1. Two roles
- For your account and website data — contacts, password, appointments, reviews, support requests — we are the controller: we decide why and how they are processed.
- Your medical record is kept by professionals and organisations, and they remain the controllers of its data. We store and show that data on their instructions and under your consents.
2. What data we collect
- Account data: email, Telegram username and chat number, phone number, last, first and middle name, date of birth, Daryger ID name, language.
- Profile photo — optional. We re-save it without capture details (place, device, date).
- Appointments: with whom, when, for which service, for whom — yourself or a family member.
- Payments: amount, currency, status. You enter bank card details on the payment service's page — they do not reach us.
- Reviews and support requests — the text and attached screenshots.
- Medical record access: consents, trusted persons and representatives, a log of who opened the record and when.
- Technical data: IP address, browser string, time of sign-in and actions — to protect against password guessing and to investigate failures.
- City: the one you chose, or an approximate one from your IP address. The city is looked up on our own server, in our own database, without third-party services. GPS coordinates are used only when you press the button, are computed in your browser and are not sent to the server.
3. Why we process them
- To give you access to the Platform and identify you at sign-in.
- To book your appointments and pass the professional what the appointment needs.
- To deliver confirmation codes, appointment reminders and security notifications.
- To protect accounts: limit the rate of attempts, notice sign-ins from unfamiliar devices, keep a security event log.
- To show doctors and organisations in your city.
- We do not use your data for advertising and do not sell it.
4. Who we share them with
- The professional or organisation you booked with — what the appointment needs: name, date of birth, the chosen service and time.
- Our hosting provider — the Platform runs and the database is stored on its servers.
- Our email provider — for emails with codes and notifications.
- Telegram — if you linked it: codes and notifications go there.
- The payment service — if you pay for an appointment in advance: the amount and the appointment number.
- Public authorities — only in the cases and to the extent the law expressly requires.
5. How long we keep them
- Account data, appointments and reviews — as long as the account exists.
- Medical records — under the medical records retention rules that professionals and organisations follow.
- Security event log — 180 days; technical logs — 30 days.
- One-time codes — minutes; the texts of sent emails are deleted right after sending.
- After an account is deleted we delete its data within 30 days, except what the law requires us to keep.
6. How we protect them
- Connections use HTTPS only. Passwords are stored as Argon2id hashes, one-time codes as HMACs with a secret key.
- Every sign-in is confirmed with a code in Telegram or by email. Attempts are rate-limited; a series of failures locks sign-in and sends you a warning.
- The most sensitive items — scans of consent forms and representatives' documents — are stored encrypted.
- No method of transfer or storage is perfectly secure, but our measures match the sensitivity of medical data.
7. Your rights
To get a copy of your data, correct inaccurate data, delete your account, restrict or stop processing, and withdraw consent where processing is based on it. You can make any of these requests at the address in the Contact section. We answer within the time set by applicable law.
8. Cookies
We use only necessary cookies: the sign-in session, form forgery protection, and your chosen city, language and theme. We have no analytics or advertising trackers.
9. Children
An account is opened by an adult. Data of children and wards is managed by their legal representative, through the Family section.
10. Changes
We may update this policy. Its date is shown at the top; we will announce material changes via your linked contacts.
11. Contact
Questions about data processing and any request from section 7: in the Support section of your account.