Privacy policy

1. General provisions

This Privacy Policy (the Policy) describes how InMotion Sport Clinic (the Clinic) collects, processes and protects the personal data of patients, their legal representatives, visitors to the website inmotion.kz and users of the patient account.

The Policy is drawn up in accordance with Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection”, the Code of the Republic of Kazakhstan “On Public Health and the Healthcare System” and other legislation of the Republic of Kazakhstan.

Consent to the processing of personal data is given separately: by ticking the box in the booking form on the website, in the patient account or by signing a form at the Clinic.

2. Personal data operator

The owner and operator of the personal data is the Clinic. The legal name, BIN, address and contacts are listed under “Clinic details” at the bottom of the page.

3. What data we process

• Appointment request: name, phone number, chosen service, comment (if you left one), language and address of the page the request was sent from, advertising campaign tags, date and time of consent and the version of its text.
• Partnership request: surname, first name, patronymic, specialisation, organisation, phone number, type of request and comment.
• Clinic patients: surname, first name, patronymic, date of birth, phone number, city, occupation and information about their health — complaints, examination and functional test results, diagnosis, rehabilitation plan and program, well-being diary entries, weekly summaries, workout check-ins and medical documents.
• Technical data: IP address and time of requests — to protect the services from code guessing and abuse; a log of actions with the medical record.

Information about health is subject to medical confidentiality and receives special protection.

4. Purposes of processing

• to handle your request, contact you and book an appointment;
• to provide rehabilitation medical services: keep the medical record, draw up and adjust the exercise program, monitor progress;
• to run the patient account: sign-in with a one-time code sent by SMS or issued at the Clinic, program, diary, documents;
• to consider a partnership proposal;
• to comply with the law, including the rules for keeping and storing medical records;
• to protect the services from unauthorised access.

5. Grounds for processing

Personal data are processed with the consent of the data subject or their legal representative, and in cases where the law allows processing without consent. The Clinic keeps the date of consent, the version of its text and the way it was given.

Personal data of minors are processed with the consent of their legal representatives.

6. How we process data

Processing includes collection, recording, systematisation, accumulation, storage, clarification, use, depersonalisation, blocking and destruction of personal data.

Data are processed in the Clinic's information system. Only staff involved in your treatment can access the medical record, and only within their duties. Every access to the record is written to the action log.

7. Where and how long data are stored

Personal data are stored on servers in the Republic of Kazakhstan; backups are encrypted and are also stored in the Republic of Kazakhstan.

Request data are kept while they are needed to book you and contact you. Medical data are kept for the retention period for medical records established by the legislation of the Republic of Kazakhstan. After that period the data are destroyed or depersonalised.

8. Disclosure to third parties

The Clinic does not sell personal data or disclose them for advertising. Data may be disclosed:

• to organisations that serve the Clinic's services (server and backup hosting, sending SMS sign-in codes, handling requests) — under a contract, with a confidentiality obligation and only to the extent needed for the service;
• to the doctor who referred you — only with your separate consent;
• to public authorities — in cases provided for by law.

Personal data are not transferred across borders.

9. Cookies and analytics

The website does not use advertising cookies or third-party counters. For the booking form to work, the browser temporarily keeps a draft of the request and the tags of the advertising campaign that brought you to the website in the tab storage; they are deleted when the tab is closed. The patient account uses a technical session cookie without which sign-in is impossible.

If the Clinic connects web analytics, the Policy will be amended. Names, phone numbers and health information are not passed to analytics systems.

10. Your rights

In accordance with the law you have the right to:

• know whether the Clinic holds your personal data and receive information about them and their processing;
• request that your personal data be changed or supplemented where there are grounds;
• request that personal data processed in breach of the law be blocked and destroyed;
• withdraw your consent to the processing of personal data, except where this contradicts the laws of the Republic of Kazakhstan;
• appeal against the Clinic's actions to the authorised body for personal data protection or to a court.

11. How to withdraw consent or contact the Clinic

A request or withdrawal of consent is submitted as a written application at the Clinic or by the email listed under “Clinic details”. The Clinic replies within the time limits set by law.

After consent is withdrawn, the Clinic stops processing your data, except for data that must be kept by law, and the patient account stops accepting new data from you.

12. Data protection

• encrypted connections to the website, the patient account and the staff workplace, encrypted backups;
• staff sign in with a password and a second factor, patients with a one-time code sent by SMS or issued at the Clinic;
• access control: each staff member sees only the records they work with;
• a log of actions with the medical record;
• limits on sign-in attempts and on sending requests.

In the event of an incident affecting personal data, the Clinic takes measures in accordance with the law.

13. Changes to the Policy

The Clinic may change the Policy. A new version is published on this page with its date. If the changes require new consent, the Clinic will ask for it again.