Privacy Policy

1. General provisions

1.1. This Privacy Policy (hereinafter — the Policy) sets out the procedure for processing and protecting the personal data of users of the iBolid.kz online portal and related services hosted on the ibolid.kz and mag.ibolid.kz domains (hereinafter — the Portal).

1.2. The owner and operator of the personal data is 2Medlink Group LLP, BIN 260740001075, registered address: Republic of Kazakhstan, Almaty, 37 Abay Ave. (hereinafter — the Company, "we").

1.3. The Policy has been developed in accordance with the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Its Protection" (hereinafter — the Personal Data Law), the Code of the Republic of Kazakhstan No. 360-VI of 7 July 2020 "On Public Health and the Healthcare System" (hereinafter — the Health Code), the Law of the Republic of Kazakhstan No. 418-V of 24 November 2015 "On Informatization", and other regulatory legal acts of the Republic of Kazakhstan.

1.4. Use of the Portal means that the user has read the Policy. Processing of a user's personal data begins only after the user has given consent in the manner described in Section 7 of the Policy.

1.5. The current version of the Policy is always available at https://ibolid.kz/en/legal/privacy.

2. Definitions

Personal data — information relating to a personal data subject who is identified or identifiable on the basis of such information, recorded on an electronic, paper and (or) other tangible medium.

Subject (user) — a natural person to whom the personal data relates: a patient, doctor, or representative of a clinic, pharmacy or manufacturer.

Partner — a medical organization (clinic, medical center), pharmacy, pharmacy chain, pharmaceutical manufacturer or doctor that posts information on the Portal and (or) accepts appointments and orders through the Portal.

Processing of personal data — actions involving the collection, recording, systematization, accumulation, storage, alteration, supplementation, use, distribution, de-identification, blocking and destruction of personal data.

3. What personal data we process

3.1. On registration and sign-in. Mobile phone number, first and last name, one-time confirmation code (OTP), date and time of registration and sign-ins, account role (patient, doctor, clinic, pharmacy, manufacturer), the fact and date of the consents given, and the version of the Policy under which consent was given.

3.2. Patient profile (completed optionally). Date of birth, sex, blood type, city, email address, profile photo.

3.3. Booking a doctor's appointment. Patient's first and last name, phone number, the selected doctor, clinic and branch, appointment date and time, appointment format (in person, online, home visit, call back), a description of the complaint or reason for the visit if the user provided one, the appointment status and its change history, the cancellation reason, and the fact of a no-show. When booking an appointment for another person (a child, a relative), that person's name and phone number are also processed.

3.4. Ordering and reserving medicines. Order contents, the selected pharmacy, the collection type (pickup or delivery), delivery address, order comment, order amount, order status.

3.5. Reviews and ratings. Review text, criteria ratings, photos, the author's display name, the link between the review and a completed visit, and the partner's replies.

3.6. Favorites and subscriptions. Saved doctors, clinics, pharmacies and medicines, and subscriptions to changes in a medicine's price.

3.7. Data of doctors and partner representatives. Last name, first name, patronymic, specialization, length of experience, place of work, license or certificate number, copies of the diploma and certificates uploaded for verification, contact details, information about completion of continuing medical education modules and the CME credits earned, and a photo.

3.8. Data of manufacturer representatives. Company name, BIN, country, website, contact details of the representative.

3.9. Technical data. IP address, date and time of requests, type and version of the browser and operating system, interface language, cookie identifiers, and the city selected or determined by geolocation. Geolocation is requested only with the explicit permission of the browser and is used solely to suggest the nearest city to the user; coordinates are not stored on the server.

3.10. We do not collect biometric data, do not request bank card numbers and do not process user payments: payment for medical services and medicines is made directly to the clinic or pharmacy, bypassing the Portal.

4. Health data

4.1. Some of the information processed constitutes personal data concerning health: a description of the complaint when booking an appointment, the specialization of the selected doctor, appointment history, the contents of an order for medicines, and the content of a review if the user discloses information about their health in it.

4.2. Such data is processed solely on the basis of separately expressed user consent and only to the extent necessary to arrange the appointment or order.

4.3. Information about the fact of seeking medical care and about a person's state of health constitutes a secret protected by law. Within the Company, access to it is granted only to authorized employees who need it to perform their job duties, and such access is logged.

4.4. We strongly recommend not stating in open fields (review text, order comment) health information that the user is not prepared to make publicly available.

5. Purposes of processing

We process personal data for the following purposes:

• registration and verification of the user's identity when signing in with a one-time code;
• arranging an appointment booking and a medicine order and transferring them to the partner; confirming, rescheduling and cancelling a booking;
• sending notifications related to a booking and an order: creation, confirmation, appointment reminder, cancellation;
• maintaining the personal account: history of bookings and orders, favorites, reviews;
• verification of doctors and partners; checking the accuracy of the information posted;
• moderation of reviews and resolution of disputes about them;
• handling requests to the support service;
• ensuring the security of the Portal: protection against code guessing, automated attacks and abuse;
• generating de-identified statistics and improving the service;
• sending advertising and information mailings — only where separate consent has been given for this;
• fulfilling obligations provided for by the legislation of the Republic of Kazakhstan.

6. Legal grounds

6.1. The primary legal ground for processing is the consent of the personal data subject, expressed in the manner set out in Section 7 of the Policy.

