POLICY
of the Federal State Budgetary Institution"National Medical Research Center for Hematology" of the Ministry of Health Russian Federation Regarding the Processing of Personal Data
(version 2.0)
(Approved by Order No. 630 of the Federal State Budgetary Institution "National Research Medical Center for Hematology" of the Ministry of Health of the Russian Federation dated 21.09.22)
Content:
1. General provisions
2. Purposes of personal data collection/a>
3. Legal grounds for personal data processing
4. Scope and categories of personal data processed, categories of personal data subjects
5. Procedure and conditions for the processing personal data
6. Ensuring the security of personal data
7. Consideration of requests from personal data subjects
8. Obligations of the Operator when contacting a personal data subject, receiving a request from him, as well as a request from Roskomnadzor
9. Organization of accounting, storage, destruction and transfer of personal data carriers
10. Storage and use of tangible personal data carriers
11. Destruction of tangible personal data carriers/a>
12. Transfer of personal data carriers
1. General provisions
1.1. This Policy defines the general purposes of collecting and processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data, the procedure and conditions for processing personal data, measures aimed at protecting personal data and information on the implemented requirements for personal data protection in the Federal State Budgetary Institution "National Research Medical Center for Hematology" of the Ministry of Health Russia (hereinafter referred to as the Operator).
1.2. This Policy does not contain any provisions restricting the rights of personal data subjects, nor does it impose on the Operator powers and obligations not provided for by the legislation of the Russian Federation.
1.3. The Policy applies to the processing by the Operator of personal data of subjects, both with the use of automation tools, including in information and telecommunications networks, and without the use of such tools.
1.4. The processing of personal data by the Operator is carried out in compliance with the principles and conditions stipulated by the legislation of the Russian Federation in the field of personal data, as well as this Policy.
1.5. The Operator publishes this Policy on its official website on the Internet at https://www.blood.ru/, and also provides unlimited access to it to any person, when contacting the Operator personally.
1.6. The following basic concepts and definitions are used in this Policy:
- automated processing of personal data — processing of personal data using computer technology;
- biometric personal data — information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his identity and which is used by the operator to establish the identity of the subject of personal data;
- blocking of personal data — temporary termination of processing of personal data (except for cases when processing is necessary to clarify personal data);
- personal data information system — a set of personal data contained in databases and information technologies and technical means that ensure their processing;
- tangible media — tangible objects (including physical fields) in which personal data is displayed in the form of symbols, images, and signals.
- depersonalization of personal data — actions that make it impossible to determine whether personal data belongs to a specific personal data subject without using additional information;
- processing of personal data— any action (operation) or a set of actions (operations) performed with or without the use of automation tools with personal data, including:
- collection — actions (operations) aimed at obtaining personal data;
- record — actions (operations) aimed at recording personal data on tangible media and in the personal data information system;
- systematization — actions (operations) for grouping personal data;
- accumulation — actions (operations) for collecting personal data and forming databases of personal data;
- storage — actions (operations) with personal data aimed at creating conditions for the safety of personal data, including their protection from unauthorized access until the moment when personal data should be destroyed;
- extraction — actions (operations) aimed at extracting personal data from other information;
- clarification (updating, modification) — actions (operations) with personal data performed in order to update them in the event of a change in personal data;
- use — actions (operations) with personal data performed for the purpose of making decisions or performing other actions that give rise to legal consequences in relation to the subject of personal data or other persons, or otherwise affect the rights and freedoms of the subject of personal data or other persons;
- distribution — actions aimed at disclosing personal data to an indefinite group of persons, including publishing personal data in the mass media, posting it in information and telecommunications networks, or providing access to personal data in any other way;
- provision — actions aimed at disclosing personal data to a certain person or a certain group of persons;
- access — actions aimed at providing personal data;
- depersonalization — actions that make it impossible to determine whether personal data belongs to a specific personal data subject without using additional information;
- blocking — actions aimed at temporarily stopping the processing of personal data (except in cases where the processing of personal data is necessary to clarify personal data);
- deletion, destruction — actions that make it impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed;
- operator — a state body, municipal body, legal entity or individual that independently or jointly with other persons organizes and / or performs the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data
- personal data — any information relating directly or indirectly to a specific or identifiable natural person (subject of personal data);
- personal data authorized for distribution by the subject of personal data — personal data that an unlimited number of persons have access to by the subject of personal data by giving consent to the processing of personal data authorized by the subject of personal data for distribution in accordance with the procedure provided for by this Federal Law;
- special categories of personal data — personal data concerning race, nationality, political views, religious or philosophical beliefs, health status, intimate life;
- cross-border transfer of personal data — transfer of personal data on the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity
1.7. The personal data subject decides to provide his/her personal data and consents to their processing freely, voluntarily and in his/her own interest. Consent to the processing of personal data must be specific, substantive, informed, conscious and unambiguous. Consent to the processing of personal data may be given by the personal data subject or his representative in any form that allows us to confirm the fact of its receipt, unless otherwise established by federal law.
1.8. In case of obtaining consent to the processing of personal data from a representative of the personal data subject, the authority of this representative to give consent on behalf of the personal data subject is checked by the Operator.
1.9. The Operator collects (receives), records, accumulates and clarifies (updates, changes) personal data of personal data subjects directly from personal data subjects or IT representatives by:
- obtaining the original required documents;
- copying of original documents.
- entering information in accounting forms (on paper and electronic media);
- entering personal data into the Operator's automated information systems.
1.10. If, in accordance with federal law, the provision of personal data and (or) the Operator's consent to the processing of personal data are mandatory, the Operator is obliged to explain to the personal data subject the legal consequences of refusal to provide his/her personal data and (or) consent to their processing.
