Main

PRIVACY POLICY

Joint Stock Company “Navigator of Health”

1. General Provisions This Privacy Policy describes how Joint Stock Company “Navigator of Health” (the “Operator”, “Company”, “Data Controller”, “we”, “us” or “our”) collects, records, systematizes, accumulates, stores, updates, retrieves, uses, transfers, anonymizes, blocks, deletes, destroys and otherwise processes personal data of visitors and users of the website https://nvhealth.ru/ (the “Website”).
This Privacy Policy has been prepared in accordance with Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”, Federal Law No. 149-FZ dated July 27, 2006 “On Information, Information Technologies and Protection of Information”, and other applicable laws of the Russian Federation.
This Privacy Policy applies to personal data collected through the Website, website forms, electronic communications and other communication channels made available by the Operator in connection with the Website.
This Privacy Policy should be read together with the Public Offer Agreement, consent forms, notices and other documents published on the Website, where applicable.

2. Terms and DefinitionsFor the purposes of this Privacy Policy, the following terms shall have the meanings set out below.
Personal Data: Any information relating directly or indirectly to an identified or identifiable individual.
Personal Data Processing: Any action or set of actions performed with personal data, with or without automated means, including collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer, anonymization, blocking, deletion and destruction.
Automated Processing: Processing of personal data using computer technologies and software tools.
Blocking of Personal Data: Temporary suspension of personal data processing, except where processing is required for clarification or updating of such data.
Anonymization: Actions resulting in the impossibility of identifying a specific individual without using additional information.
Disclosure of Personal Data: Actions aimed at making personal data available to a specific person or a defined group of persons.
Dissemination of Personal Data: Actions aimed at making personal data available to an indefinite number of persons, including publication online or through other public channels.
Cross-Border Transfer of Personal Data: Transfer of personal data to the territory of a foreign state, including transfer to a foreign authority, individual or legal entity.
User: Any visitor or user of the Website.

3. Operator Details Operator: Joint Stock Company “Navigator of Health” / JSC “NAVIGATOR OF HEALTH”.
Registered address: 12 Krasnopresnenskaya Embankment, Premises 3/2, Presnensky Municipal District, Moscow, 123610, Russian Federation.
TIN: 9703245427; KPP: 770301001.
Website: https://nvhealth.ru/.
Contact email for personal data requests: info@nvhealth.ru.

4. Categories of Personal Data Processed The Operator may process the following categories of personal data, depending on the user’s actions on the Website and the specific service requested:

• surname, first name and patronymic, where provided;
• telephone number;
• email address;
• information provided in messages, requests, application forms, feedback forms or other Website forms;
• information related to orders, requests, payment status and interaction with the Operator;
• technical data, including IP address, browser type, device information, operating system, cookies and similar identifiers, where applicable;
• other information voluntarily provided by the user to the Operator.

Fields required for access to specific Website functionality or services may be marked as mandatory. If mandatory information is not provided, the Operator may be unable to provide the relevant functionality or service.

5. Special Categories of Personal Data and Health-Related InformationThe Website and the services provided under the Public Offer Agreement are intended for informational and consulting purposes unless expressly stated otherwise.
The Operator does not request users to submit medical records, diagnoses, information about health status, prescriptions, test results or other special categories of personal data unless such information is expressly required for a specific lawful purpose and the Operator has a proper legal basis for processing it.
If a user voluntarily provides health-related information through the Website or communication channels, such information may be treated as special category personal data and shall be processed only where permitted by applicable law, including on the basis of the user’s separate explicit consent where such consent is required.
The Operator does not process biometric personal data through the Website unless expressly notified to the user and supported by a proper legal basis.

6. Purposes of Personal Data Processing The Operator processes personal data for the following purposes:

• providing access to the Website and its functionality;
• registration, identification and administration of user accounts, where applicable;
• communication with users and responding to inquiries, requests and complaints;
• conclusion and performance of agreements with users, including the Public Offer Agreement;
• providing informational, consulting and technical support;
• processing orders, payments, refunds and related accounting or reporting operations;
• improving Website performance, security and user experience;
• sending service-related notifications and, subject to proper legal basis, marketing communications;
• compliance with legal obligations, including accounting, tax, consumer protection and personal data protection requirements;
• protecting the rights and legitimate interests of the Operator and users.

For communication purposes, the Operator may use the telephone number and email address provided by the user.

7. Legal Bases for ProcessingThe legal bases for personal data processing may include:

• Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”;
• Federal Law No. 149-FZ dated July 27, 2006 “On Information, Information Technologies and Protection of Information”;
• consent of the personal data subject;
• agreements concluded with or for the benefit of the personal data subject;
• necessity to comply with legal obligations imposed on the Operator;
• necessity to protect the rights and legitimate interests of the Operator or third parties, provided that the rights and freedoms of the personal data subject are not violated;
• other legal grounds provided by applicable legislation of the Russian Federation.

8. Consent to Personal Data Processing Where processing is based on consent, the user gives consent freely, specifically, consciously, unambiguously and in an informed manner.
Acceptance of the Public Offer Agreement does not replace separate consent to personal data processing where such separate consent is required by law.
The user may withdraw consent at any time by sending a request to the Operator using the contact details specified in this Privacy Policy. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.
Separate consent may be required for processing special categories of personal data, receiving marketing communications, using certain cookies or transferring personal data to third parties where required by applicable law.

