/privacy. The date of the last update is indicated at the beginning of the document.