1.11. The Operator processes personal data of the following subjects in accordance with this Policy:
- employees of the Operator with whom employment contracts are concluded, former employees, candidates for vacant positions, relatives of employees, as well as persons performing work in the interests of the Operator in accordance with civil law contracts, business contracts and contract agreements concluded with them (hereinafter referred to as Employees);
- researchers involved in scientific research, analytical, and scientific and technical activities (hereinafter referred to as Researchers);
- patients to whom the Operator provides medical services (hereinafter referred to as Patients).
- donors who donate blood for the production of blood components (hereinafter referred to as Donors).
- persons who are enrolled in higher education programs; students who are enrolled in higher education programs; students who are enrolled in additional professional education programs (hereinafter referred to as Students);
- representatives of the Operator's counterparties who sign contracts and agreements on providing goods and services to the Operator, performing works in its interests, or receiving services by the Operator (hereinafter referred to as the Persons who signed the Contract).
- individuals who have applied to the Operator in accordance with the procedure established by the Federal Law "On the Procedure for Considering Appeals of Citizens of the Russian Federation" and legal representatives of the above-mentioned personal data subjects (hereinafter referred to as Persons who applied to the Operator).
1.12. The Operator is a legal entity that organizes the processing of personal data on behalf of other operators, which include (but are not limited to):
- government agencies and mandatory insurance funds to which Employees' funds are transferred or funds to be credited to Employees' accounts (tax inspections of the Federal Tax Service( FTS), the territorial branch of the Pension Fund of Russia, the territorial branch of the Federal Compulsory Health Insurance Fund, the Social Insurance Fund of the Russian Federation — in the amount of determined by the relevant authorities;
- health management bodies that are provided with reports containing personal data of Patients and Donors, Employees, Researchers and Students in accordance with the legislation of the Russian Federation and regulatory legal acts adopted by the relevant bodies within their competence (Ministry of Health of the Russian Federation), Ministry of Science and Higher Education of the Russian Federation (Ministry of Education and Science of the Russian Federation), The Russian Academy of Sciences (RAS), the Higher Attestation Commission (BAK) under the Ministry of Education and Science of the Russian Federation, the Federal Medical and Biological Agency (FMBA), the Moscow Department of Health, the Federal Institute of Industrial Property ( Rospatent), as well as organizations that are required to provide information by regulatory legal acts of health management bodies (Unified Donor Center, Moscow City Blood Experience Station, Unified State Information System for accounting of research, development and technological works for civil purposes) — to the extent determined by the relevant federal laws and regulatory legal acts (hereinafter referred to as the RLA).
2. PURPOSES OF PERSONAL DATA COLLECTION
2.1. The Operator processes personal data of personal data subjects in order to ensure the implementation of the following measures:
- ensuring compliance with laws and other regulatory legal acts, assisting employees in finding employment, obtaining education and promotion, ensuring personal safety of employees, controlling the quantity and quality of work performed, and ensuring the safety of property;
- remuneration of labor in accordance with the requirements of laws and other regulatory documents;
- conducting fundamental and applied scientific research in the field of physiology and pathology of hematopoiesis and the immune system, their ontogenesis and regulation, age-related hematology, immunology, oncology and transfusiology;
- development and implementation of new methods of treatment and medical rehabilitation of patients;
- bone marrow and hematopoietic stem cell transplantation;
- provision of specialized, including high-tech, medical care and medical rehabilitation of patients;
- providing consulting medical care at the "doctor-doctor" level in the "hematology" profile using telemedicine technologies;
- provision of medical care to patients with the use of hematopoietic stem cells and bone marrow, import to the Russian Federation and export from the Russian Federation of hematopoietic stem cells and bone marrow for these purposes in accordance with federal legislation;
- implementation of individual care at the initiative of the patient (his legal representative) in connection with the need for personal care;
- implementation of research, development and technological works on the creation of highly effective types of medical equipment, diagnostic, therapeutic and preventive technologies in the field of hematology and transfusiology;
- pharmaceutical activities to ensure the Operator's medical and diagnostic process, including the manufacture of medicines, their storage, qualitative and quantitative analysis, receipt and release;
- activities related to the turnover of precursors, narcotic drugs and psychotropic substances in accordance with federal legislation;
- procurement, processing, storage, ensuring the safety and use of donated blood, its components and blood substitutes to ensure the Operator's medical and diagnostic process;
- realization of the funds generated and acquired in situ from income-generating activities;
- educational activities under higher education programs — programs for training scientific and scientific-pedagogical personnel in postgraduate studies, residency programs, as well as additional professional programs;
- organization and holding of congresses, conventions, conferences, symposia, seminars, exhibitions in accordance with the Operator's activity profile;
- activities related to the legal protection and use of the results of intellectual activityof the operator in accordance with federal law;
- publication and distribution of printed materials containing the results of scientific and technical activities of the Operator;
- creation of information resources based on the Operator's business profile;
- providing access control, control and management of access to the Operator's territory
2.2.Only personal data that meets the purposes of their processing are subject to processing.
2.3. Through the processing of personal data by the Operator, the following objectives are achieved:
- in relation to Employees- assistance in employment, training and career development, ensuring personal safety of employees, monitoring the quantity and quality of work performed and ensuring the safety of property;
- in relation to Researchers- obtaining and applying data for the purpose of entering the results of scientific activity into the information system of accounting;
- in relation to Students-implementation of admission to training, assistance in training and employment, ensuring personal safety;
- in relation to Patients — providing them with medical care, preventing diseases, conducting scientific research by the Operator's employees (only with personal data that has passed the depersonalization procedure);
- in relation to Donors - keeping records of Donors and information about their health status in accordance with the RLA of health management bodies, providing information about Donors to authorized authorities and organizations;
- in respect of Persons who have signed a contract with the Operator- compliance with the norms of the Civil Code on contract work;
- in relation to Persons who have applied to the Operator- compliance with the legislation on the processing of citizens' requests.
3. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
3.1. The legal basis for personal data processing is a set of legal acts, pursuant to which and in accordance with which the Operator processes personal data:
- The Constitution of the Russian Federation;
- The Labor Code of the Russian Federation;
- The Civil Code of the Russian Federation;
- The Tax Code of the Russian Federation;
- Federal Law No. 323-ФЗ of 11.2011 "On the Fundamentals of Public Health Protection in the Russian Federation";
- Federal Law No. 273- ФЗ of 25.12.2008 "On Combating Corruption";
- Federal Law No. 326- ФЗ of 11.2010 "On Compulsory Health Insurance in the Russian Federation";
- Federal Law No. 125- ФЗ of 20.07.2012 "On Donation of Blood and its Components";
- Federal Law No. 149 - ФЗ of 07.2006 "On Information, Information Technologies and Information Protection";
- Federal Law No. 59- ФЗ of 02.05.2006 "On the Procedure for Considering Appeals from Citizens of the Russian Federation";
- Federal Law No. N- 5485-1 of 07.1993 "On State Secrets";
- Federal Law No. 402- ФЗ of 06.12.2011 "On Accounting";
- Regulation on the specifics of processing personal data performed without the use of automation tools, approved by Decree of the Government of the Russian Federation No. 687 of 09.2008;
- The list of standard administrative archival documents formed in the course of the activities of state bodies, local self-government bodies and organizations with an indication of the terms of their storage, was approved by Order No. 236 of the Federal Archival Agency of 20.12.2019;
- Charter of the Federal State budgetary Institution "National Medical Research Center for Hematology" of the Ministry of Health of the Russian Federation;
- consent of subjects to the processing of personal data;
- consent of subjects to the dissemination of personal data;
- consent of subjects to cross-border transfer of personal data;
- contracts concluded between the Operator and personal data subjects;
- contracts with counterparties;
- other regulatory legal acts of the Russian Federation and local legal acts of the Operator.
3.2. The Operator may process personal data in the following cases:
- if the subject consents to the processing of their personal data;
- the processing of personal data is necessary to achieve the goals stipulated by the legislation of the Russian Federation on healthcare, on mandatory types of insurance, with insurance legislation, legislation on state social assistance, labor legislation, legislation on state pension provisions, on labor pensions, for the implementation and fulfillment of the tasks assigned by the legislation of the Russian Federation to Operator of functions, powers and responsibilities;
- for the performance of a contract to which the personal data subject is a party or beneficiary, as well as for concluding a contract on the initiative of the personal data subject or a contract under which the personal data subject will be the beneficiary or guarantor. A contract concluded with a personal data subject may not contain provisions restricting the rights and freedoms of the personal data subject, establishing cases of processing personal data of minors, unless otherwise provided for by the legislation of the Russian Federation, as well as provisions allowing inaction of the personal data subject as a condition for concluding a contract. Pre-contractual work is a recruitment activity in which the subject's consent to processing is confirmed by a self-filled out questionnaire of the position applicant or a questionnaire (CV) submitted by him to a specialized recruitment organization, posted by the subject on specialized websites on the Internet or sent by the subject to the Operator by e-mail. In relation to Patients, pre-contractual activity is an activity with the aim of concluding a contract with the Patient or the beneficiary of which the Patient is a beneficiary;
- processing of personal data is carried out for medical and preventive purposes, in order to establish a medical diagnosis and to provide medical and social services, provided that the processing of personal data is carried out by a person who is professionally engaged in medical activities and is obliged to maintain medical secrecy in accordance with the legislation of the Russian Federation (doctor);
- processing of personal data is necessary to protect the life and health of the Patient and / or Donor, if obtaining their consent is not possible;
- the processing of personal data is necessary for the exercise of the rights and legitimate interests of the Operator or third parties established by the legislation of the Russian Federation or the regulations of healthcare management bodies, or for the achievement of socially significant goals, provided that the rights and freedoms of the personal data subject are not violated. Such activities include providing information to health management bodies and/or organizations designated by them, improving treatment methods and creating new treatment methods, and attracting representatives of other health care institutions to treat patients.
- the processing of personal data is carried out for statistical or research purposes, subject to mandatory depersonalization of personal data. These types of activities include conducting research work by the Operator, international cooperation with relevant organizations abroad, and other types of activities in which, in order to ensure the rights of Patients, their personal data intended for use for scientific purposes and within the framework of international cooperation must be depersonalized;
- access of an unlimited number of persons to personal data is provided by the personal data subject or at his request;
- personal data is subject to publication or mandatory disclosure in accordance with federal law.
4. SCOPE AND CATEGORIES OF PERSONAL DATA PROCESSED, CATEGORIES OF PERSONAL DATA SUBJECTS
4.1. The content and scope of personal data processed by the Operator correspond to the purposes of processing stated in Section 2.
4.2. The Operator processes the following personal data of subjects by category:
- Employees — other and publicly available personal data (special and biometric):
- last name, first name, middle name (if any);
- date and place of birth;
- gender and age;
- details of the identifying document;
- address of registration at the place of residence (place of stay, place of temporary residence);
- address of the place of actual residence;
- phone number (home, mobile), email address;
- insurance number of the individual personal account with the Pension Fund of Russia (SNILS);
- data of the Certificate of registration of an individual with a tax authority in the territory of the Russian Federation (INN);
- information contained in the medical insurance policy of medical insurance;
- information about employment (place of work or educational institution, position);
- data of the military registration document;
- data of documents on education, qualification, professional training and (or) availability of special knowledge, information on advanced training, professional retraining;
- personal data of the subject, including information about persons who are closely related or related to him (parents, spouses, children, brothers, sisters, as well as brothers, sisters, parents, children of spouses and spouses of children), and a change of surname;
- data of other documents that, taking into account the specifics of work and in accordance with the legislation of the Russian Federation, must be presented at the conclusion of an employment contract or during its validity period;
- information about the ability to perform work duties for health reasons (special category of personal data);
- information about work experience, previous places of work, income from current and previous places of work;
- account details of personal data subjects (if necessary);
- data of the employment contract/training agreement and related agreements;
- data of documents on passing the certification, interview, assessment and training results;
- information about business and personal qualities that are evaluative in nature;
- photographic images and images from the Operator's video cameras (category of biometric personal data);
- information about citizenship (citizenship), including the previous one, when and for what reason it was changed;
- information about the class rank (qualification category) of the state service of the Russian Federation, municipal service, diplomatic rank, military and (or) special rank, class rank of justice, class rank of prosecutor's employees (by whom and when assigned) (if any);
- information about the academic title and degree (if any);
- information on the form and date of registration of a previously existing and/or existing state secret access;
- information about state awards, other awards and distinctions (by whom and when awarded) — (if any);
- information about a stay abroad (when, where, and for what purpose);
- information about the presence (absence) of a criminal record, including one that has been withdrawn or expunged (special category of personal data);
- information about benefits;
- other information that may be necessary for the correct documentation of legal relations and for the provision of benefits provided for by the legislation or local regulatory acts of the Operator.
