Personal Data Processing Policy on the Portal

  1. General Terms

The Policy regarding the processing of personal data (hereinafter referred to as the "Policy") has been prepared in accordance with Paragraph 2 of Part 1 of Art. 18.1 of the Federal Law of the Russian Federation On Personal Data No. 152-FZ dated July 27, 2006 (hereinafter referred to as the "Law") and determines the position  the State Budgetary Institution "Research Institute for Healthcare Organization and Medical Management of Moscow Healthcare Department"  (hereinafter referred to as the “Research Institute NIIOZMM ”) in processing and personal data protection (hereinafter referred to as “Personal Data”), in respect of rights and freedoms, describes collection, storage, usage and transmission of Personal Data, implements requirements for their protection, as well as information on the personal rights  to which the relevant personal data relates.

1.2 Personal Data refers to any information relating directly or indirectly to a specific or identifiable individual (citizen).

1.3 Personal Data processing means any action (operation) or set of actions (operations) with Personal Data performed using automation tools and/or without usage of such tools. Such actions (operations) include: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, usage, transfer (provision, access), depersonalization, blocking, deletion, destruction of Personal Data.

1.4 Personal Data Security means protection of Personal Data from unlawful and/or unauthorized access to it, destruction, modification, blocking, copying, provision, distribution of Personal Data and other illegal actions regarding Personal Data.

 1.5 The Policy is applied to all actions related to the Personal Data Processing on the website mosmedtour.com (hereinafter referred to as the "Portal") and the Contact Center in the information systems of the Research Institute NIIOZMM. All Terms used in this document have the meaning used in the Law and the Terms and Conditions of Portal Use posted on the Internet at https://mosmedtour.com/eula/.

1.6 By making a request for services and registering on the Portal, creating an Account, the User by the appropriate Portal functionality provides consent to the Personal Data Processing, in the manner and under the conditions described in the Policy and provided by the current legislation of the Russian Federation. The use of the Portal or Contact Center by the User also means the unconditional consent to the Privacy Policy Rules and the Terms of Personal Data Processing specified there. If the User does not agree with the Terms of this Policy, the User shall refrain from using the Portal and Contact Center.

1.7 This Policy is applied to Personal Data received both before and after the implementation of this Policy.

  1. Legal Basis and Purpose of Personal Data Processing by the Research Institute NIIOZMM

2.1 The Research Institute NIIOZMM processes and protects Personal Data to exercise the functions, powers and duties imposed, but not limited to, under legislation of the Russian Federation in accordance with the Constitution of the Russian Federation, Federal laws, in particular the Federal law No. 152-FZ dated 27 July 2006 On Personal Data, other Federal laws of the Russian Federation defining cases and  Provisions of Personal Data Processing, methodical documents and guidelines specified by FSTEC of the Russian Federation and Federal Security Service of the Russian Federation, as well as the Civil Code of the Russian Federation, Tax Code of the Russian Federation and the Russian Federation Law No. 2300-1 dated 7 February 1992. On Protection of Consumer Rights, Federal Law No. 402-FZ dated December 6, 2011. On Accounting, as well as Personal Data Operators, the Charter and the Local Acts of the Research Institute NIIOZMM.

2.3 The Research Institute NIIOZMM is the Personal Data Operator in accordance with the Law.

2.3 Personal Data Processing may be carried out by the Research Institute NIOZMM in the following cases and on the following legal grounds:

  1. processing of Personal Data is carried out only with the consent of the Personal Data Subject, expressed in any form that allows to approve the consent, including by the methods specified in Section 1.6. of the Policy;
  2. achieving the goals stipulated by an international agreement of the Russian Federation or by Law, performing the functions, powers and duties imposed on the Personal Data Operator by the legislation of the Russian Federation;

iii. processing the request by the Portal User who is an individual with all necessary legal capacity to receive medical services provided by the Partner;

  1. fulfilling Terms and Conditions of Portal Use at site https://mosmedtour.com/eula/ when using the Portal;
  2. exercising the rights and legitimate interests of the Operator or third parties or to achieve socially significant goals if the rights and freedoms of the Personal Data Subject are not violated;
  3. for statistical or research purposes in case of mandatory depersonalization of the Personal Data, including the need for achieving the goal specified in Subsection iv.

