Privacy Policy and Personal Data Processing

Website: https://pediatrbatumi.com/

Version: September 18, 2026

1. General Provisions

This Privacy Policy and Personal Data Processing Policy (the “Policy”) describes how personal data is collected, used, transferred, stored and protected when you visit https://pediatrbatumi.com/ (the “Website”) and submit a request for medical services.

The Policy applies to visitors of the Website, patients, parents and other legal representatives of children who make contact through the Website.

Personal data is processed in accordance with the applicable legislation of Georgia, including legislation on personal data protection, patients' rights and medical confidentiality.

The Website is intended to provide information about medical services and to organise appointments. Submitting a request does not replace a medical consultation and is not a way to seek emergency medical care.

2. Responsible Person and Contacts

Requests submitted through the Website go directly to Inga Kirakozova.

Responsible person

Inga Kirakozova — pediatrician, pediatric cardiorheumatologist

Practice address

Petre Melikishvili 102б, Batumi, Georgia

Phone

+995 505 05 01 14

Website

https://pediatrbatumi.com/

Inga Kirakozova is the only person with user access to the content of requests received through the Telegram bot. Requests are not duplicated to email and are not forwarded to other staff members.

The person who determines the purposes and means of processing the personal data collected through the Website (the data controller) is Inga Kirakozova. The address stated above is the patient reception address.

If medical care is provided through an independent medical organisation, that organisation's processing of medical records is governed by applicable law and its own data processing terms.

3. Data Collected Through the Appointment Form

When submitting a request, the user may provide:

• Name.
• Contact phone number.
• The child's age.
• Preferred appointment time.
• A free-text comment.

In the free-text comment the user may, on their own initiative, provide additional information, including information about symptoms, health conditions, illnesses or other circumstances related to the child.

Such information may belong to special categories of personal data and requires enhanced protection.

The Website does not require a full medical history, medical records, passports, photos of documents or test results in order to submit an initial request.

Users are advised not to include detailed medical information in the free-text comment unless it is necessary for organising the request.

4. Technical Data

When the Website is used, its technical infrastructure may process information required for its operation and security, in particular:

• IP address.
• Browser and device type.
• Date and time of access to the Website.
• Address of the requested page.
• Technical information about requests and errors.

The actual composition of technical logs is determined by the configuration of the Website and its infrastructure providers.

Technical data must not be used for incompatible purposes without an independent legal basis.

5. Purposes of Processing

Personal data received through the appointment form is used for:

1. Receiving and reviewing the request.
2. Contacting the person who submitted it.
3. Clarifying information needed to organise the appointment.
4. Coordinating the requested time with the time actually available.
5. Organising the appropriate medical service.
6. Fulfilling applicable legal obligations.
7. Handling enquiries related to personal data.
8. Ensuring the security of the Website and preventing abuse.

Information from the request is not automatically used for advertising mailings or for building advertising audiences.

Providing personal data through the form does not mean consent to its use for any other purposes.

6. Legal Bases for Processing

Personal data is processed where a legal basis provided for by the legislation of Georgia exists.

For the processing of a request, depending on the specific operation and circumstances, that basis may be the need to take action at the user's request, consent, or another basis provided for by law.

Health information is processed only where an applicable special legal basis exists and in compliance with the additional requirements of the law.

Where processing is based on consent, that consent must meet the requirements established by law.

The user may withdraw consent in the manner prescribed by law. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal and does not remove obligations to retain data where such retention is required by law.

7. Children's Data

The Website is intended for organising medical care for children.

Requests concerning a child are usually submitted by a parent or another legal representative.

A person providing a child's personal data must have the appropriate authority or another basis provided for by law.

The processing of minors' data takes into account their rights, age, legal representation and the special rules of medical confidentiality.

When the disclosure of a child's medical information is requested, the identity and authority of the person making the request may be verified.

Children's data is not used for advertising profiling.

8. How Requests Are Transmitted via Telegram

After the form is submitted, the data is transmitted through the Website's technical infrastructure using the Telegram Bot API and delivered to Inga Kirakozova's Telegram.

Requests:

• Go directly to Inga.
• Are not duplicated to email.
• Are not forwarded to other staff members for reading.
• Are used to process the enquiry and organise the appointment.

Telegram is a third-party technical service whose infrastructure takes part in transmitting and storing messages.

The fact that other staff members have no access does not mean that Telegram or the Website's infrastructure providers do not technically process the data.

Ordinary Telegram bot messages should not be regarded as secret chats with guaranteed end-to-end encryption.

Users are advised not to send detailed medical documents or other excessive sensitive information through the form.

If medical documents need to be transferred for the provision of care, the way they are provided is agreed separately, taking into account the necessity and the security of the relevant channel.

9. Free-Text Comment

The “Comment” field is intended for additional information that will help organise the request.

It is not intended for a full medical interview, making a diagnosis or remotely assessing emergency conditions.

The user determines the content of the comment, but it is recommended to limit it to the information needed to organise the appointment.

If the comment contains health information, it is processed only within the applicable lawful purpose and in compliance with the special requirements for medical information.

Submitting a comment does not guarantee that it will be read immediately.

In an emergency, seek urgent medical care rather than waiting for a reply through the form.

10. Access and Disclosure to Third Parties

Only Inga Kirakozova reads the content of requests.