- Researchers — other and publicly available personal data:
- last name, first name, middle name (if any);
- date of birth;
- details of the identifying document;
- address of registration at the place of residence (place of stay, place of temporary residence);
- address of the place of actual residence;
- phone number (home, mobile), email address;
- citizenship;
- insurance number of the individual personal account with the Pension Fund of Russia (SNILS);
- data of the Certificate of registration of an individual with a tax authority in the territory of the Russian Federation (INN);
- information about employment (place of work or educational institution, position);
- data of documents on education, qualification, professional training and (or) availability of special knowledge, information on advanced training, professional retraining;
- information about the academic title and degree (if any);
- photographic images and images from the Operator's video cameras (category of biometric personal data);
- individual user identification number ResearcherID of the Web of Science platform;
- unique identification number of the author Author ID in the Scopus database;
- author's identification number in the RSCI system (if any);
- ORCID identification number;
- identification number of the Information and analytical system for recording the results of scientific activities "Internal portal 1—О\ОЦ of hematology for researchers";
- other external and local scientometric and bibliometric information and analytical systems and databases;
- link to the Web page (if any);
- other information that may be necessary for the correct documentation of legal relations and for the provision of benefits provided for by the legislation or local regulatory acts of the Operator.
- Patients — special, biometric, other and publicly available personal data:
- last name, first name, middle name (if any);
- date and place of birth;
- gender and age;
- details of the identifying document;
- address of registration at the place of residence (place of stay, place of temporary residence);
- address of the place of actual residence;
- phone number (home, mobile), email address;
- details of the Voluntary or Compulsory Medical Insurance policy;
- insurance number of the individual personal account with the Pension Fund of Russia (SNILS);
- information about employment (place of work or educational institution, position);
- data on the state of health, diseases, cases of seeking medical help (a special category of personal data);
- results of a clinical study of biological material (category of biometric personal data);
- information about past infectious diseases, being in contact with infectious patients and other data (if necessary) (special category of personal data);
- other medical information.
- Donors — special, biometric, other and publicly available personal data:
- last name, first name, middle name (if any);
- date and place of birth;
- gender and age;
- details of the identifying document;
- address of registration at the place of residence (place of stay, place of temporary residence);
- address of the place of actual residence;
- phone number (home, mobile), email address;
- a photographic image (a category of biometric personal data);
- information about employment (place of work or educational institution, POSITION);
- data on the state of health, diseases, cases of seeking medical help (a special category of personal data);
- results of a clinical study of biological material (category of biometric personal data);
- information about past infectious diseases, being in contact with infectious patients, staying in territories where there is a threat of the emergence and (or) spread of mass infectious diseases or epidemics, about the use of narcotic drugs, psychotropic substances, about working with harmful and (or) dangerous working conditions, as well as vaccinations and surgical interventions, completed within one year prior to the date of blood donation and/or its components (special category of personal data);
- information about previous donations;
- information about the blood type, rhesus affiliation, information about the studied antigens and the presence of immune antibodies (category of biometric personal data);
- information about awarding badges "Honorary Donor of the USSR" and "Honorary Donor of Russia";
- other medical information.
- Students — other and publicly available personal data:
- last name, first name, middle name (if any);
- date and place of birth;
- details of the identifying document;
- address of registration at the place of residence (place of stay, place of temporary residence);
- address of the place of actual residence;
- phone number (home, mobile), email address;
- insurance number of the individual personal account with the Pension Fund of Russia (SNILS);
- data of the Certificate of registration of an individual with a tax authority in the territory of the Russian Federation (INN);
- information contained in the medical insurance policy of medical insurance (Voluntary or Compulsory Medical Insurance policy);
- information about employment (place of work or educational institution, position);
- data of the military registration document;
- data of documents on education, qualification, professional training and (or) availability of special knowledge, information on advanced training, professional retraining;
- data of documents on medical activity (information on accreditation, certificates on the implementation of medical and pharmaceutical activities);
- personal data (including information about the marital status and composition of the family, change of last name, presence of children and dependents);
- data of the employment contract/training agreement and related agreements;
- data of documents on passing certification, interviews, training, and academic performance;
- information about business and personal qualities that are evaluative in nature;
- photographic images and images from the Operator's video cameras (category of biometric personal data);
- information about the academic title and degree (if any);
- information about benefits;
- other information that may be necessary for the correct documentation of legal relations and for the provision of benefits provided for by the legislation or local regulatory acts of the Operator.
- Persons who signed the agreement and Persons who contacted the Operator — publicly available personal data:
- last name, first name, middle name (if any);
- details of the identifying document (if necessary);
- phone number (home, mobile), email address (if necessary);
- position, place of work, study (if necessary);
- other information provided by the agreement or provided by the personal data subject on its own initiative.
