Privacy Policy

We collect and process the following categories of personal data voluntarily provided by users:

• Contact & Identification Data: Full name of the legal representative (parent, guardian) or applicant, telephone number, email address, city of residence;
• Child (Patient) Details: Child's full name, date of birth, medical referral status, and electronic referral number;
• Special Category Data (Art. 7 of Law № 2297-VI, Art. 9 GDPR): Health details, pediatric rehabilitation needs, and tentative clinical diagnosis.

Legal Basis for Processing Health Data: Processing of pediatric health information is performed strictly upon the explicit informed consent of a parent or legal guardian granted via the web form, exclusively for preliminary rehabilitation planning by the multidisciplinary clinical team under strict medical confidentiality.

When browsing the website, technical telemetry is collected automatically via Cloudflare Web Analytics and Google Analytics (browser type, interface language, operating system, session duration, and pages viewed).

Technical IP Anonymization: As IP addresses are recognized identifiers under data privacy legislation, our platform employs technical IP masking. Analytical systems truncate the trailing octet of IP addresses before persistence, preventing individual re-identification.

Full IP addresses logged in Cloudflare edge network logs are processed strictly for cybersecurity operations (DDoS mitigation, bot filtration, intrusion prevention) and are never shared with advertising entities.

Personal data is processed exclusively for:

• arranging consultations and appointments for pediatric rehabilitation and palliative care;
• maintaining direct communication with parents and legal guardians;
• processing employment applications and volunteer registrations.

Legal Effect of Form Submission: The voluntary completion and submission of any electronic form on this site with the consent checkbox activated constitutes an explicit manifestation of intent and formal consent to personal data processing under this Policy.

We implement modern administrative, organizational, and cryptographic security safeguards (HTTPS/TLS protocols, role-based access restrictions). The Center guarantees that personal data is never sold, rented, or utilized for commercial or marketing ends.

Technical Infrastructure Providers (Data Processors):

• Cloud Infrastructure & DDoS Defense: Cloudflare Inc. (USA/EU) for secure edge content delivery;
• Operational Notifications: Encrypted Telegram Bot API services and enterprise email systems (Ukr.net, Google Workspace / Gmail) for real-time alerts to Center administrative staff;
• Internal Records & Workflow: Protected Google Workspace spreadsheets and the Center's internal Medical Information System (MIS) with role-based access strictly limited to authorized clinical staff.

Lawfulness of Cross-Border Transfers (Art. 29 of Law № 2297-VI): Technical cloud platforms operate servers located in the European Economic Area (EEA), which provides an adequate level of data protection, as well as the United States. As the US lacks a general statutory adequacy decision under Ukrainian law, cross-border transfers are legitimized through appropriate compensatory safeguards — standard contractual clauses (Standard Contractual Clauses, SCC) pursuant to Article 29(3) of the Law of Ukraine 'On Protection of Personal Data' in combination with robust transport-layer encryption.

In compliance with Ukrainian legislation on electronic communications and data protection, alongside European standards (ePrivacy Directive):

• Strictly Necessary (Technical) Cookies: Automatically loaded to preserve user interface theme (light/dark mode), language selections, and session security. They do not require prior consent;
• Analytical Cookies: Employed to analyze visit metrics and enhance performance. Loaded strictly following explicit user consent granted via the Cookie Banner.

You may withdraw consent or modify cookie permissions at any time within your browser preferences.

Personal data is retained no longer than necessary to fulfill the legitimate purposes for which it was collected:

• Online Inquiries & Appointment Requests: Processed during the active communication and scheduling timeframe (up to 30 calendar days). General records of incoming inquiries are maintained in official communication logs and email archives for the current reporting year (up to 1 year) for non-profit statistical tracking;
• Patient Medical Records: Upon official admission to rehabilitation or palliative programs, records are transferred into primary medical files retained under mandatory Ministry of Health of Ukraine regulations (from 5 to 25 years depending on the statutory medical record form);
• Employment Resumes & Volunteer Questionnaires: Maintained in the internal candidate pool for up to 6 months;
• Network Security Logs: Retained for up to 90 calendar days for cyber incident auditing.

Upon expiration of statutory retention periods or receipt of a justified consent withdrawal request, records are securely deleted or irreversibly anonymized.

Under Article 8 of the Law of Ukraine 'On Protection of Personal Data', you have the right to access your personal data, know the sources and purposes of processing, demand rectification or erasure of inaccurate data, and withdraw consent.

To submit inquiries directly to the Center, contact: info@vitrylazhyttia.com.ua.