6.2. Processing may also be carried out without consent in cases expressly provided for by the Personal Data Law, including for the performance of a contract to which the subject is a party, to protect the subject's vital interests, and to fulfil obligations imposed on the Company by law.

7. Consent and its withdrawal

7.1. Consent to the collection and processing of personal data is given by the user upon first registration on the Portal, by ticking the corresponding box on the registration form. Without this tick, registration is not completed.

7.2. Consent to receive advertising and information mailings is given by a separate optional tick and does not affect the ability to use the Portal.

7.3. We record the date and time of consent, as well as the version of the Policy in effect at that moment.

7.4. The user has the right to withdraw consent at any time by sending a request to info@ibolid.kz from the phone number or email address stated in the profile, or through the support section in the personal account. Withdrawal of consent does not extend to data whose processing is mandatory by law, or to bookings and orders already made, to the extent necessary for the partner to perform its obligations.

7.5. Withdrawal of consent makes further use of the Portal using personal data impossible: the account is blocked or deleted.

8. To whom the data is transferred

8.1. To partners — the medical organization, doctor or pharmacy chosen by the user — the data necessary to provide the requested service is transferred: name, phone number, appointment date and time, appointment format, complaint description, and the contents and delivery address of the order. The partner processes this data as an independent owner of personal data and bears independent responsibility for it.

8.2. To communication and notification service providers — to the extent necessary to deliver the message:

8.3. To state authorities — upon a reasoned request, in the manner and to the extent provided for by the legislation of the Republic of Kazakhstan.

8.4. We do not sell personal data, and do not transfer it to advertising networks, data brokers or other third parties for their own purposes.

9. Cross-border transfer

9.1. The transfer of data to the WhatsApp Business Cloud API (Meta Platforms Ireland Ltd., Ireland) and to Google LLC services (USA) constitutes a cross-border transfer of personal data.

9.2. Such transfer is carried out only with the user's consent, to the minimum extent necessary to deliver a notification or sign in to an account, and only provided that the receiving party ensures the protection of personal data.

9.3. The user has the right to opt out of WhatsApp notifications while keeping notifications in the personal account, by sending a request to info@ibolid.kz.

10. Place and period of storage, destruction

10.1. The personal data of citizens of the Republic of Kazakhstan is stored in databases located in the territory of the Republic of Kazakhstan.

10.2. Storage periods:

• account and profile data — for the entire period the account exists;
• data on appointment bookings and medicine orders — for the period necessary to resolve possible disputes and comply with the requirements of the law, but no less than the limitation period;
• one-time confirmation codes — until they expire (5 minutes) and are subsequently cleared technically;
• reviews — until they are deleted by the author or a moderator;
• information about the consents given — for the entire storage period of the corresponding data and at least three years after its deletion, for the purposes of a legal audit.

10.3. Once the purpose of processing has been achieved, upon expiry of the storage period, or upon withdrawal of consent, personal data is destroyed or de-identified. Reviews left by a user may be retained in de-identified form — without the author's name and without a link to the account.

11. Data protection

We apply legal, organizational and technical protection measures, including:

• traffic encryption via the HTTPS protocol on all Portal domains;
• sign-in without a permanent password — using a one-time code with a limited validity period and a limit on the number of attempts;
• storage of access tokens in secure cookies inaccessible to browser-side scripts;
• rate limiting of requests to protect against code guessing and automated attacks;
• role-based access control: each employee and partner sees only the data necessary for their work;
• logging of actions with appointment bookings and access to medical data;
• backup and data integrity control.

12. User's rights

12.1. The user has the right to:

• obtain information about which of their personal data is being processed, by whom and for what purpose;
• demand the alteration and supplementation of incomplete or inaccurate data;
• demand the blocking of data where there are reasonable doubts about the lawfulness of its processing;
• demand the destruction of data processed in violation of the law;
• withdraw consent to processing;
• opt out of advertising mailings;
• appeal the Company's actions to the authorized body in the field of personal data protection or to a court.

12.2. Some data can be changed by the user independently in the personal account. Other requests are sent to info@ibolid.kz; we respond to them within the period set by the legislation of the Republic of Kazakhstan.

12.3. To protect the data, we have the right to request additional confirmation of the applicant's identity before fulfilling a request.

13. Data of minors and booking on behalf of another person

13.1. Independent registration on the Portal is permitted for persons who have reached the age of eighteen.

13.2. The user has the right to arrange an appointment booking or an order for another person — a child, relative or ward. In this case, the user confirms that they have the lawful right to provide us with that person's data and that they have obtained that person's consent (the consent of a legal representative — for a minor).

13.3. If we become aware that a minor's data has been provided without such a right, it will be deleted.

14. Cookies

The procedure for using cookies and similar technologies is described in the Cookie Policy.

15. Changes to the Policy

15.1. We have the right to amend the Policy. A new version takes effect from the moment it is posted on the Portal, unless the version itself states otherwise.

15.2. Each version is assigned a version number; the version under which the user gave consent is retained in their account.

15.3. In the event of a material change to the processing terms, we notify users through the Portal and have the right to request new consent.

16. Contacts

2Medlink Group LLP
BIN 260740001075
Republic of Kazakhstan, Almaty, 37 Abay Ave.
Email: info@ibolid.kz

For questions about the processing of personal data, and to exercise the rights listed in Section 12, contact info@ibolid.kz with the note "Personal data".