Privacy Policy
Privacy Policy
Khozrevanidze Clinic LLC, ID No. 445435707, hereinafter referred to as the “Clinic” or “we”, respects and protects the privacy of users, patients, and website visitors.
This Privacy Policy explains what types of personal data we collect, for what purposes we process them, with whom they may be shared, how long we retain them, how we protect them, and what rights you have in relation to your personal data.
By using the website www.khozrevanidze.ge, booking an appointment, communicating with the Clinic, or using the Clinic’s services, you confirm that you have read and understood this Privacy Policy.
1. What Data We Collect
The Clinic may process the following categories of personal data:
1.1. Identification and Contact Data
● First name and last name;
● Personal identification number;
● Date of birth;
● Gender;
● Citizenship;
● Telephone number;
● Email address;
● Residential address or location information, where necessary.
1.2. Health and Medical Data
As a healthcare provider, the Clinic may process health-related data, including:
● Appointment history;
● Diagnoses, medical records, and recommendations;
● Prescriptions and referrals;
● Laboratory, diagnostic, or research data;
● Insurance and medical documentation;
● Information about the Patient’s health condition provided directly by the Patient;
● Other information necessary for the provision of medical services.
Health data constitute a special category of personal data and are processed only in cases permitted by law, for the purposes of healthcare services, diagnosis, treatment, health protection, insurance processes, or compliance with legal obligations.
1.3. Technical Data
When using the website, the following data may be processed:
● IP address;
● Browser type;
● Device information;
● Operating system;
● Cookies;
● Website interaction and analytics data.
1.4. Payment Data
Where online payment functionality is available, the following data may be processed:
● Transaction identifier;
● Payment status;
● Billing-related information;
● Partially masked bank card details, where necessary.
The Clinic does not store full bank card details. Payment data are processed through the relevant payment service provider.
2. Purposes of Personal Data Processing
Personal data are processed for the following purposes:
● Provision of medical services;
● Patient identification;
● Booking, management, and confirmation of appointments;
● Maintenance of outpatient and/or other medical documentation;
● Provision of diagnosis, treatment, and medical recommendations;
● Communication with the Patient;
● Customer support;
● Management of insurance and payment processes;
● Organization of laboratory or other additional medical services;
● Improvement of the website and services;
● Statistical and analytical purposes;
● Compliance with legal and regulatory obligations;
● Marketing communications only with your prior and explicit consent.
3. Legal Bases for Data Processing
The Clinic processes personal data on the following legal bases:
● Consent – where you have provided voluntary, specific, and explicit consent to the processing of your data;
● Necessity for the provision of services – where data processing is necessary to provide you with medical or other related services;
● Legal obligation – where data processing is required to comply with applicable legislation;
● Legitimate interest – where processing is necessary for the Clinic’s lawful interests, including service improvement, security protection, and management of administrative processes, provided that such processing does not override your fundamental rights and freedoms;
● Healthcare and medical service purposes – where data processing is necessary for diagnosis, treatment, protection of the Patient’s health, or provision of medical services.
4. Processing of Health Data
Health data are processed with particular care and only to the extent necessary to achieve the relevant purpose.
The Clinic processes health data for the following purposes:
● To provide medical services;
● To ensure diagnosis and treatment;
● To protect the Patient’s health and best interests;
● To maintain medical documentation;
● To manage insurance or payment processes;
● To comply with obligations established by law.
Access to health data is granted only to authorized persons, including medical personnel and those employees for whom such access is necessary to perform their professional duties.
The legal framework concerning Patient rights is also based on the protection of citizens’ rights, honor, and dignity in the healthcare sector.
5. Sharing Data with Third Parties
The Clinic may share personal data only with persons and organizations whose involvement is necessary to achieve a specific purpose.
Data may be shared with:
● Insurance companies – within the framework of financing, co-financing, or insurance services;
● Laboratories and other healthcare providers – where the relevant service is necessary for the Patient’s care;
● Payment providers and financial institutions – for processing payment transactions;
● IT, hosting, technical support, and analytics service providers;
● Marketing service providers – only where appropriate consent has been obtained;
● Government, law enforcement, or regulatory authorities – in cases provided for by law;
● The Clinic’s internal medical staff – to ensure continuity and quality of medical care.
Data are shared only to the extent necessary for the relevant purpose.
When sharing data with third parties, the Clinic takes reasonable measures to ensure that the data are processed in accordance with applicable confidentiality and security requirements.
