Consent to the processing of personal data

Consent to the processing of personal data is given to the operator of the MEDGID medical portal, located on the Internet at https://medgid.kz. The portal is the owner and operator of the information system within the meaning of the Law of the Republic of Kazakhstan "On Personal Data and its Protection" No. 94-V and the Law of the Republic of Kazakhstan "On Informatisation": it determines the composition of the data processed, the purposes and methods of their processing and is responsible for their protection. This consent is valid in the version dated 10.02.2026.

Consent is given by the user freely, of their own will and in their own interest. The moment of giving consent is considered to be the ticking of the relevant field and the submission of one of the portal's forms: a request to book an appointment with a doctor, logging into the patient account, a review of an appointment or an enquiry to the portal administration. Without ticking the consent box, the portal does not accept contact details and does not create a request.

Consent is given to the processing of data necessary for booking an appointment with a doctor or at a clinic, for the operation of the patient account, for the publication of verified reviews and for responding to the user's enquiries. The portal does not collect data unrelated to these purposes.

The clinic or doctor with whom the user books an appointment receive the information necessary for the appointment and process it independently, on their own legal grounds and in accordance with healthcare legislation, including the Code of the Republic of Kazakhstan "On Public Health and the Healthcare System". This consent does not replace or cancel their processing.

Contact with the portal administration on any matters of personal data processing — by email at mail@medgid.kz and by telephone at +7 (747) 708 28 18. A response to an enquiry is sent within three working days from the day of its receipt.

The portal processes only the data that the user reports about themselves, and only to the extent necessary for the stated purposes. The portal does not request or store information about health status, diagnoses, examination results or prescriptions: the free comment field for a request serves to clarify the circumstances of the visit, and there is no need to enter information of a medical nature into it.

When booking an appointment, the following are processed: — the name by which the user has identified themselves; — contact details: phone number and email address; — the comment on the request, if the user has written one; — information about the booking itself: the doctor, the clinic and its branch, the date and time of the appointment, the type of appointment, the selected service and its cost, the language of the request and the request number.

The link between contact details and the selected doctor is stored in the database in encrypted form using the AES-256-GCM algorithm. The encryption key is stored outside the database and outside the portal's source code; without it, a request is not created at all. This link can be opened by the booking operator and by the clinic to which the booking was made.

When logging into the patient's account, the following are processed: an irreversible fingerprint of the contact details, by which the user's bookings are found, the name used for addressing in the account, the selected language of messages, the mark of the consent given and the date it was given, the list of favourite doctors and clinics, as well as information about the open session. The one-time confirmation code is stored not in its original form, but as an irreversible fingerprint — together with its validity period and the attempt counter, so it is impossible to read the code from the database.

When publishing a review, the following are processed: the text of the review, separate lines about what was liked and what was not liked, five ratings of the appointment, the date of the visit, the author's signature with a partially hidden number, and an irreversible fingerprint of the contact details, by which the review is identified as left by this user. When contacting the portal's administration, the name, contact details and the text of the message are processed. The search query string is stored separately and is not linked to the user in any way.

Consent is given to the performance of the following actions with the listed data, as provided for by the Law of the Republic of Kazakhstan "On Personal Data and its Protection": collection, recording, systematisation, accumulation, storage, clarification, modification, use, depersonalisation, blocking and deletion. Processing is carried out both by automated means, using the portal's information system, and without automation tools — by the employee who processes the request.

Dissemination of the data is limited to transferring it to the clinic and the doctor to whom the user is making an appointment. The clinic receives the name, contact details, comment on the request and information about the appointment itself — without this, the appointment cannot be accepted and confirmed. The data is not transferred or sold to other persons; it is not published in open access, except for the text of a review which the user deliberately leaves for publication and which is signed on the portal with a number with partially hidden digits.

Contact details are used to confirm the appointment, remind about the visit, invite the user to leave a review about a completed visit and to respond to an enquiry. The portal operator calls back about the request within fifteen minutes during working hours. Advertising and informational mailings not related to the user's appointments are not sent using these data; consent to receive advertising within the meaning of the Law of the Republic of Kazakhstan "On Advertising" is not covered by this consent and is requested separately.

Depersonalised information about page visits is collected by the portal only after the user's separate consent to the use of cookies. Such information includes the address of the opened page and the clicked card of a doctor or clinic — and nothing more; neither the name, nor contact details, nor a hash of the number are included in it.

Data is stored on servers serving the portal and located on the territory of the Republic of Kazakhstan. Cross-border transfer of personal data is not carried out. The portal takes protection measures proportionate to the composition of the data: encryption of the link between contact details and the doctor, storage of confirmation codes and contact details of the account user in the form of irreversible hashes, and role-based differentiation of employee access.

The consent is valid from the moment it is ticked in the portal form until the moment it is withdrawn. The consent does not have a separate validity period: as long as it has not been withdrawn, the portal has the right to process the data for the purposes named above, and after withdrawal — only to the extent expressly prescribed by the legislation of the Republic of Kazakhstan.

Storage periods are determined by the portal's own system and are observed without separate reminder: — an appointment request is stored for one year from the day of creation, after which it is depersonalised — the name, contact details and comment are deleted from it, while the depersonalised record of the appointment that took place remains with the clinic; — open access to the patient's account is closed after seven days, after which access must be confirmed again; — a one-time confirmation code is valid for fifteen minutes and becomes unusable once this period expires; — a published review is stored until the user requests deletion of their data or withdraws consent; — an enquiry to the portal administration and the reply to it are stored in the enquiries log; the reply period is three working days from the day the enquiry is received.

Termination of processing upon expiry of the period occurs automatically and does not depend on whether the user has applied. Depersonalisation of the request is irreversible: it is impossible to restore the name and contact details from it either by the portal's means or upon request.

If, after withdrawal of consent or deletion of data, the user again books an appointment, processing begins anew, on the basis of a new consent and to the same extent. Previously deleted information is not restored in this case.

Withdrawal of consent is equivalent to a request to delete one's personal data and is submitted via the form on the page https://medgid.kz/kabinet/udalenie-dannyh/. Logging into the account is not required for this: the law does not require a person to first set up access in order to dispose of their data. It is sufficient to confirm ownership of the contact details with a one-time code that the portal sends to the specified address.

Withdrawal of consent may also be declared in writing — by email to mail@medgid.kz, indicating the contact details by which the portal should locate the user's information. The request is reviewed within three working days. Reference questions about data processing are also accepted by phone +7 (747) 708 28 18; withdrawal of consent is not processed by phone, since ownership of the contact details cannot be confirmed through a telephone conversation.

Upon an executed request, the portal does the following: — appointment requests are anonymised: the name, contact details and comment are deleted, and the anonymised record of the appointment that took place remains with the clinic; — reviews signed with these contact details are deleted together with the ratings and the clinic's reply, and the average ratings of the doctor and clinic are recalculated; — the name, the selected message language, the consent mark and the favourites list in the account are deleted; — confirmation codes and messages sent to these contact details are deleted; — all open logins to the account are closed.

Withdrawal of consent has no retroactive effect: processing carried out before its receipt remains lawful. The withdrawal does not extend to information that the portal or the clinic is obliged to retain by virtue of the legislation of the Republic of Kazakhstan, including legislation on healthcare and on accounting, nor to anonymised information by which the user can no longer be identified.

The consequence of withdrawal is stated directly: after the data is deleted, the portal cannot accept a new appointment request and cannot open the account using the former contact details until the user gives consent again. Withdrawal of consent entails no other restrictions — the catalogue of doctors and clinics, the schedule and the reference sections of the portal remain accessible without any consent.