Policy on the Processing and Security of Personal Data
1. General Provisions
1.1. This Policy on the Processing of Personal Data (the "Policy") has been developed in accordance with the Law of the Republic of Tajikistan "On Personal Data Protection", No. 1537 dated 3 August 2018 (the "Law"), and sets out the position of the medical institutions of Dushanbe (the "Institutions") with respect to the processing and protection of personal data ("Personal Data") in order to safeguard the rights and freedoms of individuals. The Policy governs the collection, storage, use and transfer of Personal Data, establishes practical requirements for its protection, and provides information on the rights of the individuals to whom the relevant Personal Data relates.
1.2. Personal Data means any information relating directly or indirectly to an identified or identifiable natural person (a "User" or "Data Subject").
1.3. Processing of Personal Data means any action (operation), or set of actions (operations), performed on Personal Data by automated means and/or without the use of such means. Such actions include, in particular, recording, systematization, storage, alteration, supplementation, retrieval, use, dissemination, anonymization, blocking and destruction of Personal Data.
1.4. Security of Personal Data means the protection of Personal Data against unlawful and/or unauthorized access, destruction, alteration, blocking, copying, provision or dissemination, as well as against any other unlawful action involving Personal Data.
1.5. This Policy applies to all activities involving the Processing of Personal Data on the "eTib" digital platform within the information systems of the Institutions.
1.6. A User's use of the "eTib" digital platform constitutes the User's unconditional acceptance of this Policy and the terms governing the Processing of Personal Data set out herein. If a User does not agree to the terms of this Policy, the User must refrain from using the "eTib" digital platform.
1.7. This Policy applies to Personal Data obtained both before and after the effective date of this Policy.
2. Legal Grounds and Purposes for the Processing of Personal Data by the Institutions
2.1. The Institutions process Personal Data and ensure its security for the purpose of performing the functions, powers and duties imposed upon them by the legislation of the Republic of Tajikistan, including, without limitation, in accordance with the Constitution of the Republic of Tajikistan, applicable laws, in particular the Law of the Republic of Tajikistan "On Personal Data Protection", No. 1537 dated 3 August 2018, other regulatory legal acts of the Republic of Tajikistan, and the charters and internal regulations of the Institutions.
2.2. The Institutions may process Personal Data in the following circumstances and on the following legal grounds:
- where the Data Subject has consented to the Processing of Personal Data in any form that allows the fact of such consent to be confirmed, including by the means specified in Clause 1.6 of this Policy;
- where Processing is necessary to exercise the rights and legitimate interests of third parties or to achieve socially significant objectives, provided that the rights and freedoms of the Data Subject are not infringed;
- for statistical or other research purposes, subject to the mandatory anonymization of Personal Data;
- for any other purposes specified in this Policy.
2.3. Personal Data processed under this Policy and required for registration on the "eTib" digital platform includes:
- the User's surname and given name;
- the User's contact telephone number;
- email address (optional).
2.4. Information provided at the request of the Institutions and entered directly by the Institutions (the "eTib" digital platform processes and stores Personal Data solely for the proper and complete operation of the information system):
- the patient's photograph;
- the patient's sex;
- date of birth;
- the patient's citizenship;
- address and contact telephone numbers.
2.5. The Institutions store the Personal Data of Users entered into the information system of the "eTib" digital platform when Users provide their Personal Data and register on the platform, as well as information recorded by the Institutions concerning the course of treatment. The following technical data is also recorded when pages of the "eTib" digital platform are accessed:
- IP address;
- cookie data;
- access time;
- the address of the page on which the information is located;
- referrer (the address of the previous page).
Disabling cookies may prevent a User from accessing certain sections of the "eTib" digital platform.
3. Categories of Personal Data Processed by the Institutions
3.1. The Institutions process the following categories of Users' Personal Data:
- information obtained during registration, authorization and the posting of information (surname, given name, patronymic, date of birth, sex, telephone number, email address, registered address, work address, delivery address and cookie data);
- information obtained in the course of transactions (sex, age, passport details, payment instrument information, city of residence and/or address).
3.2. The Institutions process the following categories of Personal Data of Data Subjects who submit complaints to the Institutions regarding an alleged infringement of their rights: surname, given name and patronymic; passport details (or details of another identity document); contact details (telephone and/or fax number and email address) of the rights holder or other person whose rights have allegedly been infringed and/or of the applicant, where the applicant acts as the authorized representative of the rights holder or other person whose rights have allegedly been infringed; and information concerning complaints received and the progress and outcome of their consideration.