4.3. It is not allowed to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other.
5. PROCEDURE AND CONDITIONS FOR PROCESSING PERSONAL DATA
5.1. The Operator processes personal data in accordance with the following principles:
5.1.1. Legality and fair basis of personal data processing. The Operator takes all necessary measures to comply with the requirements of the legislation, does not process personal data in cases where this is not allowed by the laws of the Russian Federation, and does not use personal data to the detriment of subjects.
5.1.2. Limiting the processing of personal data for the achievement of specific, pre-defined and legitimate goals.
5.1.3. Processing only those personal data that meet the previously stated purposes of their processing. Compliance of the content and scope of the processed personal data with the stated purposes of processing. Prevention of personal data processing that is incompatible with the purposes of personal data collection. Prevention of processing of redundant personal data in relation to the stated purposes of their processing.
5.1.4. Ensuring the accuracy, sufficiency and relevance of personal data in relation to the purposes of personal data processing. The Operator takes all reasonable measures to maintain the relevance of the processed personal data, including, but not limited to, the exercise of the right of each subject to receive their personal data for review (except in cases where this right is restricted by federal laws) and to require the Operator to clarify, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the purposes of processing stated above.
5.1.5. Destruction or depersonalization of personal data upon achievement of the stated purposes of their processing or in case of loss of the need to achieve these goals, if it is impossible for the Operator to eliminate the violations of personal data committed, unless otherwise provided for by federal laws.
5.2. The Operator does not disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law or regulatory legal acts of healthcare management bodies.
5.3. The Operator does not process personal data related to such special categories as race and nationality, political views, religious or philosophical beliefs, as well as information about the private life of personal data subjects.
5.4. Information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his identity — biometric personal data, including photographic images-may be processed by the Operator only with the written consent of the subject or in cases where such processing is provided for by the legislation of the Russian Federation.
5.5. When storing personal data, the Operator uses databases located on the territory of the Russian Federation.
5.6. When processing personal data performed without the use of automation tools, personal data is separated from other information, in particular by recording them on separate material carriers of personal data, in special sections or in the fields of forms.
5.7. When recording personal data on tangible media, it is not allowed to record personal data on one tangible medium, the purposes of processing of which are obviously incompatible. For the processing of various categories of personal data performed without the use of automation tools, a separate material carrier is used for each category of personal data.
5.8. The Operator, when storing personal data, complies with the necessary conditions that ensure the safety of personal data and exclude unauthorized access to them, and takes the necessary measures to ensure such conditions.
5.9. The Operator does not make decisions that give rise to legal consequences in relation to the subject of personal data or otherwise affect his rights and legitimate interests of subjects, based solely on automated processing of personal data.
5.10. The processing of personal data is carried out with the consent of the personal data subject to the processing of his/her personal data.
5.11. Consent to the processing of personal data authorized for distribution by the personal data subject is issued separately from other consents of the personal data subject to the processing of his/her personal data.
5.12. The Operator performs cross-border transfer of personal data only in the following cases:
- if there is a written consent of the personal data subject to the cross-border transfer of his/her personal data;
- when this is provided for by international treaties of the Russian Federation;
- for the performance of a contract to which the personal data subject is a party;
- provided for by federal laws, if this is necessary in order to protect the foundations of the constitutional order of the Russian Federation, ensure national defense and state security;
- to protect the life, health, or other vital interests of the personal data subject if it is impossible to obtain their written consent.
5.13. In case of incapacity of the personal data subject, consent to the processing of his/her personal data (request / request for revocation of consent, clarification, blocking of personal data, etc.) is given by the legal representative of the personal data subject.
5.14. Consent to the processing of personal data may be revoked by the personal data subject (his representative) upon his request/request to revoke this consent. If the personal data subject withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the personal data subject, if there are grounds specified in paragraphs 2-11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of Federal Law No. 152 - ФЗ.
5.15. When receiving consent to the processing of personal data of the subject (request/request for revocation of consent, clarification, blocking of personal data, etc.) from his representative, the Operator is obliged to verify the authenticity of the power of attorney or other document confirming the authority of this representative. The power of attorney issued to the representative must contain:
- a specific indication of who it is provided to, for what purposes and for how long;
- an indication to the Operator for what purposes consent to the processing of personal data is given (request/request);
- an indication that this action does not contradict the interests of the personal data subject;
- an indication that consent to the processing of personal data (request/appeal) is given at the will of the personal data subject;
- the reason why the personal data subject consents to the processing of personal data (request/request) through a representative, and not in person.
5.16. Any written consent of the personal data subject to the processing of his/her personal data (request/request for revocation of consent, clarification, etc.) when received by the Operator through a representative, must include: last name, first name, middle name, address of the representative of the personal data subject, number of the main document certifying his/her representative's identity, information about the date of issue of the specified document and the issuing authority, details of the power of attorney or other document confirming the authority of this representative. The Operator keeps a copy of the power of attorney or other document confirming the authority of this representative together with the consent (request).
5.17. The Operator has the right to continue processing personal data of subjects without their consent, if the processing of personal data is prescribed or provided for by law, in particular, it is personal data that:
- transferred, in accordance with the legislation, to the Federal Tax Service, the Pension Fund of the Russian Federation, the Social Insurance Fund of the Russian Federation, the Ministry of Internal Affairs, the Federal Security Service of Russia, the military enlistment office and other state organizations;
- transferred, in accordance with the legislation, to state information systems;
- provided at the request of inspection and supervisory authorities during inspections;
- provided at the request of courts and investigative authorities;
- specified in the employee's personal card (Form No T-2 or form approved by the employer).
- they are contained in the documents required for submission when applying for a job (Article 65 of the Labor Code of the Russian Federation).
- they are included in medical reports, if passing medical examinations is mandatory for the subject;
- they are contained in other accounting documents, the storage of which is provided for by law.
5.18.The Operator is obliged to provide proof of obtaining the consent of the personal data subject to the processing of his/her personal data or proof of the existence of the grounds specified in paragraphs 2-11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of Federal Law No. 152 - ФЗ.
