Privacy Policy and consent to data processing

Policy on personal data processing

1. General provisions

1. This Policy defines the procedure for processing personal data and the measures to ensure its security that are applied by the operator — Mila Garashchenko [patronymic] (hereinafter the Operator) — in the operation of the website доктормила.рф (hereinafter the Website), in the provision of consultation services, and in correspondence with users.
2. The Policy has been developed in accordance with Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (hereinafter 152-FZ) and the regulations adopted in accordance with it.
3. The Policy applies to all personal data that the Operator receives from users of the Website and from clients, including through the forms on the Website, by phone, and in messengers.
4. The Policy is published for free access on the Website. The current revision is always available on this page.
5. The Operator processes personal data on a lawful and fair basis, limiting itself to the purposes stated in Section 4, and does not allow the processed data to be excessive.

2. Key definitions

• Personal data — any information relating to a directly or indirectly identified natural person.
• Personal data processing — any action or set of actions performed with data, including collection, recording, systematization, accumulation, storage, updating, extraction, use, transfer, blocking, deletion, and destruction.
• Operator — the person who independently organizes the processing of personal data and determines its purposes and the composition of the data.
• Data subject — the natural person to whom the personal data relates (a visitor of the Website, a client).
• Consent of the subject — specific, substantive, informed, and conscious consent to the processing of personal data.
• Cookie — small text files that are stored in the browser and make it possible to recognize the device on a repeat visit.
• Anonymization — actions as a result of which it becomes impossible to determine that the data belongs to a particular person.

3. What data is processed

3.1. Data that you provide yourself:

• the name or form of address you use for yourself;
• your phone number, your Telegram or WhatsApp username, your e-mail address (if you provided it);
• the content of your request: your questions, a description of how you feel and of your complaints, lifestyle circumstances, and the test results that you decide to share;
• the format of work you chose (consultation, follow-up support, program, assessment) and a time convenient for you to be contacted.

3.2. Information about your health that you provide voluntarily belongs to special categories of personal data (Article 10 of 152-FZ). It is processed only on the basis of your consent and solely for the purposes specified in Section 4. You have the right not to provide such information — in that case the scope of the consultation may be limited.

3.3. Technical data that is processed automatically when you visit the Website: IP address, cookie data, information about your browser, device, and screen resolution, the pages and time of your visit, the referral source, and anonymized statistics of actions on the page.

3.4. The Operator does not collect biometric personal data, does not process the data of children under 14 without the consent of a legal representative, and does not obtain data from third-party sources without your knowledge.

4. Purposes of processing

1. Communication: replying to your request, clarifying your question, and agreeing on the format and time of the consultation.
2. Scheduling a consultation, a follow-up support program, or an assessment, and keeping a record of what has been agreed.
3. Preparing personalized recommendations and materials for the consultation, including reviewing the information you have provided.
4. Informing you about services, programs, events, and blog materials — only with separate consent and with the option to opt out at any time.
5. Improving how the Website works: analyzing anonymized statistics of visits and user behavior.
6. Complying with the requirements of the legislation of the Russian Federation.

5. Legal grounds

• the consent of the data subject to the processing of their data (Article 6, Part 1, Clause 1 of 152-FZ);
• processing necessary for the performance of a contract to which the data subject is a party (Article 6, Part 1, Clause 5 of 152-FZ);
• processing of special categories of data — on the basis of written consent (Article 10, Part 2 of 152-FZ);
• federal laws and other regulatory legal acts that establish cases of mandatory processing.

6. Procedure and conditions of processing

1. Processing is carried out in a mixed way: with the use of automation tools and without them (paper records, notes for the consultation).
2. Access to personal data is granted only to the Operator and to persons for whom it is necessary in order to carry out the instruction of the subject.
3. The Operator does not make decisions that produce legal consequences based solely on automated data processing.
4. The data is not used for purposes incompatible with the purposes in Section 4. If new use is required, the Operator requests additional consent.
5. Data is transferred to third parties only in the cases specified in Section 7 or upon a requirement provided for by law.

7. Transfer of data to third parties and cross-border transfer

1. Messengers. If you write via WhatsApp (Meta Platforms Inc., USA) or Telegram (Telegram Messenger Inc.), your messages are processed under the rules of those services, and some of the data may end up outside the Russian Federation — this is a cross-border transfer. By sending a message, you confirm this. If you need to communicate without a cross-border transfer, please contact me by phone.
2. Web analytics systems. The Website may use Yandex.Metrica (YANDEX LLC, Russian Federation) — anonymized visit statistics, cookies, and view data. If Google Analytics is used, it transfers data to Google LLC (USA).
3. Hosting and email services. Technical data is processed by the hosting provider that keeps the Website running.
4. Payment services. When you pay for services, the bank or payment service processes the personal data to the extent necessary for the transfer.
5. The Operator does not sell, publish, or transfer personal data to third parties for marketing purposes.

8. Cookies and analytics

1. The Website uses technical cookies that are necessary for it to work (for example, remembering the state of the menu) and analytical cookies that help to understand which sections visitors use.
2. Cookies do not make it possible to establish your identity directly — they contain anonymized identifiers.
3. You can disable or delete cookies in your browser settings, or turn on private browsing mode. After you disable them, some features of the Website may work incorrectly.
4. Anonymized analytics data is stored no longer than is necessary to analyze how the Website works.