2.4.The Subjects whose Personal Data is processed by the Portal and Employees of the Contact Center are the Portal Users; any other individuals who address applications/appeals to the Research Institute NIIOZMM. The Research Institute NIIOZMM processes personal data of the following individuals including:

  1. The Portal Users in order to:
  • organize the interaction between the Users and the Partners, in accordance with Terms and Conditions of Portal Use ;
  • provide information about the Partners and their services;
  • inform the Users about the request status;
  • assist in handling claims between the Users and the Partners;
  • post the User reviews of the Partners and their services;
  • analyze service provided by the Research Institute NIIOZMM and the Partners and improve its quality for the Users/Patients;
  • in any other cases directly stipulated by the current legislation of the Russian Federation.
  1. other individuals applying to the Research Institute NIIOZMM with claims of alleged violation of their rights and the rights of third parties, in order to process incoming applications, transmit information about received applications to individuals whose actions could allegedly lead to the violation of the relevant rights, assist in settling claims, make a decision on the application of the Terms and Conditions of Portal Use and other User documents of the Portal and liability measures to the Partners and Users.

iii. all Portal Users in order to fulfill Terms and Conditions of Portal Use at https://mosmedtour.com/eula/ using the Portal, analyzing and improving the quality service for the Partners and Users.

  1. Employees of the Research Institute NIIOZMM in order to implement labor contracts in accordance with the legislation of the Russian Federation.
  2. Counterparties of the Research Institute NIIOZMM, which Personal Data Processing is carried out as part of implementation of contractual relations between the Parties.
  3. Categories of Personal Data Processed by the Research Institute NIOZMM

3.1 The Research Institute NIOZMM  processes the following categories of the User Personal Data: information received during registration and request processing (surname, name, patronymic, images and videos made and provided during registration, information about professional occupation, phone number, email address, cookies), User complaints (transmitted by the User via the Portal, Contact Center or in a different way), User reviews about the Partners and their services.

3.2 The Research Institute NIOZMM processes the following categories of the Personal Data of the Subjects applying to the Research Institute NIOZMM with claims of alleged violation of their rights: surname, name, patronymic, passport data (data of another identity document), contact information (phone and (or) fax numbers, email address) of the copyright holder or another individual whose right was allegedly violated, and (or) the applicant, if he acts as an authorized representative of the copyright holder or another person whose right was allegedly violated, information about the received claims, progress and result of their examination.

3.3 The Personal Data specified in Paragraphs of the Section above may be obtained by the Research Institute NIOZMM in one of the following ways:

  • provided by the Subjects of by filling out the appropriate forms on the Portal, by sending correspondence or emails to the email addresses of the Research Institute NIOZMM;
  • received from third parties in the cases listed in this Paragraph.In particular, the User Personal Data may be obtained by the Research Institute NIOZMM directly from the Partners or other counterparties of the Research Institute NIOZMM in connection with the implementation of actions stipulated by the current legislation of the Russian Federation.
  1. Principles and Conditions of Personal Data Processing

4.1 When processing Personal Data, the Research Institute NIIOZMM adheres to the following principles:

  • Personal Data shall be processed on a legitimate basis;
  • Personal Data is not disclosed to third parties and is not distributed without the consent of the Personal Data Subject, excluding the cases stipulated by the legislation of the Russian Federation;
  • identification of specific legal purposes is limited to the Personal Data Processing (including collection);
  • combining databases, including databases containing Personal Data that are processed for purposes incompatible with each other, is not allowed;
  • Personal Data Processing is limited to the achievement of specific, predetermined and legitimate goals;
  • processed Personal Data shall be destroyed or depersonalized with withdrawal of consent to processing applied by the Personal Data Subject, in case of achieving or no further need for achieving processing purposes, unless otherwise stipulated by the Federal Law;
  • the content and volume of processed Personal Data correspond to the stated processing purposes.The Personal Data processed is not redundant in relation to the stated processing purposes;
  • when processing Personal Data, the accuracy and sufficiency of Personal Data and, if necessary, the relevance of Personal Data in relation to the stated processing purposes are ensured;
  • the storage of Personal Data is carried out in a form that allows determining the Personal Data Subject for no longer than the purposes of Personal Data Processing purposes require, unless the term for storing Personal Data is established by the Federal Law or an agreement to which the Personal Data Subject is a party, beneficiary or guarantor.

4.2 The Research Institute NIOZMM does not process Personal Data related to race, nationality, political views, religious, philosophical or other beliefs, health status, personal life, membership in public associations, including professional unions, or biometric data. The Research Institute NIOZMM does not perform voice input and Personal Data verification by unprotected transmission channels.Transferring data by Personal Data Subjects to Employees of the Contact Center is voluntary and implies that the data received will be used in accordance with this Policy.

