Personal Data Processing Policy

1. General provisions

This Policy defines the procedure for processing personal data and the measures for their protection implemented by the Silkway Med service (hereinafter the "Operator"), available at silkwaymed.ru. The Policy has been developed in accordance with Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006, and applies to all website visitors and users of the service.

By using the website, the user confirms that they have read this Policy. Consent to the processing of personal data, including health information, and to its cross-border transfer to medical institutions in China is given in a separate document — the Consent to Personal Data Processing — which the user provides when submitting a request.

Operator: Общество с ограниченной ответственностью «Глобал Трафик» (ООО «Глобал Трафик»), INN 5403091377, KPP 540301001, OGRN 1265400004726. Registered address: 630088, РФ, Новосибирская область, г. Новосибирск, ул. Громова, д. 14, этаж 3, помещение 9. Legal entity email: info.globaltraffic@mail.ru.

2. Key concepts

Personal data

— any information relating directly or indirectly to a specified or identifiable individual.

Processing of personal data

— any action or set of actions performed with or without the use of automation tools on personal data: collection, recording, organization, accumulation, storage, updating, use, transfer, anonymization, blocking, deletion, and destruction.

Data Subject

— the individual to whom the processed data relates — a website visitor or a customer of the service.

Operator

— the legal entity or sole proprietor that organizes the processing of personal data and determines its purposes and composition.

3. Categories of data subjects

The Operator processes the personal data of the following categories of individuals:

• visitors to the silkwaymed.ru website who have submitted a consultation request;
• customers who have entered into a contract with the Operator for the provision of services for organizing a medical treatment trip;
• individuals who have contacted the Operator by email, via messengers, or by phone.

4. Purposes of processing personal data

• processing the consultation request and contacting the user;
• selecting a suitable partner clinic in China for the user's medical request;
• consultation with medical institutions in China regarding the user’s medical request;
• organizing and supporting the treatment trip (logistics, accommodation, interpreter, contract with the clinic);
• performing the contract concluded between the Operator and the user;
• informing the user about the progress of the selection and the Operator's services;
• responding to the user's requests and resolving claims;
• complying with the requirements of applicable law.

5. Legal grounds for processing

• the consent of the data subject (Article 6(1)(1) of Federal Law No. 152-FZ);
• consent of the data subject to the processing of special categories of personal data — health information (Article 10(1)(1) of 152-FZ);
• consent of the data subject to the cross-border transfer of personal data to a state that does not provide adequate protection of subjects’ rights (Article 12(4) of 152-FZ);
• performance of a contract to which the data subject is a party (Article 6(1)(5) of Federal Law No. 152-FZ);
• fulfillment of obligations imposed by the legislation of the Russian Federation;
• exercise of the rights and legitimate interests of the Operator.

6. Scope and categories of data processed

Within the website's request form, the Operator processes:

• the user's name;
• contact details (phone number, messenger, email — at the user's choice);
• the selected area of treatment and a brief description of the request — in free form, filled in by the user voluntarily;
• technical data about the website visit: IP address, cookie identifiers, browser and device information, the referrer, and statistics on interaction with the pages.

The selected area of treatment and any health information the user provides voluntarily belong to special categories of personal data (Article 10 of 152-FZ) and are processed on the basis of the Consent to Personal Data Processing. Medical documents — discharge summaries, scans, test results — are neither requested nor accepted through the request form: they are provided later via a secure channel communicated by the manager and on the basis of a separate consent in written form.

7. Methods and terms of processing

Processing is carried out both with and without the use of automation tools. The period of processing personal data is determined by the achievement of the purposes of processing or the withdrawal of the subject's consent, whichever occurs first.

The retention period for the data of users who have submitted a request but have not concluded a contract is no more than 12 months from the date of the last contact. The data of customers who have concluded a contract is stored for the term of the contract and for 3 years after its termination in order to comply with the requirements of the law.

8. Transfer of personal data to third parties

To provide clinic-matching and trip-organization services, the Operator transfers a limited amount of personal data to the following categories of recipients:

• medical institutions in China — on the basis of the user’s consent to cross-border transfer and after a specific clinic has been agreed (see the next section);
• transport and service partners (airlines, hotels, interpreters) — to the extent minimally necessary to provide the service;
• government authorities — in cases expressly provided for by the legislation of the Russian Federation.

The Operator does not transfer personal data to third parties for marketing or advertising purposes without the separate consent of the subject.

9. Cross-border transfer of personal data

The service cannot be provided without transferring the user’s data to medical institutions of the People’s Republic of China. China is not included in the list of states providing adequate protection of the rights of personal data subjects, so such a transfer takes place only where the user has given separate consent to the cross-border transfer — see the Consent to Personal Data Processing.

Before starting a cross-border transfer, the Operator notifies Roskomnadzor of its intention to carry out the cross-border transfer of personal data, as required by Article 12(3) and 12(4) of 152-FZ.

The clinic receives the minimum necessary amount of data: name, contact details, information about the medical request, and the medical documents the user has provided for assessment. The user is informed that the transferred data is subject to the legislation of the People’s Republic of China and that the scope of the data subject’s rights may differ from that provided for by the legislation of the Russian Federation.

The user may withdraw consent to the cross-border transfer at any time; the consequences of withdrawal are described in the Consent to Personal Data Processing.

10. Protection of personal data

The Operator applies legal, organizational, and technical measures to protect personal data:

• encryption of transmitted data using the TLS protocol;
• restricting access to the data by employees and partners to the minimum necessary rights;
• storing medical documents exclusively in secure channels other than the website's request form;
• regular auditing and backup of the data.

11. Cookies and analytics

The website uses cookies and web analytics services (for example, Yandex.Metrica and Google Analytics) for traffic statistics and to improve the website. The user can disable cookies in their browser settings; this will not affect the ability to submit a request but may limit the website's functionality.

12. Rights of the data subject

In accordance with Article 14 of Federal Law No. 152-FZ, the subject has the right to:

• obtain information about which of their personal data is being processed and for what purposes;
• request the updating, blocking, or destruction of their data if it is incomplete, outdated, inaccurate, or not needed for the stated purposes;
• withdraw consent to the processing of data;
• appeal the Operator's actions to Roskomnadzor or in court.

13. Contacts and inquiries

Requests and inquiries regarding the processing of personal data — to the email address: legal@silkwaymed.ru. The response time is no more than 30 days from the receipt of the inquiry.

14. Changes to the policy

The Operator has the right to amend this Policy. The current version is published on the website at silkwaymed.ru/privacy. The date of the last update is indicated at the beginning of the document.