9. Storage periods and destruction of data

1. Personal data is stored no longer than the purposes of processing require, but no more than three years from the moment of the last contact, unless another period is established by law or by a contract.
2. When the purposes of processing are achieved, the need to achieve them is lost, or consent is withdrawn, the data must be destroyed or anonymized within a period not exceeding 30 days, except in cases where storage is mandatory by law.
3. Data is destroyed in a way that excludes its further recovery: deletion of messages, records, files, and backup copies.

10. Rights of the data subject

• to receive information about the processing of your personal data (Article 14 of 152-FZ), including the legal grounds, purposes, methods, and periods of processing;
• to request that the data be updated, blocked, or destroyed if it is incomplete, outdated, inaccurate, or was obtained unlawfully;
• to withdraw consent to processing at any time;
• to object to the processing of data for the purposes of promoting services;
• to appeal the actions or inaction of the Operator to Roskomnadzor or in court;
• to get in touch on any matter of data processing using the contacts in Section 14.

A response to a request under Article 14 of 152-FZ is provided within 10 business days. Requests to update, block, or destroy data are fulfilled within 7 business days of receipt of the request. The period may be extended by no more than 5 business days with notification to the applicant.

11. Security measures

1. The Operator takes legal, organizational, and technical measures to protect data from unlawful access, destruction, modification, blocking, and distribution.
2. These measures include: appointing a person responsible for data processing, restricting access to devices and accounts, using passwords and two-factor authentication, transmitting data over the secure HTTPS protocol, backup copying, keeping records of storage media, and timely deletion of unnecessary data.
3. The Operator assesses the harm that may be caused to data subjects in the event of a violation of 152-FZ and matches the scope of the measures taken to that harm.

12. Withdrawal of consent

1. Consent to the processing of personal data can be withdrawn at any time: call +7 913 837-13-32, write on Telegram @milafito, or send an e-mail to [e-mail].
2. Your request must make it possible to identify you: please provide your name and the contact you used to get in touch.
3. After receiving the withdrawal, the Operator stops processing and destroys the data within 30 days, except for data whose storage is mandatory by law or necessary for the performance of a contract that has already been concluded.
4. Withdrawal of consent may make it impossible to provide consultation services any further.

13. Changes to the Policy

1. The Operator has the right to change the Policy, including when legislation or the list of services used changes.
2. The new revision takes effect from the moment it is published on this page; the revision date is indicated at the beginning of the document.
3. By continuing to use the Website after the new revision is published, you confirm that you have read it.

14. Operator contacts

• Operator: Mila Garashchenko [patronymic], Krasnoyarsk
• Phone: +7 913 837-13-32
• Telegram: @milafito, channel @phytodoctor01
• WhatsApp: +7 903 415-16-09
• E-mail: [e-mail]
• INN / OGRNIP (tax IDs): [provide if applicable]
• Address for written requests: [postal address]

Consent to personal data processing

This text applies when you tick the consent box in the request form on the Website, send a request via WhatsApp or Telegram, or otherwise ask for a consultation.

1. List of personal data

• last name, first name, patronymic (to the extent that I have provided them);
• phone number, Telegram or WhatsApp username, e-mail address;
• the content of my request: my question, a description of how I feel and of my complaints, information about my lifestyle, and the test results that I provide voluntarily;
• the chosen format of services (consultation, follow-up support, program, assessment) and my preferred time to be contacted.

2. Purposes of processing

• communication regarding my request and agreeing on the terms of the consultation;
• scheduling a consultation, a follow-up support program, or an assessment;
• preparing personalized recommendations and materials for the consultation;
• informing me about services, programs, and materials — with separate consent.

3. List of actions with personal data

Collection, recording, systematization, accumulation, storage, updating (refresh, modification), extraction, use, transfer (provision, access) in the cases specified in the Policy, blocking, deletion, destruction. Processing is carried out both with the use of automation tools and without them.

4. Consent to the processing of health information

I consent to the processing of special categories of personal data — information about my health that I provide voluntarily — solely for the purpose of preparing and conducting the consultation and drawing up recommendations.

5. Validity of consent and procedure for withdrawal

• the consent is valid until the purposes of processing are achieved, but no more than three years from the moment of my last contact with the Operator;
• I can withdraw my consent at any time: by phone +7 913 837-13-32, on Telegram @milafito, or by e-mail at [e-mail];
• after I withdraw my consent, the Operator stops processing and destroys the data within 30 days, except in cases where storage is mandatory by law;
• I understand that withdrawal of consent may make it impossible to provide consultation services any further.

6. Confirmations

• I confirm that the personal data I have provided is accurate;
• I have read the Policy on personal data processing and understand how and for what purposes my data is processed;
• I have been notified of my right to receive information about the processing of my data (Article 14 of 152-FZ), to request that it be updated, blocked, or destroyed, and to appeal the actions of the Operator to Roskomnadzor or in court;
• consent is given by ticking the box in the request form on the Website, by sending a message in a messenger, or by other explicit confirmation; the text of the consent is available at доктормила.рф/en/privacy.html#consent.