5.19. The Employee's express consent to the processing of his/her personal data is not required, since the processing is necessary for the performance of an employment contract to which the Employee is a party — the subject of personal data, except in cases where it is necessary to obtain the Employee's written consent for specific cases of personal data processing. Such written consent is required, in particular, but is not limited to the following cases:
- inclusion of the Employee's personal data in publicly available sources of personal data, including on the relevant pages of the electronic registry, information boards of the Operator's registry, posting on the Operator's official website, and in other cases;
- processing of special categories of personal data, including processing of information about the Employee's health status by employees of the Operator who are not engaged in professional medical activities and are obliged to maintain medical secrecy in accordance with the legislation of the Russian Federation;
- processing of biometric personal data of the Employee, including his/her photographic images used to establish the Employee's identity, for example, when entering via a pass onto the territory of the Operator;
- cross-border transfer of personal data of an employee on the territory of foreign countries that do not provide adequate protection of the rights of personal data subjects. States that provide adequate protection are States parties to the Council of Europe Convention on the Protection of Individuals with regard to Automated Processing of Personal Data and States included in the special list approved by Roskomnadzor;
- obtaining personal data of Employees from third parties, including for the purpose of verifying them, as well as in cases where the data cannot be obtained from the Employee himself;
- receiving and processing personal data about the subject's private life in cases directly related to labor relations issues;
- communication of the Employee's personal data to any third party;
- disclosure of Employee's personal data to third parties for commercial purposes.
5.20. The express consent of a candidate for a vacant position of Operator to the processing of his/her personal data is not required, since such processing is carried out by the Operator for the conclusion of an employment contract at the initiative of the applicant — the subject of personal data, except for cases when obtaining written consent is provided for by federal law.
5.21. It is not necessary to obtain special consent from Patients to the processing of their personal data by employees of the Operator who are professionally engaged in medical activities and are obliged to maintain medical secrecy in accordance with the legislation of the Russian Federation, if the processing is carried out for medical and preventive purposes, in order to establish a medical diagnosis, provide medical and social services. In all other cases, the Patient's consent must be obtained in accordance with the procedure established by Article 9 of Federal Law No. 152- ФЗ.
5.22. Donors, Researchers, and Students consent to the processing of their personal data in writing upon initial application in accordance with the procedure established by Article 9 of Federal Law 152- ФЗ.
5.23. The Operator stores all consents to the processing of personal data for 3 (three) years after the expiration of the consent period or its revocation, unless otherwise provided by federal law or contract.
5.24. The personal data of the Persons who signed the agreement contained in the unified state registers of legal entities and individual entrepreneurs are open and publicly available, with the exception of the details of the individual's identifying document. Protection of their confidentiality and the consent of subjects to processing is not required. In all other cases, it is necessary to obtain the consent of the subjects of personal data representing the interests of counterparties, in the event of a legal relationship with the Operator.
5.25. When considering the application of Persons who have applied to the Operator, it is not allowed to disclose the information contained in the application, as well as information concerning the private life of a citizen, without his/her consent. It is not considered disclosure of the information contained in the appeal, sending a written appeal to a state body, local self-government body or an official whose competence includes solving the issues raised in the appeal.
5.26. Processing of personal data for the purpose of promoting the Operator's services on the market through direct contacts with potential consumers by means of communication means is allowed only with the prior consent of the personal data subject. Such processing of personal data is deemed to be carried out without the prior consent of the personal data subject, unless the Operator proves that such consent has been obtained.
6. ENSURING THE SECURITY OF PERSONAL DATA
6.1. The security of personal data processed by the Operator is ensured by the implementation of legal, organizational, and technical measures necessary and sufficient to meet the requirements of federal legislation in the field of personal data protection.
6.2. Legal measures include:
- development of local regulatory acts of the Operator that implement the requirements of Russian legislation, including this Policy;
- refusal of any methods of processing personal data that do not meet the purposes defined in this Policy
6.3. Organizational measures include:
- appointment of a person responsible for organizing the processing of personal data;
- establishing rules for access to personal data processed in the personal data information system, as well as ensuring registration and accounting of all actions performed with personal data in the personal data information system;
- limiting the number of employees of the Operator who have access to personal data, and the organization of a permissive system for access to them;
- familiarization of the Operator's employees directly involved in the processing of personal data with the provisions of personal data legislation, including the requirements for personal data protection, this Policy, local acts of the Operator on personal data processing, and training of these employees;
- defining in employment contracts with employees and their job descriptions obligations to ensure the security of personal data processing and responsibility for violations of the established procedure;
- regulation of personal data processing processes;
- organization of accounting of material carriers of personal data and their storage, ensuring the prevention of theft, substitution, unauthorized copying and destruction;
- identification of threats to the security of personal data during their processing, formation of threat models based on them;
- placement of technical means for processing personal data within the protected area;
- restricting access of unauthorized persons to the Operator's territory and buildings belonging to it, preventing their presence in the premises where personal data is processed and technical means of processing them are located, without control by the Operator's employees;
- interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing about computer incidents that resulted in illegal transfer (provision, distribution, access) of personal data;
- control over the measures taken to ensure the security of personal data and the level of security of personal data information systems.
6.4. Technical measures include:
- development of a personal data protection system based on the threat model for the corresponding classes of information systems or the levels of personal data security established by the Government of the Russian Federation when processing them in personal data information systems;
- application of information security tools that have passed the compliance assessment procedure in accordance with the established procedure;
- assessment of the effectiveness of measures taken to ensure the security of personal data prior to commissioning of the personal data information system;
- implementation of a permissive system for employees' access to information resources, software and hardware tools for processing and protecting information, and a password system for access to personal data protection information systems;
- registration and tracking of actions of users of personal data information systems;
- use of certified cryptographic protection tools when transmitting personal data over unprotected communication channels(including the Internet); detection of malicious software (application of antivirus programs) on all nodes of the Operator's information network that provide the appropriate technical capability;
- secure inter-network communication (application of inter-network shielding);
- detection of unauthorized access to personal data and taking measures, including measures to detect, prevent and eliminate the consequences of computer attacks on personal data information systems and to respond to computer incidents in them;
- recovery of personal data modified or destroyed as a result of unauthorized access to them (a system for backup and recovery of personal data);
- periodic monitoring of user actions and proceedings on violations of personal data security requirements.