4.3 The Research Institute NIOZMM provides recording, systematization, accumulation, storage, clarification (updating, modification), extraction of Personal Data using databases located on the territory of Russia, and does not carry out cross-border transferring of Personal Data.

4.4 The Research Institute NIOZMM has the right to entrust the Personal Data Processing to third parties with the provided consent of the Personal Data Subject on the basis of a contract concluded with such third parties, in the following cases:

  • in order to process requests from the Users and third parties via voice and non-voice communication channels, including email, online chat, mobile applications and / or social networks;
  • in order to organize interaction between the Partner and the User in the framework of ensuring the execution of the User requests;
  • in order to analyze the quality of the service provided by the Research Institute NIIOZMM and its quality improvement;
  • in order to improve the terms of service;
  • in order to conduct statistical research.

4.5 Individuals processing Personal Data on the basis of an agreement (operator's order) concluded with the Research Institute NIIOZMM, including the Partners, obliged to comply with the principles and rules for processing and protecting Personal Data stipulated by the current legislation of the Russian Federation. For each third party, the agreement defines a list of actions (operations) with Personal Data that will be performed by a third party processing Personal Data, the purpose of processing, establishes the obligation of such a person to maintain confidentiality and ensure the safety of Personal Data during the processing process, indicates the protection requirements of the processed Personal Data in accordance with the current legislation of the Russian Federation.

4.6 The Research Institute NIIOZMM has the right to transfer Personal Data to third parties with the consent of the Personal Data Subject in the following cases:

4.6.1 To the Partners for the purposes of processing the User requests, in cases provided for by the Terms and Conditions of Portal Use, including the case when the Research Institute  receives a claim for violation of intellectual or other rights of third parties, in order to resolve the received claims, in case of receiving other applications, reviews, claims, complaints, messages or documents addressed to the Partner, in other cases and purposes, as stated in the Terms and Conditions of Portal Use;

4.6.2 in order to protect the rights and legitimate interests of the Research Institute NIIOZMM or third parties in cases where the Personal Data Subject violates any terms of the User documents of the Portal and (or) this Policy;

4.6.3 by a court decision that has entered into force or in cases stipulated by the current legislation of the Russian Federation;

4.7 in order to comply with the Terms and Conditions of Portal Use at https://mosmedtour.com/eula/ when using the Portal, analyzing and improving the quality of the User service, for statistical or other research purposes, the Research Institute NIIOZMM develops, improves, optimizes and implements new functionality of the Portal. To ensure this, the User agrees and instructs the Research Institute NIIOZMM to carry out processing (including collection, recording, systematization, accumulation, storage, clarification (update, change), comparison, extraction, usage, depersonalization, blocking, deletion and destruction) of the User Account and any other Personal Data, including the Data available to the Partner acting on behalf of the Research Institute NIIOZMM to transfer the Account and any other User Personal Data stored by the Research Institute NIIOZMM to the Partners to execute such an order for processing and receiving analytical information from the Partners based on the results of processing, including the results of automated processing of such Data, including in the form of integer and / or text values and identifiers.

4.8 The Research Institute NIIOZMM has the right to transfer Personal Data to third parties with the consent of the Personal Data Subject, as well as in cases when the possibility of transferring Personal Data to third parties is directly provided by the legislation of the Russian Federation and does not require the consent of the Personal Data Subject.

4.9 In order to comply with the requirements of the current legislation of Russia and its contractual obligations, the processing of Personal Data by the Research Institute NIIOZMM is carried out with both usage and non-usage of automation tools.

Such operations include: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, usage, transfer (provision, access), depersonalization, blocking, deletion, destruction of personal data.

4.10 The Research Institute NIOZMM does not take decision that generate legal consequences regarding the Personal Data Subject or otherwise affect the rights and legitimate interests on the basis of exclusively automated Personal Data Processing.

4.11 The Research Institute NIOZMM does not check and, as a rule, is not able to check the relevance and reliability of the information provided by the Personal Data Subjects obtained through the Portal. The Research Institute NIOZMM presumes that the Personal Data Subjects act reasonably and in good faith, provide accurate and sufficient personal information and keeps it updated.

