Privacy policy

Version of October 6, 2026

This Policy explains what personal data Viva Clinic PE receives, why, how long it keeps the data, to whom it may transfer it, and what rights you have. It has been prepared in accordance with the Law of Ukraine “On Personal Data Protection” No. 2297-VI (the “Law”) and the Fundamentals of the Legislation of Ukraine on Health Care (the “Fundamentals”).

1. Who processes your data

1.1. The personal data controller is the private enterprise Viva Clinic (ПП «Віва Клінік», hereinafter the “Clinic”).

1.2. EDRPOU code 40358245. Address: 27A Sobornosti Street, Slavuta, Khmelnytskyi Region, 30000, Ukraine.

1.3. The Clinic holds a license to conduct business activities in medical practice (Order of the Ministry of Health of Ukraine No. 601 of June 16, 2016).

1.4. Website: https://viva-clinic.com. Email for personal data requests: vivaclinic.sl@gmail.com.

2. Scope of the Policy

2.1. This Policy applies to data the Clinic receives through the website and the communication channels listed in Section 3 and, in general terms, to medical data processed at the Clinic when providing medical care (Section 6).

2.2. The website is for information only. It has no personal accounts, registration, online payments, newsletter or online store. Online booking takes place on third-party services that the website links to.

2.3. The website contains links to other resources, including the online cosmetics store garna.shop, which is a separate business. Those resources are governed by their own privacy policies.

2.4. The terms for providing medical services, including those on personal data and confidentiality, are also set out in the Public offer.

3. What data we receive

3.1. Data you provide yourself when you book an appointment or contact the Clinic: your name, phone number, and any other information you choose to share (for example, the service you need, a convenient time, or your question). You can provide it via:

• a phone call;
• Viber or Telegram (+380 68 539 50 24);
• messages on Instagram or Facebook;
• the online booking form on Google Forms (forms.gle);
• the booking form for the 40+ screening (Google Forms).

3.2. Anonymized website usage data collected by Google Analytics 4 (Section 7).

3.3. Medical data processed at the Clinic when providing medical care (Section 6).

3.4. Please do not send detailed information about your health, test results or documents through forms, messengers or social networks. To book, your name, phone number and the name of the service are enough; it is better to discuss everything else with your doctor at the appointment.

4. Purposes of processing

We process personal data in order to:

• book you for an appointment, examination or procedure, and confirm, reschedule or cancel the booking;
• answer your questions;
• provide medical care and keep medical records;
• comply with legal requirements, including those related to the electronic health care system;
• view anonymized visit statistics and make the website more convenient.

We do not use data for purposes incompatible with those listed above.

5. Legal grounds for processing

5.1. The Clinic processes data on the grounds set out in Article 11 of the Law:

• your consent. By providing data by phone, in a messenger, on a social network or through a booking form, you consent to its processing for booking and contacting you. You can withdraw your consent (Section 11);
• the conclusion and performance of a contract for medical services to which you are a party, as well as steps taken at your request before entering into it;
• an obligation of the Clinic established by law, for example, keeping medical records;
• the Clinic’s legitimate interest in analyzing anonymized website statistics. You can opt out of this (Section 7).

5.2. The Law gives special protection to health data: it may be processed for the purposes of health protection, medical diagnosis, treatment or the provision of medical services, provided that it is processed by medical professionals or other employees of a health care institution who are bound by the duty of medical confidentiality (Part 2 of Article 7 of the Law).

6. Medical data and medical confidentiality

6.1. Everyone has the right to confidentiality regarding their state of health, the fact of seeking medical care, their diagnosis and examination results (Article 39-1 of the Fundamentals). Medical professionals and other persons who learn this information in the course of their duties may not disclose it, except in cases provided for by law (Article 40 of the Fundamentals).

6.2. Medical data, such as declarations with family doctors, visit records, and test and examination results, is processed at the Clinic solely to provide medical care. It is accessible only to employees who need it for their work and who are bound by medical confidentiality.

6.3. When you sign a declaration choosing a primary care doctor, your data is entered into the electronic health care system as required by the legislation on state financial guarantees of medical services for the population. Data processing in that system is governed by the relevant legislation.