9. Cookies and Similar Technologies The Website may use cookies, web analytics tools and similar technologies to ensure proper operation of the Website, remember user preferences, improve Website performance, analyze traffic and enhance user experience.
Cookies may be strictly necessary, functional, analytical or marketing-related. Marketing cookies shall be used only where a proper legal basis exists, including user consent where required by law.
The user may restrict or disable cookies in the browser settings. Disabling certain cookies may affect Website functionality.
Where the Website uses third-party analytics or advertising tools, information about such tools shall be provided on the Website or in a separate cookie notice where applicable.

10. Methods and Conditions of Processing Personal data may be processed with or without the use of automated means.
The Operator processes personal data lawfully, fairly, only for specific, predetermined and legitimate purposes, and only to the extent necessary for those purposes.
The Operator does not combine databases containing personal data processed for incompatible purposes.
The Operator shall not make decisions producing legal consequences for the user or otherwise significantly affecting the user solely on the basis of automated processing, unless such processing is permitted by law and the user is properly informed.

11. Storage, Localization and Retention Personal data shall be retained only for as long as necessary to achieve the purposes of processing, unless a longer retention period is required by law or by an agreement involving the user.
Where personal data of citizens of the Russian Federation is collected, the Operator shall ensure recording, systematization, accumulation, storage, updating, modification and retrieval of such personal data using databases located in the Russian Federation, where required by applicable law.
Upon achievement of processing purposes, expiry of the retention period or withdrawal of consent, personal data shall be deleted, destroyed or anonymized, unless further processing is required or permitted by applicable law.

12. Transfer to Third Parties and Entrusted Processing The Operator may transfer personal data to third parties or entrust processing of personal data to third parties only where there is a lawful basis and only to the extent necessary for the relevant processing purpose.
Such third parties may include hosting providers, IT service providers, communication service providers, payment service providers, professional advisers and other persons involved in the operation of the Website or performance of obligations to the user.
Where processing is entrusted to a third party, the Operator shall require such third party to maintain confidentiality and ensure the security of personal data in accordance with applicable law.
Personal data shall not be sold to third parties.

13. Cross-Border Transfer of Personal Data Before carrying out any cross-border transfer of personal data, the Operator shall comply with applicable requirements of the legislation of the Russian Federation, including notification and assessment requirements where applicable.
Cross-border transfer may be carried out only where there is a lawful basis and where the rights of personal data subjects are protected in accordance with applicable law.
If cross-border transfer requires separate consent or additional notification, the Operator shall take the necessary steps before such transfer is carried out.

14. Confidentiality and Security Measures The Operator and persons authorized to process personal data shall maintain confidentiality of personal data and shall not disclose such data without lawful grounds.
The Operator implements legal, organizational and technical measures designed to protect personal data against unauthorized or accidental access, destruction, modification, blocking, copying, disclosure, dissemination and other unlawful actions.
Such measures may include access control, internal policies, employee instructions, confidentiality obligations, technical protection measures, backup procedures and monitoring of personal data processing procedures.

15. Rights of Personal Data Subjects Personal data subjects have the right to:

• obtain information regarding the processing of their personal data;
• request access to their personal data;
• request correction, blocking or deletion of inaccurate, outdated, incomplete, unlawfully obtained or unnecessary personal data;
• withdraw consent to personal data processing where processing is based on consent;
• request termination of personal data processing in cases provided by law;
• challenge unlawful actions or omissions of the Operator before competent authorities or courts;
• exercise other rights provided by the legislation of the Russian Federation.

Personal data subjects shall provide accurate and up-to-date personal data and notify the Operator of relevant changes. Persons providing inaccurate information or disclosing personal data of third parties without proper authority may bear liability in accordance with applicable law.

16. Procedure for Submitting Requests Requests related to personal data processing may be submitted to the Operator by email at info@nvhealth.ru or by other contact method published on the Website.
The request should contain sufficient information to identify the applicant and the nature of the request. Where necessary, the Operator may request additional information to verify the identity or authority of the applicant.
The Operator shall consider requests and provide responses within the timeframes established by applicable law.

17. Marketing Communications The Operator may send informational messages related to the Website, services, orders, requests or technical matters where such communication is necessary for performance of an agreement or for responding to the user’s request.
Marketing, advertising or promotional communications shall be sent only where there is a proper legal basis, including the user’s prior consent where required by applicable law.
The user may withdraw consent to marketing communications at any time using the unsubscribe mechanism provided in the message, if available, or by contacting the Operator.

18. Personal Data of Minors The Website is not intended to collect personal data of persons under the age of 18 without the involvement and consent of their legal representatives where such consent is required by law.
If the Operator becomes aware that personal data of a minor has been provided without proper legal basis, the Operator shall take reasonable steps to delete or otherwise lawfully process such data in accordance with applicable law.

19. Amendments to this Privacy Policy The Operator may amend this Privacy Policy from time to time. The current version shall be published on the Website.
Unless otherwise stated, amendments enter into force from the date of publication of the updated version on the Website.
Users are encouraged to review the current version of this Privacy Policy before using the Website or submitting personal data.

20. Final Provisions This Privacy Policy is governed by and shall be interpreted in accordance with the legislation of the Russian Federation.
If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

This Privacy Policy shall remai