Privacy Policy
This policy explains what data the website receives, why it is needed, how long it is retained, and how you can exercise your rights.
Version 2 · effective 11 August 2026
1Who processes personal data
The personal data controller is phlebologist Oleksandr Tatarin. The website is used to inform patients, receive enquiries, and arrange consultations.
Current telephone, email, and clinic address are displayed on this page from the website settings. You can use these contacts for questions about personal data processing.
2What data we receive
When you submit a form, we receive your name, telephone number, the selected or entered reason for the enquiry, form type, page address, referrer when available, a technical submission identifier, submission time, and server-side evidence of the notice shown to and accepted by you.
The reason for the enquiry may contain health-related information. Do not provide more medical information in the form than is necessary for the initial contact.
The raw IP address is not stored. The CMS temporarily uses an HMAC fingerprint of the IP address only to protect the form from abuse.
3Purposes and legal basis
The data is used to receive your enquiry, contact you, answer questions, arrange a consultation or appointment, protect the form from automated abuse, and demonstrate that you provided consent.
The legal basis for processing data submitted through the form is your explicit, informed consent, which you provide before submission. You may choose not to submit the form and instead use the published contact details.
4Who can access the data
Personal data in an enquiry is accessible only to authorised users of the protected Admin panel within their roles and to technical infrastructure providers that operate the website, CMS, database, and network.
Telegram receives only a technical notification of a new enquiry, the form type, server time, and submission identifier. Your name, telephone number, reason for enquiry, page address, and referrer are not sent to Telegram.
We do not sell personal data or provide it to advertising platforms.
5Retention and deletion
An enquiry is retained for no longer than 90 days from submission. After that period, an automated hourly task deletes the record from the CMS and database.
The HMAC fingerprint of the IP address is needed only during the ten-minute rate-limit window and is cleared during the next scheduled hourly run. The raw IP address is not stored in the enquiry.
Backups are retained separately according to a limited operational cycle and are used only for recovery after a failure. Data from a backup is not returned to active processing except during a controlled system recovery.
6Your rights
You have the right to know the sources of collection, storage location, processing purpose, controller, and recipients of your data; access your data; request correction or deletion of inaccurate or unlawfully processed data; object to processing; and withdraw consent.
You may also complain to the Ukrainian Parliament Commissioner for Human Rights or apply to a court. To exercise your rights, use the current contact details shown on this page. To locate an enquiry without excessive disclosure, you may be asked to confirm your telephone number and approximate enquiry time.
7How we protect data
Data is transmitted over a protected HTTPS connection, stored in a private CMS and database, and accessed according to role-based permissions. Integration secrets are not stored in public Admin fields or frontend code.
No processing method eliminates every risk. If an incident is confirmed, we will restrict access, preserve the necessary technical evidence, and take the steps required by law.
9Technical infrastructure and other countries
Network, hosting, or service infrastructure providers may technically process network data in other countries under their terms and applicable law. We limit the data provided to each service to what is necessary for its function.
Changing a provider or connecting a new integration that receives personal data requires a separate review of this policy and the Admin settings.
10Policy updates
Each new version is published with a separate version number and effective date. Material changes to the purposes, categories of data, recipients, or retention period require renewed approval before publication.
A draft in the Admin panel is not a public policy and is not shown to visitors until approval is complete.
This English version is a translation for convenience. If the versions differ, the Ukrainian version governs.
11Contacts
For questions about personal data processing, contact phlebologist Oleksandr Tatarin.