6.4. The Clinic does not publish or sell medical data and does not share it for advertising.

7. Cookies and Google Analytics

7.1. The website uses Google Analytics 4, a service of Google LLC. It stores cookies in your browser and collects anonymized statistics: which pages you view, clicks on phone, messenger and booking links, your device and browser type, and your approximate location (city or country).

7.2. We see only aggregated statistics and do not use them to identify you.

7.3. The website does not set advertising cookies.

7.4. How to opt out of analytics:

• block or delete cookies in your browser settings;
• install the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout.

The website will work without these cookies.

7.5. Google processes data in accordance with its own privacy policy.

8. Who data may be shared with

8.1. Third-party services. If you contact the Clinic through a third-party service, your data is first received and processed by that service under its own rules and privacy policy:

• Google LLC: Google Forms and Google Analytics;
• Meta: Instagram and Facebook;
• Viber and Telegram: messengers.

The Clinic does not control how these companies process data, so we recommend that you read their policies.

8.2. Cross-border transfer. Some of these services process data outside Ukraine. You choose how to contact the Clinic: if you do not want your data processed abroad, please call us. By choosing such a service, you consent to the cross-border transfer of your data in accordance with Article 29 of the Law.

8.3. Other health care institutions. If the Clinic engages another licensed health care institution to provide a service (as provided for in the Public offer), only the data needed for that service is shared with it, subject to medical confidentiality.

8.4. Government authorities: only in the cases and in the manner expressly provided for by law.

8.5. We do not sell personal data or share it with third parties for advertising.

9. How long we keep data

• Booking requests: until the appointment is arranged, and no longer than necessary.
• Medical records: for the periods established by law.
• Other data: for as long as needed for the purpose for which it was obtained, or as long as required by law.

After that, the data is deleted or anonymized.

10. How we protect data

10.1. The Clinic takes organizational and technical measures to protect data against unlawful processing, loss, damage or unauthorized access.

10.2. Personal data is accessible only to employees who need it to perform their duties. They are obliged not to disclose data they learn in the course of their work (Article 10 of the Law).

10.3. The website does not store on its server the data you enter in booking forms: that data goes to Google Forms. The website uses a secure HTTPS connection.

11. Your rights

Under Article 8 of the Law, you have the right to:

• know where and for what purpose your data was obtained, where it is processed, and who its controller is;
• receive information about the conditions of access to the data, including the third parties to whom it is transferred;
• access your data;
• receive, no later than 30 calendar days after your request, an answer as to whether your data is being processed, and find out its contents (except in cases provided for by law);
• object to the processing of your data by submitting a reasoned request;
• demand that data be changed or destroyed if it is processed unlawfully or is inaccurate;
• protection against unlawful processing and accidental loss, destruction or damage of data, as well as against the provision of information that is inaccurate or that discredits your honor, dignity and business reputation;
• restrict the right to process your data by making a reservation when giving consent;
• withdraw your consent to processing;
• know how automated data processing works and be protected from an automated decision that has legal consequences for you;
• complain about data processing to the Ukrainian Parliament Commissioner for Human Rights or to a court, and use other legal remedies.

Withdrawing consent does not affect processing that the Clinic is required to carry out by law, including keeping medical records.

12. How to exercise your rights

12.1. Email vivaclinic.sl@gmail.com, send a letter to the Clinic’s address (Section 1), or contact the Clinic in person.

12.2. To protect your data, we may ask you to confirm your identity, especially where medical data is concerned.

12.3. We will respond within the time limits set by the Law.

13. Complaints

If you believe your rights have been violated, please contact the Clinic first, and we will try to resolve the issue quickly. You can also file a complaint with the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or go to court.

14. Children

The personal data of minors is provided by their parents or other legal representatives. They may also exercise the rights described in Section 11 on the child’s behalf to the extent permitted by law.

15. Changes to this Policy

15.1. The Clinic may update this Policy. A new version is published on this page with its version date.

15.2. If the purpose of processing changes to one that is incompatible with the previous purpose, the Clinic will ask for your consent to processing for the new purpose, except in cases provided for by law.