Personal data is not sold and is not provided to other parties for their own advertising use.

Technical providers that keep the Website running, transmit requests and deliver messages to Telegram may take part in data processing, within the limits of their actual role.

Data may be disclosed to other parties where a legal basis exists, including when it is necessary for the provision of medical care, the fulfilment of a legal obligation or the protection of rights in cases provided for by law.

If the user later seeks the services of a laboratory or another specialist, the relevant transfer of data must have its own legal basis and be limited to what is necessary.

This Policy does not mean that all of the categories of third parties listed automatically receive every request.

11. International Data Transfers

The use of Telegram and other technical services may involve the processing of personal data outside Georgia.

International transfers of personal data must be carried out in compliance with the applicable requirements of the legislation of Georgia, including requirements for legal bases and necessary safeguards.

The use of a third-party service does not in itself release the person responsible for processing from the duty to verify the lawfulness of the relevant transfer.

This Policy does not claim that data is stored exclusively within the territory of Georgia.

12. Retention Periods

Personal data is stored for as long as is necessary for the relevant lawful purpose, unless a mandatory retention period is established by law.

The retention period for a request is determined separately from the retention period for medical records.

If a request did not lead to the provision of medical care, the need to keep its content any further is assessed separately.

If the enquiry led to the provision of medical care, the information that must be included in medical records is processed and stored in accordance with the applicable requirements.

Once the purpose of processing has been achieved and there are no other legal grounds for retention, the data must be deleted, destroyed or otherwise processed in a way permitted by law.

The procedure for deleting messages from Telegram, server logs and backups is determined with regard to the actual technical infrastructure and the applicable requirements.

13. Data Protection

When personal data is processed, security measures appropriate to the nature of the data and the risks must be applied.

Such measures include restricting access, protecting accounts and technical keys, secure transmission of information, control of administrative access, prevention of excessive storage and response to security breaches.

Access to the content of requests is restricted to Inga Kirakozova.

Technical protection mechanisms must match the actual configuration of the Website and the Telegram bot.

No data transmission or storage system can guarantee absolute security.

If a security breach is identified, measures are taken to limit its consequences and the applicable notification obligations are fulfilled.

14. Medical Confidentiality

Information about a child's health, the fact of seeking medical care, examinations, diagnosis and treatment is protected in accordance with the applicable requirements of medical confidentiality.

Such information is not published on the Website and is not disclosed to unrelated parties without a proper legal basis.

Publishing reviews, photographs, treatment stories or other materials that could identify a patient requires a separate assessment of the lawfulness of the relevant processing and the necessary permissions.

Submitting a request does not mean consent to the publication of any information about the patient.

15. Cookies and Third-Party Technologies

The Website may use technical means that are necessary for its correct operation and security.

If optional analytics, advertising or other technologies are used, their use must comply with the requirements of the law, including obtaining consent in cases where it is required.

The actual list of cookies and third-party technologies must match the real configuration of the Website.

The existence of this section does not mean that the Website uses specific advertising or analytics platforms.

16. External Links

The Website may contain links to maps, social networks, professional profiles and other external resources.

After following an external link, the processing of data by the owner of that resource is governed by its own rules.

The mere presence of an external link does not mean that the content of a request is transferred to that resource.

If third-party elements are embedded directly into a page, their actual processing of technical data must be considered separately.

17. Rights of Data Subjects

Within the limits and in the manner provided for by the legislation of Georgia, the user has the right to:

• Receive information about the processing of personal data.
• Request access to their data.
• Demand the correction of inaccurate data.
• Demand the deletion of data or the cessation of processing where legal grounds exist.
• Withdraw consent where processing is based on consent.
• Exercise other rights provided for by law.
• Appeal against unlawful processing in the established manner.

Certain rights may be restricted in cases directly provided for by law, including obligations to retain medical records.

Rights in relation to a child's data are exercised with regard to the child's age, interests, legal representation and the special requirements of medical legislation.

18. Enquiries About Personal Data

To submit a request concerning the processing of personal data, you can contact Inga Kirakozova:

Phone

+995 505 05 01 14

Practice address

Petre Melikishvili 102б, Batumi, Georgia

Where necessary, the identity and authority of the person making the request may be verified, especially if the request concerns a child's medical information.

A response is provided in the manner and within the time limits prescribed by the legislation of Georgia.

If a request cannot be granted, the person making it receives an appropriate explanation in the cases provided for by law.

19. No Consent to Advertising

Submitting a request through the Website does not mean consent to advertising messages.

Contact details obtained for appointment purposes must not be automatically used for marketing mailings, advertising targeting or building advertising audiences.

Separate marketing processing requires its own legal basis and compliance with the applicable requirements.

20. Changes to This Policy

The Policy may change when legislation, technical infrastructure or the way services are provided is updated.

The current version is published on the Website with its date indicated.

If changes require additional notification or new consent, the relevant actions are carried out in the manner prescribed by law.

A new version of the Policy does not retroactively create a legal basis for previously unlawful processing.

21. Governing Law

Personal data is processed in accordance with the applicable legislation of Georgia.

This Policy does not limit the rights of patients, children and their legal representatives provided for by mandatory provisions of the law.

In the event of a conflict between the provisions of the Policy and mandatory legal requirements, the relevant requirements of the law apply.