  1. Rights of Personal Data Subjects

5.1 The Personal Data Subject, whose Personal Data is processed by the Research institute NIIOZMM, has the right to:

  1. change (update, add) the Personal Data provided by logging in to the Personal Account at any time if the Portal functionality allows it;
  2. delete the provided Personal Data by sending to the Research Institute NIIOZMM a written notice indicating which Personal Data is to be deleted;

iii. receive from the Research Institute NIIOZMM:

  • confirmation of the Personal Data Processing and information about the Personal Data availability related to the relevant Personal Data Subject;
  • information about the legal basis and purpose of Personal Data Processing;
  • information about Personal Data Processing procedures used in the Research Institute NIIOZMM;
  • information about the name and location of the Research Institute NIIOZMM;
  • information about people (excluding Employees of the Research Institute NIIOZMM) who have access to Personal Data or to whom Personal Data may be disclosed on the basis of Agreement with the Research Institute NIIOZMM or on the basis of the Federal Law;
  • processed Personal Data related to the Personal Data Subject and information about the source of its receipt, unless otherwise stipulated by the legislation of the Russian Federation;
  • information about the terms of Personal Data Processing, including the terms of their storage;
  • information on the process for the execution of the rights of Personal Data Subject in a way stipulated by the legislation on Personal Data;
  • the name and address of the individuals processing Personal Data on behalf of the Research Institute NIIOZMM;
  • other information provided by Law;
  1. demand from the Research Institute NIIOZMM clarification of the Personal Data, blocking or destruction if the Personal Data is incomplete, outdated, inaccurate, illegally obtained or unnecessary for the stated processing purpose;
  2. withdraw the consent to Personal Data Processing at any time by sending an electronic message containing an electronic signature to the e-mail address: niiozmm@zdrav.mos.ru or by sending a written notification to the address of the Research Institute NIIOZMM. After receiving such a message, the processing of Personal Data of the Personal Data Subject will be terminated and the Personal Data shall be deleted, excluding the cases when processing can be continued in accordance with the legislation of the Russian Federation. In this case, sending of such a message on the withdrawal of the User consent shall be also considered as notification of unilateral refusal to fulfill the corresponding request and entails the impossibility of its execution;
  3. demand the elimination of illegal actions of the Research Institute NIIOZMM in relation to its Personal Data;

vii. take measures prescribed by Law to protect their rights and legitimate interests, including for damages and (or) compensation for non-pecuniary damage in court.

5.2 The rights provided for in the Subsections of the above Paragraph may be limited in accordance with the requirements of the legislation of Russia and (or) cases when the Research Institute NIIOZMM processes Personal Data on other legal grounds different from the consent of the Personal Data Subject.

  1. Obligations of the Research Institute NIIOZMM

In accordance with the requirements of the Law, the Research Institute NIIOZMM is obliged to:

1) provide the Personal Data Subject with the information concerning his Personal Data Processing on his request, or provide a legal refusal within thirty days from the date of receiving a request from the Personal Data Subject or his representative;

2) at the request of the Personal Data Subject, specify, block or delete the Personal Data being processed if the Personal Data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated processing purpose within a period not exceeding seven working days from the date when the Personal Data Subject or his representative provides information confirming these facts;

3) keep a record journal of appeals of Personal Data Subjects which is to record the requests of Personal Data Subjects for receiving Personal Data and facts of Personal Data provision for these requests;

4) notify the Personal Data Subject about the Personal Data Processing if the Personal Data was not received from the Personal Data Subject. The following cases are excluded: - the Personal Data Subject has been notified of the Personal Data Processing by the Research Institute NIIOZMM; - the Personal Data has been received by the Research Institute NIIOZMM in connection with the contract execution  to which the Personal Data Subject is a party, beneficiary or guarantor, or on the basis of the requirements of current legislation;

- Personal Data are publicly available by the Personal Data Subject or obtained from a publicly available source;

- the Research Institute NIIOZMM processes depersonalized Personal Data for statistical or other research purposes, if the rights and legitimate interests of the Personal Data Subject are not violated;

- providing the Personal Data Subject with the information contained in the notification on the Personal Data processing violates the rights and legitimate interests of third parties;

5) if the goal of Personal Data Processing  is achieved, immediately terminate the Personal Data Processing and destroy the corresponding Personal Data within a period not exceeding thirty days from the date the goal of Personal Data processing  was achieved, unless otherwise provided by Agreement to which the beneficiary or guarantor is a Personal Data Subject, by other contract between the Research Institution NIIOZMM and the Personal Data Subject or if the Research Institution NIIOZMM has no right to process Personal Data without the consent of the Personal Data Subject on the grounds stipulated by the Law or other Federal Laws;

6) if the Personal Data Subject withdraws the consent  to the  Personal Data Processing, stop processing Personal Data and destroy Personal Data within a period not exceeding thirty days from the date of the withdrawal receipt, unless otherwise provided by Agreement between the Research Institute NIIOZMM and the Personal Data Subject. The Research Institute NIIOZMM is obliged to inform the Personal Data Subject about the destruction of Personal Data;

7) collecting Personal Data, including by means of the Internet, the Research Institute NIIOZMM provides recording, systematization, accumulation, storage, clarification (updating, modification), extraction of Personal Data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.

