1. Who processes your data

The data controller is the Municipal Non-Profit Enterprise of the Kharkiv Regional Council "Multidisciplinary Clinical Hospital for Comprehensive and Rehabilitative Treatment of War Veterans and Persons Affected by Technological Disasters" (the hospital), 85 Yevropeiska St, Kharkiv, 61166, Ukraine.

Hospital contact details are on the Contacts page.

2. What data we collect

Online appointment booking:

• phone number (required);

• full name and e-referral number (optional);

• the selected department, service, doctor, date and time;

• the IP address of the device used to book (stored only as an irreversible hash).

Patient account sign-in:

• phone number;

• a one-time SMS code (stored only as a hash);

• a rating and comment on a completed visit, if you leave them.

Anonymous doctor review:

• rating and review text (published without a name, after moderation);

• the device IP address (never published, stored only as an irreversible hash).

The website uses no advertising or analytics trackers (Google Analytics, Meta Pixel, etc.).

3. Why we process data

• to book, confirm, reschedule or cancel your appointment;

• to send an SMS sign-in code;

• to arrange medical care with the right doctor;

• to protect the website from abuse: mass fake bookings, spam and password guessing.

4. Legal basis

• your consent (Art. 11(1)(1) of the Law), given when you submit the booking or review form;

• processing of health-related data by a healthcare institution for the purpose of treatment (Art. 7(2)(6) of the Law);

• the hospital's legitimate interest in website security (Art. 11(1)(6) of the Law) — for IP address hashes.

5. Where data is stored

The website and its database are hosted on a Hostinger server in the Republic of Lithuania (European Union). Lithuania is a member of the European Economic Area and, under Art. 29 of the Law, provides an adequate level of personal data protection. Hosting resources of municipal institutions in data centres outside Ukraine during martial law is permitted by Cabinet of Ministers Resolution No. 263 of 12 March 2022.

Only authorised administrators can access the server; connections to the website are encrypted (HTTPS).

6. Who receives data

• hospital registry staff and doctors, within their duties;

• TurboSMS LLC (Ukraine) — phone number and the text of the SMS with the code;

• Mailgun Technologies, Inc. (USA) — an internal notice to the registry about a new or cancelled appointment;

• Google LLC (USA) — reCAPTCHA checks that a form is sent by a person, not a bot; Google receives technical browser data and the IP address.

Data is transferred to the USA on the basis of your consent (Art. 29(4)(1) of the Law). Data is disclosed to anyone else only where the law requires it.

7. How long data is kept

• SMS codes — up to 24 hours after they expire;

• appointment and review data — for as long as needed for the purpose of processing and to meet healthcare legal requirements;

• the internal security log (data changes, sign-ins) — for as long as needed to investigate incidents;

• patient session — 14 days; staff session — up to 12 hours.

After that, data is deleted or anonymised.

8. Cookies and browser storage

• kh_session — keeps you signed in to your account (up to 14 days);

• kh_csrf — protects forms against request forgery (up to 14 days);

• kh_accessibility_mode, howareu-promo-dismissed — remember the accessibility mode and a dismissed notice (stored only in your browser).

Google services (reCAPTCHA, the map on the Contacts page) may set their own cookies.

9. Your rights

Under Art. 8 of the Law you have the right to:

• know who processes your data, where and why;

• access your data;

• request correction or deletion of your data;

• withdraw your consent;

• object to processing;

• complain to the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or to a court.

To exercise your rights, contact the hospital using the details on the Contacts page. We will reply within 30 calendar days.

10. Changes to this policy

The hospital may update this policy. The current version is always available on this page.

Version of 3 November 2026.