7. CONSIDERATION OF REQUESTS FROM PERSONAL DATA SUBJECTS
7.1. If the fact of inaccuracy of personal data or illegality of their processing is confirmed, the personal data is subject to updating by the Operator, and the processing must be stopped accordingly.
7.2. The Operator is obliged to inform the personal data subject or his representative about the processing of personal data of such a subject carried out by him at the request of the latter.
7.3. In accordance with the current legislation, the personal data subject has the right to receive information related to the processing of his/her personal data, including information containing:
- confirmation of the processing of personal data by the Operator;
- legal grounds and purposes of personal data processing;
- purposes and methods of processing personal data used by the Operator;
- name and location of the Operator, information about persons (with the exception of employees of the Operator) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Operator or on the basis of a federal law;
- processed personal data related to the relevant personal data subject, the source of their receipt, unless a different procedure for submitting such data is provided for by federal laws;
- terms of processing of personal data, including the terms of their storage;
- procedure for the exercise by the personal data subject of the rights provided for in Federal Law No. 3152 ФЗ;
- information about cross-border data transfers that have been made or are being considered;
- the name of the organization or the surname, first name, middle name and address of the person who processes personal data on behalf of the Operator, if the processing is or will be entrusted to such a person (organization);
- information on the ways in which the operator fulfills its obligations under Article 18.1 of Federal Law No. 152- ФЗ;
- other information provided for by federal laws.
7.4. The Operator is obliged to inform the personal data subject or his representative of information, to the extent provided for in clause 7.3, about the availability of personal data related to the relevant personal data subject, as well as provide an opportunity to get acquainted with this personal data when the personal data subject or his representative directly applies, or within ten working days from the date of receipt request of the personal data subject or its representative. The specified period may be extended, but not for more than five working days, if the Operator sends a reasoned notification to the personal data subject indicating the reasons for extending the deadline for providing the requested information.
7.5. The request must contain:
- number of the main identifying document of the personal data subject or his/her representative;
- information about the date of issue of the specified document and the issuing authority;
- information confirming the personal data subject's participation in relations with the Operator (contract number, date of conclusion of the contract, conditional word designation and/or other information), or information otherwise confirming the fact of personal data processing by the Operator;
- signature of the personal data subject or their representative.
7.6. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation. The request form can be arbitrary, or it can be provided by the Operator as one of the standard request forms (Appendices N° 1-4).
7.7. The Operator provides information to the personal data subject or his representative in the form in which the relevant request or request is sent, unless otherwise specified in the request.
7.8. The right of a personal data subject to access their personal data may be restricted in accordance with federal laws, including if:
- processing of personal data, including personal data obtained as a result of operational search, counterintelligence and intelligence activities, is carried out for the purposes of national defense, state security and law enforcement;
- the processing of personal data is carried out by the authorities that have detained the subject of personal data on suspicion of committing a crime, or who have charged the subject of personal data in a criminal case, or who have applied a preventive measure to the subject of personal data before charging, with the exception of cases provided for by the criminal procedure legislation of the Russian Federation, if it is allowed to familiarize the suspect or accused with such personal data;
- processing of personal data is carried out in accordance with the legislation on countering the legalization (laundering) of proceeds from crime and the financing of terrorism;
- access of the personal data subject to his/her personal data violates the rights and legitimate interests of third parties;
- processing of personal data is carried out in cases stipulated by the legislation of the Russian Federation on transport security, in order to ensure the stable and safe functioning of the transport complex, protect the interests of individuals, society and the state in the field of transport complex from acts of illegal interference.
7.9. If the personal data subject considers that the Operator processes his/her personal data in violation of the requirements of Federal Law No. 152- ФЗ or otherwise violates his/her rights and freedoms, the personal data subject has the right to appeal the Operator's actions or omissions to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.
7.10. The subject of personal data has the right to protect their rights and legitimate interests, including compensation for losses and (or) compensation for moral damage in court.
8. OBLIGATIONS OF THE OPERATOR WHEN CONTACTING THE SUBJECT OF PERSONAL DATA, RECEIVING A REQUEST FROM HIM/HER, AS WELL AS A REQUEST FROM ROSKOMNADZOR
8.1. The Operator appoints an authorized person for processing requests from subjects (hereinafter referred to as the Authorized Representatives). Several Authorized Representatives may be appointed.
8.2. When contacting the subject or his representative, the Operator, through an Authorized Representative, must provide the subject or his representative with information about the availability of personal data related to the relevant personal data subject, as well as provide an opportunity to get acquainted with this personal data when contacting the personal data subject or his representative.
8.3. Information is provided in the same form as the request was received, unless otherwise provided by law or specified in the applicant's request, and it should not contain personal data related to other personal data subjects, except in cases where there are legal grounds for disclosure of such personal data.
8.4. The terms of providing information by the Operator, through an Authorized Representative, depend on the form of application of the personal data subject or his representative:
- if the personal data subject or his/her representative applies personally-directly when applying;
- when sending a request — within 10 (ten) business days from the date of its receipt, by registered mail with notification and (or) other method specified by the applicant. The specified period may be extended, but for no more than five working days, if the Operator sends a reasoned notification to the personal data subject indicating the reasons for extending the deadline for providing the requested information.
