Privacy Policy
1. General provisions
1.1. This Privacy Policy (the Policy) defines the procedure for processing and protecting personal data of users of the Cordis mobile application (the Application).
1.2. The personal data operator is:
CORDIS Medical Assistance LLP
BIN 210940031283
Address: 58A Abay Avenue, Bostandyk district, Almaty, Kazakhstan, postal code 050008
Email: cordis.dev.kz@gmail.com
Call center: 5550
(hereinafter, the Company).
1.3. The Company determines the purposes and methods of processing personal data of Application users and is responsible for compliance with the legislation of the Republic of Kazakhstan on personal data and its protection.
1.4. The Application does not independently generate or create insurance data. The Application displays information received from the Company's active information system, where the data is already processed on the basis of concluded agreements, including voluntary health insurance agreements (VHI agreement) and agreements with users' employers.
1.5. By using the Application, the user confirms that they have read this Policy and agree to the personal data processing terms set out in it.
2. Definitions
Company means CORDIS Medical Assistance LLP.
Application means the Cordis mobile and/or web application.
User means an individual who uses the Application on lawful grounds.
Account means a set of data that identifies the User when using the Application.
VHI agreement means a voluntary health insurance agreement under which the User is granted access to the Application.
Personal data means information relating to an identified or identifiable individual.
Information system means the Company's corporate information system that is the source of data displayed in the Application.
3. What data is processed
3.1. Depending on the Application functionality, the following data may be processed:
3.1.1. surname, first name, patronymic
3.1.2. individual identification number (IIN)
3.1.3. date of birth
3.1.4. phone number
3.1.5. email address
3.1.6. employer information
3.1.7. information about the voluntary health insurance agreement
3.1.8. information about the insurance program
3.1.9. information about insurance limits
3.1.10. information about attached family members
3.1.11. information about medical organizations available under the agreement
3.1.12. technical information about the device
3.1.13. authorization logs
3.1.14. IP address
3.1.15. device identifiers
3.2. Depending on the implemented functionality, the Application may process information about medical services, medical documents, laboratory tests and other medical data only to the extent necessary to provide the relevant functions and where there are grounds provided by law.
4. Data source
4.1. Personal data is received:
4.1.1. from the Company's existing information system, where the data is included on the basis of a VHI agreement, employment or civil-law relations between the User, employer and Company, as well as other lawful grounds
4.1.2. directly from the User when using the Application (for example, during authorization)
4.2. The Application is an additional channel for displaying data already existing in the Company's information system and is not the primary source of its creation.
5. Processing purposes
5.1. Personal data is used exclusively for:
5.1.1. user authorization
5.1.2. providing access to information under the VHI agreement
5.1.3. displaying insurance limits
5.1.4. displaying available clinics
5.1.5. ensuring operation of the Application
5.1.6. providing informational support to users
5.1.7. fulfilling contractual obligations
5.1.8. organizing the User's interaction with insurance companies, medical organizations, doctors and laboratories when using the relevant Application functionality
5.1.9. providing the User with medical, advisory, diagnostic and other services available through the Application
6. Actions with personal data
6.1. To achieve the purposes specified in section 5, the Company performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion and destruction of personal data.
7. Data relevance
7.1. Some information displayed in the Application is based on data contained in the Company's information system and received in the course of performing the relevant agreements. Updates to certain information may occur with a delay. The Company recommends that the User verify the relevance of insurance coverage information in the manner provided by the VHI agreement before receiving a medical service.
8. Data transfer
8.1. The Company does not transfer personal data to third parties.
8.2. Except for:
8.2.1. state authorities of the Republic of Kazakhstan in cases provided by law
8.2.2. insurance companies to the extent necessary to perform voluntary health insurance agreements
8.2.3. medical organizations, doctors and laboratories to the extent necessary to provide the User with the relevant medical, advisory, diagnostic and other services provided through the Application or in connection with its use
8.2.4. the User's employer to the extent necessary to administer the VHI agreement
8.2.5. infrastructure providers and technical contractors ensuring operation of the Application (including hosting and information system maintenance), acting under agreements that provide obligations to protect personal data
8.3. The Company does not carry out cross-border transfer of personal data except in cases expressly provided by contractual obligations or legal requirements; in such case, the User will be notified additionally.
9. Data storage
9.1. Personal data is stored for the term of the VHI agreement and/or other processing grounds, and after their termination, for the periods established by the legislation of the Republic of Kazakhstan for storing the relevant categories of documents and information.
9.2. After termination of the VHI agreement, the User's access to the Application is terminated or restricted; data no longer required for the purposes specified in section 5 of this Policy is subject to deletion or anonymization, except for information that must be stored on grounds provided by law.
10. Personal data protection and information security
10.1. The Company takes necessary organizational, technical and legal measures aimed at ensuring the security and confidentiality of personal data and protecting it from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, provision and other unlawful actions in relation to personal data in accordance with the legislation of the Republic of Kazakhstan.
10.2. To ensure personal data security, the Company, in particular:
10.2.1. uses information protection tools and secure data transmission channels
10.2.2. separates access rights to personal data
10.2.3. provides access to personal data only to authorized persons who need such access to perform their job duties or contractual obligations
10.2.4. records and controls access to information systems
10.2.5. takes measures to prevent unauthorized access, alteration, disclosure, loss or destruction of personal data
10.2.6. regularly improves organizational and technical measures for personal data protection considering technological development and current information security threats
10.3. Despite the protective measures taken, transmission of information over the Internet and operation of information systems cannot fully exclude the risk of information security incidents. The Company takes reasonable and sufficient measures to prevent such incidents and minimize their consequences.
10.4. If an incident affecting Users' personal data is identified, the Company acts in accordance with the requirements of the legislation of the Republic of Kazakhstan, takes necessary measures to localize and eliminate the consequences of the incident, and notifies authorized state bodies and/or personal data subjects where such notification is required by law.
11. User rights
11.1. The User has the right to:
11.1.1. receive information about the processing of their personal data
11.1.2. request clarification, blocking or deletion of data in cases provided by law
11.1.3. withdraw consent to data processing if this does not contradict legal requirements and contractual obligations
11.2. To exercise these rights, the User contacts the Company using the contact details specified in the Contacts section. The Company reviews requests within the time limits established by the legislation of the Republic of Kazakhstan.
12. Functionality development and new data categories
12.1. When adding functions that require processing new categories of personal data (including test results, medical conclusions, geolocation, photos and documents, camera data), the Company will update this Policy and, where necessary, obtain separate User consent before such processing begins.
13. Policy changes
13.1. The Company may amend this Policy. The new version takes effect from the moment of publication unless otherwise stated in the new version. The current version of the Policy is always available in the Application.
14. Contacts
14.1. For questions regarding personal data processing, the User may contact the Company using the contact details specified in the Contacts section, which is an integral part of the Application terms of use.