Privacy Policy

Preliminary version. The final Privacy Policy text is approved by the clinic's lawyer before publication.

Version dated 5 August 2026, effective from that date.

This document explains what information the Plastera Clinica website and clinic collect about you, why we need it, how long we keep it and what you can do about it. We wrote it to be readable without a lawyer. It is based on the Law of the Republic of Kazakhstan "On Personal Data and Its Protection" and on Kazakhstan healthcare legislation.

1. Who processes your data

The data operator is the medical centre Plastera Clinica, Astana. The address, phone number and messengers are listed in the "Contacts" section.

A designated member of staff is responsible for personal data processing at the clinic. You can write to them at privacy@plasteraclinica.kz, the address for any question or request related to this Policy.

2. What data we collect

From website forms: your name, phone number and, where needed, email address and the nature of your enquiry. If you attach CT scans, X-rays or photographs, we receive those too.

From messages and calls: whatever you tell us yourself on WhatsApp, by phone or in a messenger while booking a consultation.

At the appointment: information about your health, examination results and treatment plan. This is medical data, it is covered by medical confidentiality and is handled more strictly than the rest.

Technical information: IP address, device and browser type, pages viewed. It lands in server logs automatically, as on any website, and does not identify you personally.

3. Why we need this data

We use it only for the reason you contacted us:

• to call you back and answer your question;
• to book your consultation and remind you about the appointment;
• to give a preliminary assessment based on the images you send;
• to provide medical services and maintain medical records;
• to support you after surgery;
• to understand which pages of the website are useful and improve them.

We do not use your data for advertising mailouts without your separate consent, and we do not pass it on for anyone else's mailouts.

4. The legal basis for processing

There are three grounds: your consent, given when you submit a form; the contract for medical services, if you become a patient of the clinic; and the requirements of Kazakhstan law, which oblige a medical organisation to keep and store records.

5. Cookies and web analytics

Cookies are small files a website stores in your browser so it can recognise it on your next action.

What is used now. Strictly necessary cookies only: the session file that keeps your connection to the site, and form protection against request forgery. Without them the booking form will not submit. These files do not collect information about your behaviour and are not shared with advertising systems.

Analytics and advertising. No web analytics counters or advertising pixels are installed in this version of the website. If the clinic adds them, we will list them in this section and provide a way to refuse them before they start working.

How to refuse. Cookies can be disabled and deleted in your browser settings, under privacy or site data. Please note: if you block strictly necessary cookies, forms on the website will stop working. You will still be able to browse the site.

6. Who we share data with

Your data is accessible to the clinic staff involved in your enquiry: the administrator, the doctor, the assistant.

Beyond them, data reaches the services that help us handle enquiries:

• the enquiry tracking system, so a request is not lost and it is clear who contacted you and when;
• the notification service that alerts the administrator about a new request;
• the hosting provider whose servers run the website.

These services act on our instructions, do not use the data for their own purposes and may not pass it on further.

Advertising systems may receive an anonymised signal that a request was submitted. It is needed to understand which advertising brings patients. Medical information, images and the content of your enquiry are never sent to advertising systems.

Data is disclosed to state authorities only in cases directly provided for by Kazakhstan law and only to the extent the law requires.

We do not sell personal data.

7. Transfers outside Kazakhstan

Some of the services above, such as messengers, the enquiry tracking system and advertising systems, run on servers outside the Republic of Kazakhstan. This means contact details from a request may cross the border.

Such a transfer is only possible where the receiving party ensures protection of personal data no lower than that required by Kazakhstan law, and only to the extent necessary for the specific purpose.

Medical records, images and examination results do not leave the clinic and are not part of any cross-border transfer.

8. How long we keep data

• Requests and contact details - until you withdraw your consent, and no longer than three years from your last enquiry.
• Medical records - for the period set by Kazakhstan healthcare legislation. We cannot shorten this period, even at your request.
• Server logs - up to twelve months.

Once the period expires or you withdraw consent, the data is deleted or anonymised, meaning it no longer points to a particular person. After that it cannot be restored. Copies in backup storage are overwritten within thirty days by the normal rotation cycle.

9. How we protect data

The website runs over a secure protocol, so a completed form is transmitted in encrypted form. Access inside the clinic is separated: a member of staff sees only what their work requires. Medical information is protected by medical confidentiality. Paper documents are stored in rooms with restricted access.

10. Your rights

In relation to your personal data you have the right to:

• know what information about you we hold, where it came from and who it was shared with;
• correct data that is inaccurate, incomplete or out of date;
• delete data obtained in breach of the law or no longer needed for the purpose it was collected for;
• block processing, that is, require it to be suspended while the accuracy of the data or the lawfulness of processing is checked;
• withdraw your consent to processing at any time, without giving reasons;
• appeal against our action or inaction to the authorised personal data protection body of the Republic of Kazakhstan or to a court.

11. How to contact us and withdraw consent

Write to privacy@plasteraclinica.kz or submit a request at the clinic. Please state your name and the phone number you left, so we can find your record, and what exactly you want: to receive information, correct it, delete it or withdraw your consent.

We reply no later than three working days after receiving your request. If a check is needed before we can answer, we will tell you within the same period and name the date of the final reply.

After you withdraw consent we stop processing and delete the data. The exception is information the clinic is legally obliged to keep, primarily medical records. Withdrawing consent does not make processing carried out before the withdrawal unlawful.

12. Changes to this Policy

If the Policy changes, the new version is published on this page with its effective date. The date of the current version is shown at the top of the document. We suggest checking this page before you submit a new request.