8.5. If the Operator refuses to provide information about the availability of personal data about the relevant personal data subject to the personal data subject or his representative when they apply, or when receiving a request from the personal data subject or his representative, the Operator must give a reasoned response in writing, containing a reference to the provision of Part 8 of Article 14 of Federal Law No. 152- ФЗ "On Personal Data" or any other federal law that is the basis for such refusal, within a period not exceeding 10 (ten) business days from the date of the request of the personal data subject or his representative, or from the date of receipt of the request of the personal data subject or his representative. The specified period may be extended, but not for more than five working days, if the Operator sends a reasoned notification to the personal data subject indicating the reasons for extending the deadline for providing the requested information.
8.6. The Operator is obliged to provide the personal data subject or his representative with the opportunity to get acquainted with the personal data related to this personal data subject free of charge. Within a period not exceeding 7 (seven) business days from the date when the personal data subject or his representative provides information confirming that the personal data is incomplete, inaccurate or irrelevant, the Operator is obliged to make necessary changes to them. Within a period not exceeding 7 (seven) business days from the date of submission by the personal data subject or his representative of information confirming that such personal data is illegally obtained or is not necessary for the stated purpose of processing, the Operator is obliged to destroy such personal data. The Operator is obliged to notify the personal data subject or his representative of the changes made and measures taken, and to take reasonable steps to notify third parties to whom the personal data of this subject has been transferred.
8.7. The personal data subject's request/appeal to the Operator and the decision taken on this request/appeal are reflected in the Log of requests of personal data subjects.
8.8. Upon receipt of a request from Roskomnadzor, the Operator is obliged to provide this authorized body for the protection of the rights of personal data subjects with the necessary information within 10 (ten) business days from the date of receipt of such a request. The specified period may be extended, but for no more than five working days, if the Operator sends a reasoned notification to the authorized body for the protection of the rights of personal data subjects, indicating the reasons for extending the deadline for providing the requested information.
9. ORGANIZATION OF ACCOUNTING FOR PERSONAL DATA CARRIERS
9.1. The measures taken by the Operator to protect personal data carriers, their means of processing and storage, exclude the possibility of unauthorized access to the media and personal data stored on them, as well as unauthorized use of material personal data carriers.
9.2. Material carriers of personal data include: Machine-readable media:
- magnetic tapes in cassettes;
- removable hard magnetic disks;
- non-removable hard magnetic disks;
- flexible magnetic disks;
- optical and magneto-optical discs;
- USB-media;
- mobile device memory cards;
- electronic means of authentication (iButton, USB tokens, etc.). Paper-based (plastic or film-based) media;
- printouts of text, graphic and other information on a paper basis;
- plastic (film) cards with information printed on them.
9.3. Machine data carriers used in the technological process of information processing, including the Operator's information systems, are subject to accounting in electronic journals or hard-copy journals.
9.4. Accounting of physical data carriers with personal data on a paper basis is carried out on the basis of the current legislation of the Russian Federation and internal regulatory documents of the Office Management Operator.
10. STORAGE AND USE OF TANGIBLE PERSONAL DATA CARRIERS
10.1. Storage of material carriers of personal data is carried out in the Operator's divisions, under conditions that exclude the possibility of theft, uncontrolled access, disrepair or destruction of the information contained on them.
10.2. The list of places of storage of material carriers of personal data is approved by an Order.
10.3. In the case of loss or unauthorized destruction of personal data carriers, an internal investigation is conducted and an investigation report is drawn up. Appropriate marks are made in the accounting logs of machine/paper carriers of personal data.
10.4. Upon dismissal of an employee, departure on vacation, business trip or in other cases of prolonged absence from the workplace, the employee is obliged to transfer the media containing personal data to the person charged with the performance of his/her work duties.
11. DESTRUCTION OF TANGIBLE PERSONAL DATA CARRIERS
11.1. Hard-copy documents containing personal data whose retention periods have expired are subject to destruction in accordance with the Rules for Organizing the Storage, Acquisition, Accounting and Use of Documents of the Archive Fund of the Russian Federation and other archival documents in state authorities, local self-government bodies and organizations approved by the order of the Ministry of Culture of the Russian Federation dated 31.03.2015 3° 526.
11.2. If the purposes of personal data processing are achieved, as well as if the personal data subject withdraws consent to their processing, personal data is subject to destruction if:
- otherwise is not provided for in the contract to which the personal data subject is a party, beneficiary or guarantor;
- The Operator does not have the right to process personal data without the consent of the subject on the grounds provided for by the Federal Law "On Personal Data" or other federal laws of the Russian Federation;
- the Operator has no legal grounds to continue processing personal data;
- receiving a request from a personal data subject for the destruction of their personal data, if the personal data is outdated, inaccurate, or illegally obtained;
- receiving a request from the personal data subject for the destruction of his/her personal data, if the personal data is not necessary for the stated purpose of processing;
- no other agreement between the Operator and the personal data subject provides otherwise.
11.3. The Operator performs systematic control and allocation of documents containing personal data with expired storage periods that are subject to destruction.
11.4. The issue of destruction of selected documents containing personal data is considered by an expert commission, the composition of which is approved by an order.
11.5. Deletion of personal data means actions that make it impossible to restore the content of personal data (irrevocable destruction of information from the carrier) or as a result of which the material carriers of personal data are destroyed.
11.6. Destruction of material data carriers that have become unusable or have lost their practical value is carried out:
- for paper media — by incineration or placement in a shredder (shredder, etc.).
- for machine-generated media — by mechanical violation of the integrity of the media, which does not allow reading or restoring personal data (sawing, flattening, etc.) or guaranteed erasure of information by software.
11.7.Third-party organizations may be involved for the disposal and destruction of media. At the same time, an agreement on ensuring the security of personal data and an act of transfer of personal data based on standard forms must be drawn up with a third-party organization (Appendix No. 5).
12. TRANSFER OF PERSONAL DATA CARRIERS
12.1. Transfer of material media containing personal data to third parties (including supervisory authorities) is possible only in cases expressly provided for by legislative and regulatory acts, or in case of separate consent of the personal data subject.
12.2. The fact of transfer must be formalized by the corresponding standard agreement (Appendix No. 5).