  1. Protection of Personal Data

7.1 Processing Personal Data, the Research Institute NIIOZMM takes necessary legal, organizational and technical measures on order to protect Personal Data from unlawful and (or) unauthorized access to them, destruction, modification, blocking, copying, provision, distribution of Personal Data, as well as from other illegal actions in relation to Personal Data.

7.2 Such measures include:

  1. designation of the person responsible for organizing the Personal Data Processing and the person responsible for ensuring data security;
  2. development and approval of local acts on Personal Data Processing and protection;

iii. application of legal, organizational and technical measures to ensure the Personal Data security.

  1. control over the measures taken to ensure the Personal Data security and the protection level of information systems processing Personal Data;
  2. assessment of the harm that may be caused to Personal Data Subjects if the legislation on Personal Data is violated, on the ratio of the harm and the measures taken by the Research Institute NIIOZMM aimed at compliance of the obligations stipulated by the legislation on personal data;
  3. compliance with the Terms that prevent unauthorized access to tangible media of Personal Data and ensure the safety of Personal Data;

vii. familiarization of the Employees of the Research Institute NIIOZMM directly processing Personal Data with the provisions of the Russian legislation on personal data, including the requirements for Personal Data protection, Local Acts on the processing and protection of Personal Data, and training Employees of the Research Institute NIIOZMM

  1. Terms of Processing (Storage) of Personal Data

8.1 Terms of processing (storage) of Personal Data are determined based on the purposes of Personal Data Processing , in accordance with the validity period with Personal Data Subjects, the requirements of current legislation: Personal Data of the registered Users is stored for the entire duration of the User Account; Personal Data of other people applying to the Research Institute NIIOZMM with claims of alleged violation of their rights, during the entire period of processing and examination of the relevant claims and for three years from the date of processing termination and (or)examination  of the claim, unless otherwise provided by limitation of action period for relevant disputes. 

8.2 Personal Data which processing (storage) period is expired is to be destroyed, unless otherwise provided by the legislation of the Russian Federation. Storage of Personal Data after the termination of their processing is allowed only after the depersonalization.

  1. Procedure for Obtaining Clarifications on Personal Data Processing

9.1 Personal Data Subjects whose Personal Data is processed by the Research Institute NIIOZMM can get clarification on their Personal Data Processing  by contacting the Research Institute NIIOZMM in person or by sending a corresponding written request to the address of the Research Institute NIIOZMM.

  1. Automatically Collected Information

10.1 The Research Institute NIIOZMM can collect and process the following information, including non-personal data:

  • information about the interests of the Portal Users based on the entered search queries of the  Portal users regarding the services implementing by the Partners in order to provide the Users with the updated information of the Portal usage, as well as to generalize and analyze information about the Portal Paragraphs and  the most high-demand services of the Partners among the Portal Users;
  • information about the interests of the Contact Center Users based on the received requests from the Contact Center Users in order to provide the Users with updated information when using the Contact Center, as well as to generalize and analyze information about the most high-demand features of the Contact Center among the Contact Center Users;
  • information that generates the Partner system rating: the User reviews of the Partner, information about query execution and other information;

10.2 The Research Institute NIIOZMM processes and stores search queries of the Portal Users in order to generalize and create statistics of the Portal Paragraphs usage.

10.3 The Research Institute NIIOZMM automatically receives certain types of information obtained during the User activity on the Portal, email correspondence, etc. These are technologies and services, such as web protocols, cookies, web tags, as well as third-party applications and tools. However, web tags, cookies and other monitoring technologies do not give an opportunity to receive Personal Data automatically. If the Portal User provides the Personal Data at his own discretion, for example, when filling out a feedback form or sending an email, only then the automatic collection of the detailed information shall be started for the convenient usage of the web-portals and (or) improved interaction with the Users.

10.4 If the Research Institute NIIOZMM can reasonably relate the information specified in this Paragraph to the Account of a particular User, such information may be processed together with the Personal Data and other personal information of such User.

  1. Policy Changes; Other Provisions

11.1 The Research Institute NIIOZMM may periodically make changes to this Policy, including reflecting changes in the scope of services provided by the Research Institute NIIOZMM or changes in the functionality of the Portal, as well as changes in legislation. The new version of the above-mentioned Terms and confidential conditions comes into force from the moment of its publication, unless it specifies a different time period for its entry into force.

Download file