4. Principles and Conditions Governing the Processing of Personal Data
4.1. When Processing Personal Data, the Institutions observe the following principles:
- Personal Data is processed on a lawful basis;
- Personal Data is not disclosed to third parties or disseminated without the consent of the Data Subject, except as provided by the legislation of the Republic of Tajikistan;
- specific and lawful purposes are determined before the Processing, including the collection, of Personal Data begins;
- databases containing Personal Data processed for mutually incompatible purposes are not combined;
- the Processing of Personal Data is limited to the achievement of specific, predetermined and lawful purposes;
- processed Personal Data is destroyed or anonymized when the Data Subject withdraws consent to its Processing, when the purposes of Processing have been achieved, or when the need to achieve those purposes ceases to exist, unless otherwise provided by the legislation of the Republic of Tajikistan;
- the content and scope of the Personal Data processed are consistent with the stated purposes of Processing, and the Personal Data processed is not excessive in relation to those purposes;
- the accuracy and sufficiency of Personal Data, and where necessary its relevance to the stated purposes of Processing, are ensured during Processing.
4.2. The Institutions do not process Personal Data concerning racial or ethnic origin, political opinions, religious, philosophical or other beliefs, health, private life, membership in public associations, including trade unions, or biometric Personal Data. The Institutions do not perform voice input or verification of Personal Data using unsecured data transmission channels.
4.3. The Institutions ensure the recording, systematization, accumulation, storage, clarification (updating and alteration) and retrieval of Personal Data using databases located within the Republic of Tajikistan and do not carry out cross-border transfers of Personal Data.
4.4. The Institutions may transfer Personal Data to third parties with the consent of the Data Subject and in cases where the transfer of Personal Data to third parties is expressly permitted by the legislation of the Republic of Tajikistan and does not require the consent of the Data Subject.
4.5. In order to comply with the applicable legislation of the Republic of Tajikistan and contractual obligations, the Institutions process Personal Data both by automated means and without the use of such means. Processing operations include collection, recording, systematization, storage, clarification, retrieval, use, transfer, anonymization, blocking, deletion and destruction of Personal Data.
4.6. The Institutions do not make decisions based solely on automated Processing of Personal Data where such decisions produce legal effects in relation to a Data Subject or otherwise affect the Data Subject's rights and legitimate interests.
4.7. The Institutions do not verify and, as a general rule, are unable to verify the consistency and accuracy of information provided by Data Subjects through the "eTib" digital platform. The Institutions assume that Data Subjects, acting reasonably and in good faith, provide accurate and sufficient Personal Data and keep it up to date.
5. Rights of Data Subjects
5.1. A Data Subject whose Personal Data is processed by the Institutions has the right to:
- amend (update or supplement) the Personal Data previously provided at any time by accessing the Personal Account, where the functionality of the "eTib" digital platform permits;
- request deletion of the Personal Data previously provided by sending written notice to the Institutions specifying the Personal Data to be deleted.
5.2. A Data Subject also has the right to:
- obtain from the Institutions confirmation that Personal Data is being processed and information concerning the existence of Personal Data relating to the relevant Data Subject;
- obtain information on the legal grounds and purposes for the Processing of Personal Data;
- obtain information on the methods used by the Institutions to process Personal Data;
- obtain information on the names and locations of the Institutions;
- obtain information on persons (other than employees of the Institutions) who have access to Personal Data or to whom Personal Data may be disclosed under an agreement with the Institutions or pursuant to the legislation of the Republic of Tajikistan;
- obtain the Personal Data being processed in relation to the Data Subject and information on the source from which it was obtained, unless the legislation of the Republic of Tajikistan provides for a different procedure for the provision of such data;
- obtain information on the duration of the Processing of Personal Data, including applicable retention periods;
- obtain information on the procedure by which a Data Subject may exercise the rights provided by the legislation of the Republic of Tajikistan;
- obtain the names and addresses of persons processing Personal Data on behalf of the Institutions;
- obtain any other information provided for by the legislation of the Republic of Tajikistan;
- require the Institutions to rectify, block or destroy the Data Subject's Personal Data where such data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purposes of Processing;
- withdraw consent to the Processing of Personal Data at any time through the "eTib" digital platform or by sending written notice to the address of the Institutions. Upon receipt of such notice, the Processing of the Data Subject's Personal Data will cease and the Personal Data will be destroyed, except where Processing may continue in accordance with the legislation of the Republic of Tajikistan;
- require the Institutions to cease any unlawful action involving the Data Subject's Personal Data.
5.3. The rights set out in this Section may be restricted in accordance with the legislation of the Republic of Tajikistan and/or where the Institutions process Personal Data on another lawful basis in addition to the consent of the Data Subject.
6. Obligations of the Institutions
6.1. In accordance with applicable legal requirements, the Institutions must:
6.1.1. At the request of a Data Subject, provide information concerning the Processing of the Data Subject's Personal Data, or issue a reasoned refusal on lawful grounds, within thirty days after receiving the request from the Data Subject or the Data Subject's representative.
