Privacy Policy

1. General

1.1. This Policy sets out how personal data is processed and protected in accordance with the Law of the Republic of Uzbekistan No. ZRU-547 "On Personal Data" of 2 July 2019 and other legislation of the Republic of Uzbekistan.

1.2. The owner and operator of the personal data is [to be added], taxpayer ID (STIR) [to be added], registered address: [to be added], operating as "Gavhar Clinic" at 46 Fazokorlar Street, Tashkent (the "Clinic", "we").

1.3. This Policy covers data we receive through gavharclinic.com (including its Uzbek and English versions), through the Telegram bot @gavharclinic_bot, and when you call the phone numbers listed on the website.

1.4. By submitting a form or using the bot you confirm that you have read this Policy. You give your consent to data processing separately — by ticking the box in the form or tapping the button in the bot (section 4).

2. What data we process

2.1. Data you provide yourself:

• in the booking form — your name, phone number, area of concern (for example, "Knee"), preferred doctor and date, and your question if you write one;
• in the Telegram bot — the phone number you send with the "Share my number" button, the name and ID of your Telegram account, the interface language, and the text of your messages to the bot.

2.2. Data sent automatically: IP address, browser and device type, the page address, and the date and time of the request. These are recorded in server logs and used to protect the website from attacks and spam.

2.3. We do not ask for diagnoses, test results, scans, passport details or other documents through the website or the bot. Please do not send them. Medical information is processed only at the Clinic, during an in-person visit, on the basis of your separate written consent and under medical confidentiality.

3. Purposes of processing

• to book you for an appointment, consultation or check-up and confirm the time;
• to call you back and answer your question;
• to remind you about your appointment (if you use the bot);
• to keep a record of requests and improve our front desk;
• to protect the website and the bot from abuse, spam and attacks;
• to comply with the legislation of the Republic of Uzbekistan.

We do not use your data for marketing messages without your separate consent and we do not sell it to third parties.

4. Consent to processing

4.1. We process your data on the basis of your consent. On the website you give consent by ticking "I agree to the processing of my personal data…" before sending the form; in the bot, by tapping "I agree, share my number". We record the date, time and the version of the Policy you agreed to.

4.2. By giving consent you allow the Clinic ([to be added], STIR [to be added]) to collect, record, organise, store, update, use, transfer (within section 5), anonymise and destroy the data listed in section 2 for the purposes in section 3, including the cross-border transfer described in section 6.

4.3. Consent is valid until the purposes are achieved or until you withdraw it, and no longer than the periods in section 7.

4.4. You can withdraw consent at any time: send /delete to the bot, email gavharclinic@gmail.com, or call 1281 / +998 95 199-77-93. We will then stop processing and delete the data unless the law requires us to keep it.

4.5. If you book on behalf of someone else (for example, a child or relative), you confirm that you are entitled to share their data. Data of persons under 18 is provided only by their parents or legal guardians.

5. Who receives the data

5.1. Only the Clinic's front-desk and administrative staff who need it for their work can see booking requests. They are bound by confidentiality.

5.2. To run the website and the bot we use technical processors that store and transmit data on our behalf and do not use it for their own purposes:

• Cloudflare, Inc. — website hosting, attack protection, booking database;
• Telegram — delivery of bot messages and staff notifications;
• Google LLC — website fonts and the map on the Contacts page (only when you open that page).

5.3. We disclose data to public authorities only in the cases and in the manner expressly provided for by the legislation of the Republic of Uzbekistan.

5.4. We do not sell, rent or share your data with third parties for advertising.

6. Storage and cross-border transfer

6.1. The servers of the processors listed in 5.2 are located outside the Republic of Uzbekistan. By giving consent you agree to the transfer of your data outside Uzbekistan for the purposes in section 3.

6.2. We do not collect biometric or genetic data through the website or the bot — data that the law requires to be stored within the Republic of Uzbekistan.

6.3. We choose processors that protect data to international standards: encryption in transit, access control and security audits.

7. Retention periods

• booking requests — no longer than 3 years from the request date, then deleted automatically;
• bot user data — while you use the bot and no longer than 3 years after your last message;
• server logs — no longer than 30 days;
• when you withdraw consent or ask us to — deleted within 10 working days, unless the law requires otherwise.

8. How we protect data

• the website works only over secure HTTPS, data is encrypted in transit;
• the booking database is not reachable from the internet; only authorised staff have access;
• access keys for the bot and the database are stored encrypted and are not published in the code;
• the website is protected against automated submissions (rate limits, bot protection) and against being embedded in other sites;
• we regularly review security settings and keep software up to date.

If we become aware of a breach affecting your data, we will notify you and the competent authority as required by law.

9. Your rights

You have the right to:

• know whether the Clinic processes your data, which data, why and to whom it is transferred;
• have inaccurate or incomplete data corrected;
• have your data deleted or its processing stopped if it is unlawful or the purpose has been achieved;
• withdraw your consent (4.4);
• complain about the Clinic's actions to the competent state authority for personal data or to a court.

10. How to make a request

Email gavharclinic@gmail.com, call 1281 or +998 95 199-77-93, send /delete to the bot @gavharclinic_bot, or visit the front desk at 46 Fazokorlar Street, Tashkent. We reply within 10 working days. To protect your data we may ask you to confirm that the request comes from you.

Person responsible for personal data processing: [to be added].

11. Cookies and local storage

11.1. The website does not use advertising or analytics cookies. Only your chosen language is saved in your browser (localStorage).

11.2. Cloudflare may set technical cookies needed for attack protection. The Google map on the Contacts page loads only when you view that page and may set Google's own cookies.

11.3. If we add analytics or advertising pixels in the future (for example, Meta Pixel for Instagram ads), we will update this Policy and ask for your consent before turning them on.

12. Changes to this Policy

We may update this Policy. The new version is published on this page with its date. If the changes affect the purposes or the data we process, we will ask for your consent again.

13. Operator details and contacts

[to be added]

Taxpayer ID (STIR): [to be added]

Registered address: [to be added]

Clinic address: 46 Fazokorlar Street, Tashkent

Phone: 1281, +998 95 199-77-93

Email: gavharclinic@gmail.com

Telegram: @gavharclinic_bot