6. Data Retention Periods
The Clinic retains personal data only for as long as necessary to achieve the purposes defined in this Policy or to comply with obligations established by law.
Retention periods are determined according to the following criteria:
● Medical documentation is retained for the period required by applicable legislation and medical regulations;
● Insurance and financial documentation is retained in accordance with applicable tax, accounting, or other legal obligations;
● Data used for marketing communications are retained for the duration of the consent or until consent is withdrawn;
● Website analytics and technical data are retained only for as long as necessary for the relevant technical, security, or analytical purpose;
● Where no specific retention period is prescribed by law, data are retained for a period reasonably necessary to achieve the purpose of processing.
Data that are no longer necessary for the relevant purpose and are no longer required to be retained by law will be deleted, destroyed, or anonymized.
Anonymized data may be used for statistical, analytical, or service improvement purposes.
7. Data Security
The Clinic takes appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction.
Such measures may include:
● Restricting access to data;
● Designating authorized persons;
● Internal data processing rules and controls;
● Technical safeguards and security systems;
● Informing employees about confidentiality obligations;
● Periodic review of data security processes.
Nevertheless, no electronic system can guarantee absolute security.
8. Your Rights
You have the following rights in relation to your personal data:
● To receive information as to whether your data are being processed;
● To request access to your data;
● To request correction or updating of incorrect, incomplete, or inaccurate data;
● To request deletion of data in cases provided for by law;
● To request restriction of data processing;
● To object to data processing, including processing for direct marketing purposes;
● To withdraw consent at any time where processing is based on your consent;
● To request data portability in cases provided for by law;
● To lodge a complaint regarding a violation of your rights with the relevant competent authority.
To exercise your rights, you may contact us at:
Upon receiving your request, the Clinic will review it in accordance with the procedures and time limits established by law. During the review of your request, we may need to verify your identity in order to protect data security and prevent unauthorized access.
9. Marketing Communications
The Clinic may send you marketing, promotional, or informational communications only with your prior, voluntary, and explicit consent.
You have the right to opt out of marketing communications at any time. You may unsubscribe using the method specified in the relevant message or by contacting the Clinic.
Opting out of marketing communications will not affect essential communications related to medical services, appointment management, payments, or compliance with legal obligations.
10. Cookies and Analytics
The website may use cookies and similar technologies for the following purposes:
● Ensuring proper functioning of the website;
● Remembering user preferences;
● Analyzing website traffic and usage;
● Improving services;
● Marketing or advertising-related purposes, only where appropriate consent has been obtained.
Cookies may include:
● Essential cookies;
● Analytics cookies;
● Functional cookies;
● Marketing cookies.
Cookies may be managed or disabled through your browser settings. Disabling cookies may limit the functionality of certain features of the website.
11. Data of Minors
The Clinic processes personal data of minors only in accordance with applicable law, with the involvement of a parent, legal representative, or other authorized person where necessary for the provision of medical services or compliance with legal obligations.
Health data of minors are processed with particular care and only for the purposes of protecting their health and providing medical services.
12. Data Protection Incidents
If a personal data security breach occurs that may create a risk of harm to an individual’s rights and freedoms, the Clinic will act in accordance with applicable legislation.
In such cases, the Clinic will take appropriate measures to assess the incident, mitigate its consequences, and, where required by law, notify the relevant individuals or competent authority.
13. Data Protection Impact Assessment
Where the nature, scope, context, or purposes of data processing are likely to result in a high risk to the rights and freedoms of data subjects, the Clinic will carry out a Data Protection Impact Assessment in cases required by law.
This may apply in particular where large volumes of health data or other special categories of personal data are processed.
14. Changes to the Policy
The Clinic reserves the right to periodically update this Privacy Policy.
The updated version will be published on the website and will take effect from the moment of publication unless otherwise specified.
We recommend that you periodically review the updated version of this Policy.
15. Contact Information
For questions related to this Privacy Policy, the processing of personal data, or the exercise of your rights, you may contact us:
Khozrevanidze Clinic LLC
ID No.: 445435707
Website: www.khozrevanidze.ge
Email: Info@khozrevanidze.ge
Data Protection Officer: Salome Mamulaishvili
Contact Information:
Email: salome.mamulaishvili@gmail.com
Telephone: 555 94 91 08
Last updated: June 11, 2026