6.1.2. At the request of a Data Subject, rectify, block or destroy the Personal Data being processed where such data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purposes of Processing, within no more than seven business days after the Data Subject or the Data Subject's representative provides information substantiating those circumstances.
6.1.3. Maintain a register of requests from Data Subjects recording requests for access to Personal Data and each instance in which Personal Data is provided in response to such requests.
6.1.4. Notify a Data Subject of the Processing of the Data Subject's Personal Data where the Personal Data was not obtained from the Data Subject. The following cases are exempt from this requirement:
- the Data Subject has been informed that the Institutions are processing the Data Subject's Personal Data;
- the Institutions obtained the Personal Data in connection with the performance of an agreement to which the Data Subject is a party, beneficiary or guarantor, or pursuant to the applicable legislation of the Republic of Tajikistan;
- the Institutions process anonymized Personal Data for statistical or other research purposes, provided that the rights and legitimate interests of the Data Subject are not infringed;
- providing the Data Subject with the information contained in a notice concerning the Processing of Personal Data would infringe the rights and legitimate interests of third parties;
- where a Data Subject withdraws consent to the Processing of Personal Data, cease Processing and destroy the Personal Data within no more than thirty days after receipt of the withdrawal. The Institutions must notify the Data Subject that the Personal Data has been destroyed;
- when collecting Personal Data, including through the "eTib" digital platform on the Internet, ensure the recording, systematization, accumulation, storage, clarification (updating and alteration) and retrieval of Users' Personal Data using databases located within the Republic of Tajikistan.
7. Protection of Personal Data
7.1. When Processing Personal Data, the Institutions take the legal, organizational and technical measures necessary to protect Personal Data against unlawful and/or unauthorized access, destruction, alteration, blocking, copying, provision and dissemination, as well as against any other unlawful action involving Personal Data.
7.2. Such measures include, in particular:
- appointing a person responsible for organizing the Processing of Personal Data and a person responsible for ensuring information security;
- developing and approving internal regulations on the Processing and protection of Personal Data;
- implementing legal, organizational and technical measures to ensure the security of Personal Data;
- monitoring the measures adopted to ensure the security of Personal Data and the level of protection afforded by Personal Data information systems;
- assessing the harm that may be caused to Data Subjects in the event of a breach of the legislation of the Republic of Tajikistan and the relationship between such harm and the measures adopted by the Institutions to ensure compliance with their obligations under the legislation of the Republic of Tajikistan;
- complying with conditions that prevent unauthorized access to physical media containing Personal Data and ensure the security of such Personal Data;
- familiarizing employees of the Institutions who are directly involved in the Processing of Personal Data with the relevant legislation of the Republic of Tajikistan, including requirements governing the protection of Personal Data and internal regulations on the Processing and protection of Personal Data, and providing appropriate training to such employees.
8. Personal Data Processing (Retention) Periods
8.1. The period for which Personal Data is processed and retained is determined by reference to the purposes of Processing, the terms of agreements with Data Subjects and the requirements of the applicable legislation of the Republic of Tajikistan:
- the Personal Data of registered Users is retained for the entire lifetime of the User's account;
- the Personal Data of unregistered Users is retained for three years;
- the Personal Data of other persons who have submitted complaints to the Institutions regarding an alleged infringement of their rights is retained throughout the Processing and consideration of the relevant claims and for three years after the completion of such Processing and/or consideration, unless the legislation of the Republic of Tajikistan establishes a different limitation period for the relevant disputes.
8.2. Personal Data for which the Processing or retention period has expired must be destroyed, unless otherwise provided by the legislation of the Republic of Tajikistan. Personal Data may be retained after the cessation of Processing only after it has been anonymized.
9. Procedure for Obtaining Clarification on the Processing of Personal Data
9.1. Data Subjects whose Personal Data is processed by the Institutions may obtain clarification concerning the Processing of their Personal Data by contacting the Institutions in person or by sending a relevant written request to the address of the Institutions.
10. Liability of the Parties
10.1. In accordance with the legislation of the Republic of Tajikistan, the Institutions are liable for documented loss or damage suffered by a User as a result of the unlawful use of the User's Personal Data, except in the circumstances specified in this Policy.
10.2. The Institutions are not liable for the loss or disclosure of a User's Personal Data where such Personal Data:
- was publicly available before its loss or disclosure;
- had been disclosed by third parties before being provided to the Institutions;
- was disclosed with the User's consent;
- was disclosed in any other circumstances provided by the legislation of the Republic of Tajikistan.
11. Amendments to the Policy. Other Provisions
11.1. The Institutions may amend or supplement this Policy from time to time, including to reflect changes in the services provided by the Institutions, the functionality of the "eTib" digital platform or the legislation of the Republic of Tajikistan. A new version of the Policy takes effect upon publication unless it specifies a different effective date.