Privacy policy

Data controller: Doladu Clinic medical centre, address: вул. Другетів, 103, м. Ужгород, 88002.

This policy follows the Law of Ukraine «On Personal Data Protection», the Fundamentals of the Legislation of Ukraine on Health Care and the law on medical confidentiality. For visitors from the European Union we also take into account the General Data Protection Regulation (GDPR).

By using the website, sending a request, booking an appointment or signing in to the account, you confirm that you have read this policy.

Contact details: name, phone number, email address, preferred language.

Account data: the phone number confirmed through Telegram, the chat ID with the clinic bot, your role in the system (patient, doctor, administrator).

Health data: complaints and comments in requests, in the chat and in AI doctor matching; appointments and consultations; documents in the medical record (test results, conclusions, discharge summaries); speech transcripts and summaries of online consultations; doctor's notes.

Data for the declaration with a family doctor: full name, date of birth, sex, passport or ID card details, taxpayer number, address, contacts, data of a child and their legal representative or a trusted person, and photos or scans of these documents.

Shop orders: order contents, delivery method and address.

Technical data: IP address, browser and device type, date and time of requests, cookies and the browser's local storage (see section 9), server logs.

We do not ask for data we do not need. If you do not provide the required data we cannot provide the related service (for example, book you in or file a declaration).

Providing medical care and services, keeping medical records.

Booking appointments and online consultations, running video consultations, visit reminders.

Contacting you: calls from the front desk, replies in the chat and Telegram, emails.

Concluding a declaration on the choice of a primary care doctor in the national eHealth system.

Running the patient account and medical record, receiving test results from partner laboratories.

Matching a doctor or service to your description (AI matching) and site search.

Processing and delivering shop orders.

Website security, abuse prevention and compliance with the law.

Your consent to the processing of personal data, including health data (the consent text is published on the «Consent to data processing» page).

Concluding and performing a contract for medical services, and steps you ask for before it.

Legal obligations of a health care institution (medical records, reporting, eHealth).

Health data is processed for health care, diagnosis and treatment by medical staff and other clinic staff bound by medical confidentiality (Article 7 of the Law «On Personal Data Protection»).

AI doctor matching, chat replies outside working hours, smart search, document recognition for declarations and summaries of online consultations run on Claude models by Anthropic PBC (USA). Only the text needed for a particular answer is sent (your description, a message, a document photo or a call transcript).

Anthropic processes this data as the clinic's service provider and, under its commercial terms, does not train its models on it.

The AI does not diagnose or prescribe treatment: it only suggests which doctor or service to choose. Decisions about your health are made by a doctor.

Speech recognition during a video consultation is done by your browser (in Google Chrome, by Google's recognition service). Only the doctor sees the transcript; it is used for the consultation summary in the medical record.

The clinic's doctors and administrators, within their duties.

The central database of the national eHealth system (NHSU) — for declarations and medical records, as required by law.

Partner laboratories — if you take tests there on the clinic's referral.

Service providers acting on the clinic's behalf: hosting and storage; Anthropic PBC (AI, see section 5); Telegram (the clinic bot, sign-in and notifications); Google (the clinic's email, maps and reviews, Google Analytics — with your consent); Microsoft (Clarity — with your consent); delivery services for shop orders.

Public authorities — only in the cases and in the manner provided by law.

We do not sell personal data or share it for advertising.

Some providers (Anthropic, Google, Microsoft, Telegram) process data on servers outside Ukraine, including in the USA. Such transfers are based on your consent and limited to what the purpose requires (Article 29 of the Law «On Personal Data Protection»).

No longer than the purpose requires or the periods set by law.

Medical records — for the periods set by the law on medical documentation, even if you delete your account.

Photos and scans of documents for a declaration — until it is filed, but no longer than 30 days; the declaration form data — while the declaration is in force and for the period set by law.

Requests, chat conversations and technical logs — as long as they are needed to contact you, for security and record keeping.

Without your consent the website uses only necessary cookies and local storage entries: refresh_token — keeps you signed in (up to 30 days, not readable by page scripts); doladu_auth — a sign that you are signed in; theme — light or dark theme; doladu_cart — the shop cart; doladu_visitor — the chat conversation ID.

Analytics runs only after you agree in the cookie banner: Google Analytics 4 (Google LLC; cookies _ga, _ga_*) counts visits and actions on the site, Microsoft Clarity (Microsoft Corporation; cookies _clck, _clsk, CLID) shows heatmaps and de-identified session recordings. Page addresses are sent without parameters, form fields and the chat are hidden, and the patient account, medical record, declarations, sign-in, cart, video calls and staff pages are never recorded.

You can change your mind at any time with the «Cookie settings» link at the bottom of every page. We use no advertising cookies.

Data in transit is encrypted (HTTPS). Medical record and declaration documents are kept in private storage and open only through temporary links for those entitled to see them.

Staff access is role-based; staff are bound by medical confidentiality and the confidentiality of personal data.

Signing in is confirmed through Telegram, and sessions expire.

We process children's data with the consent and at the request of their parents or other legal representatives.

If you provide another person's data (for example, a child's or a trusted person's), you confirm you are entitled to do so.

Under Article 8 of the Law «On Personal Data Protection» you have the right to: know who processes your data, where and why; access your data and learn which third parties received it; have inaccurate data corrected and unlawfully processed data destroyed; object to processing; withdraw consent (this does not affect processing before the withdrawal or processing required by law); know how automated processing works and be protected from decisions made solely by automated means; complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

For personal data questions write or call: [email protected], +380 77 777 54 23, вул. Другетів, 103, м. Ужгород, 88002.

We answer requests for access to data within 30 calendar days.

We may update this policy when the law or the website changes. The current version is always published on this page.